The first item on the agenda is the Executive Director's Report, Susan Barrett. Thank you. So, a couple of scheduling updates. First, we do not have a meeting next week that will be for July 4th, so we are canceling that meeting. I also want to remind folks that we have a very busy July, and so please consult our website with our upcoming July meetings. And just as a reminder, we have our Rate Review Hearings, which are being conducted on Monday, July 22nd, and Tuesday, July 23rd, both in Room 11 at the State House. We are also conducting a public forum on Rate Review, and that is located in the Council Chamber's Memorial Room at City Hall in Montpelier. A couple of other announcements. First, I wanted to introduce folks to a new member of the Green Mountain Care Board team, and that's Elena Barube. She will be the Director of Value-Based Programs and ACO Regulation. She will not be presenting the team today because she just started on Monday, but she's catching on very quickly. Elena comes to us from the Department or the Agency of Education, where she was the Manager of Finance for Special Education. She also has background in academia and corporate finance, so I welcome Elena. Okay, I'll turn it over to you after that. And then also just wanted to let folks know that this week, was it just yesterday? I think it was yesterday morning. The Rural Health Care Task Force met, and that was per Act 26 of last session. The legislature asked that a group of identified participants to ask them to come together to evaluate the current state of rural health care in Vermont and identify ways to sustain the system and to ensure it provides access to affordable, high-quality health care. I am pleased to announce that our own Robin Lunge was nominated as the Chair of that Task Force, and so she will be working along with the group to make sure that we have a report back to the legislature in January of 2020. And if you have anything to add, you can, Robin, or you don't have to if you don't want to. No, I mean it was an organizational meeting, so we got ourselves organized, and we'll have many more meetings to come. Perfect. And Mr. Chair, can I turn this over to our general council, who will announce a rate review decision? Sure. Thank you. So on Monday, the board issued a decision disapproving the 2020 Association Health Plan rate program filing submitted by Blue Cross Blue Shield without prejudice to refiling, so they can refile that filing at a later date when it is not appropriate to do so. And that's the decision. I have nothing else to report now. Thank you. The next item are the minutes of Wednesday, June 19th. Is there a motion? It's been moved and seconded to approve the minutes of Wednesday, June 19th without any additions, deletions, or corrections. Is there any discussion? Seeing none, all those in favor signify by saying aye. Aye. Any opposed? Thank you. We have a very short agenda today, so we welcome Marissa and Melissa to join us down the front. Can you take it away? Thank you. Good afternoon. My name is Marissa Melamed. I'm here with Melissa Miles, and we're back today to present to you the final 2020 ACO budget guidance and certification eligibility form. We began development of the 2020 guidance in mid-March with internal review of last year's ACO budget and certification guidance and review process. The guidance is reviewed and adopted annually by the board to assist the public and the regulated entity by providing our current approach to or interpretation of the statute and rule. The guidance development process includes reviewing the questions, data collection tables, and budget submission from last year in incorporating any required statutory changes or process improvements. In addition to our internal review, we consulted with OneCare and the Office of the Healthcare Advocate to inform the guidance. We presented the draft guidance at the June 5th board meeting. We reviewed public comment and we're here today to present any updates or changes and recommend a vote to adopt the guidance for the 2020 ACO budget submission. So our agenda today is pretty simple. I'm going to go over the 2020 certification eligibility verification form and we're going to review the public comment and changes on the budget guidance and recommend a vote on the guidance. So we went over this June 5th, but to review the Green Mountain Care Board has the regulatory authority to provide oversight of accountable care organizations with two different mechanisms, certification and budget review. After initial certification, which happened in 2018, the yearly review is to verify ongoing eligibility under the criteria in Rule 5. The yearly review of the ACO's projected budget is where we look at their network, payer contracts, budget, and population health programming. Then through reporting, we monitor the ACO's activities related to the budget throughout the year and we collect updated policies and procedures related to certification. So the guidance is developed under this authority and the standards and requirements by which we review the ACO's submission are set forth in 18VSA 9382, GMCB Rule 5.0, and the all-payer model agreement. So for a review of annual certification, we annually review the One Care's eligibility for certification by asking the ACO to complete a form, identifying material changes to policies, procedures, programs, organizational structures, provider network, health information infrastructure, or other matters addressed in the 10 certification sections of Rule 5.0 that are on the slide. And the annual eligibility review is our opportunity to ask the ACO to attest to material changes and verify that we have received the latest documentation. So this year, we were able to more closely align the timing of the certification form with the budget guidance. There were no changes to the certification criteria this year. So last year, we brought this form to the board for a vote because there was three new criteria that we needed to review in 2019 that we did not in 2018. This year, the board does not need to vote on the form because there's no new criteria. The form is substantially similar to last year in that it asks for changes to policies and procedures. It includes 15 narrative questions on specific criteria that are related to certification such as governance, mechanisms for obtaining consumer inputs to inform the public or other consumer protections, updates to informatics, platforms, and attestation on the antitrust guidance that the board issued and compliance with the new criteria that we reviewed last year. So the form is now completed. It's posted on our website under 2020 ACO budget and certification. We've done a little work on the website to make it a little bit easier to navigate and find materials and we're continuing to work on that process, particularly in this interim time between issuing the guidance and receiving the submission. The form is now posted, but it will be formally issued to OneCare on July 1st along with the budget guidance. And then we've asked that the form be completed by September 1st so that we have additional time or we have the month before the budget submission to review the certification. So just a reminder of what we presented June 5th. This is an overview of, I'm switching now to the budget guidance. This is an overview of what is in the budget guidance and we are going to highlight changes that we made from what was presented June 5th to what we have posted now as our recommended final guidance. And I'm going to turn that over to Melissa. Thank you, Marissa. So as Marissa mentioned, we shared the FY20 ACO budget guidance with the healthcare advocate in May. They provided feedback on the guidance which we worked to incorporate. In follow up, they submitted a public comment on June 17th that can be found on our website. And of note, they provided some questions for our staff in those public comments as a result of the meeting that we will be responding to and posting to our website when they're complete. They also requested the option to submit questions for OneCare to answer simultaneously when OneCare responds to GMCB's FY 2020 guidance in October. And we have agreed to this and those questions will be received by the Board mid-July and also posted to our website with the guidance. So now I'm going to review the two comments that pertain to your approval today of the FY20 budget guidance. And they can be found in section 5, which is the ACO quality population health model of care and community integration initiatives. So this is question 3. And I think I'll just read the question to give you some framework. So how have OneCare's population health investments supported transformation and care at the local level? This includes the complex care coordination program, Rise Vermont, the regional clinical representatives and other initiatives directly funded by the ACO. The ACA's suggestion was please note in your description of each initiative which population health program investment budget items it pertains to under Appendix 5.4. So if you'll recall Appendix 5.4 is where all of the population health investments are listed and how they tie back to the criteria in Act 113 as well as a description of them in the total dollar amount. So we agree with this. We had already worked with the HCA on the last sentence which is that if you're providing support other than financial, please describe because OneCare provides both, sorry, but OneCare contributes through financial and also non-direct financial means including they have clinical consultants out in the community, technical assistants and the population health investments. So we agree to what the HCA suggested but would like to offer modification to replace it that you will see underneath. So for each program list the population health investments referenced in Appendix 5.4 that the community or OneCare is using to support the program. So we would expect that if OneCare lists any of these, any initiatives they would then also tie those investments to them in the qualitative written portion of our guidance. This is an evolving program as we understand and maybe, you know, we will continue to refine some of these questions. This question was worked on a bit this year to be able for OneCare to be able to fully describe all that they're doing in the community. So secondly on question nine, by payer in line of business, provide an analysis of your most recent annual ACO quality reports for measures. In addition provide results and analysis for the measures included in each payer contract including the quality scores, benchmark and percentile for each payment and reporting measure for 2018. The HCA's suggestion was to add in for any previous years for which information on the measure was collected and then back to our question then and results of patient or provider surveys. Describe how these results have informed the ACO's programs and model of care including the ACO's annual quality improvement program. So we, you know, in talking with staff and also with the board, we accept the HCA suggestion but have a modification to it to be able to tie the analysis to how the results from their previous years are influencing their quality improvement initiatives and also their programs that they're developing. So we do acknowledge that there may be some statistical limitations to comparisons so which we've asked OneCare to acknowledge. So in conclusion the staff recommend that the board vote to approve the guidance as presented June 5th, 2019 with the recommended changes to section five questions three and nine presented June 26th, 2019 today. So now we'd like to offer it up for board questions please. If there are any. Question to the board. Any comments from the board? I would make a motion if you're ready for a motion. I'm sure we'll do a public comment on that. I move that we approve the guidance as presented on June 5th, 2019 with the recommended by staff changes to section five questions three and nine as presented today, June 26th, 2019. Is there a second? Second. Okay, moved and seconded. At this point we'll open it up to public comments or questions. Yes. Thanks. First I just wanted to thank Phyllis and Marissa for working with us and for working to incorporate some of our feedback in this draft. And I just wanted to note that we, on the first point, we do believe that the change that was made addresses what we were looking for. On the second point, we don't believe that it does, but since we will be submitting questions to be included with the guidance, we can ask for the information that we're looking for in our questions so we don't see a problem with it being done in that way. The only thing I did want to note is, so the information we are looking for is year over year quality data. And the way that it's currently written, the data that's being requested is only for the current year. And then one cares asked to kind of narratively describe how pastors have informed their quality improvement programs so that we do think that's important information to include, but having the actual data to back it up we think is essential so you can expect to see that in our questions that we'll be sending. And then so one of the questions that we also included in our comments that was a question for the board staff is related to the board's position on year over year quality information and how the board plans to kind of look at that information so that's something we're looking forward to hearing more about what we do as we respond to those questions. So my understanding and maybe you all correct me, we have the results from prior years. So it's not the fact that we don't have the results because we're not asking them to repeatedly give us results that they already have. We're asking them to describe how they're using the results from prior years that we already have in their programming for this year. Is that more or less correct for the advocate yet? Yes, that is correct. And as we start to look at the author and model results there are some NCO author and model measures in there that we will also be examining through time up to 2022. Other comments or questions? Yes, Susan? Susan Aronoff from the Vermont Developmental Disabilities Council and I didn't submit comments because I thought that the guidance collected both the quality performance data from all of the payers and all the programs and the financial performance information. But in looking back over both the comments and the materials for today's meeting and the conversation I was having with a colleague I was able to point out and it was in one of the slides that was just discussed where you collect the information about past quality performance. But I couldn't find anywhere and if you could point it out that would be great and if it doesn't exist it would be a comment. I know it's outside the comment period so take it for what it's worth. But that as they submit their budget if one care could provide what their performance was in Blue Cross it's the only place we get it. We can't get it from the Medicare website or from Diva. So Blue Cross financial performance, the private ones financial performance and Medicare and Medicaid. I know Medicare results might not be available till whenever but as soon as they are available and if that could be cumulative because I think that I understand your point that they submit stuff so maybe you guys already have it. But just as a researcher trying to find stuff it is really hard to look at year after year performance when you can't access the data in any one single place. Because the Green Out Care Board has the affirmative duty under the state action doctrine to not give any ACO the safe harbor of being able to engage in price negotiations or whatever unless, unless there's a benefit in savings and cost to the population. I would think the Green Out Care Board should be looking year after year to see are we saving any money for the population yet or slowing the curve and is the quality improving yet? So I would think you guys would want this year over year information easily accessible too and it just isn't right now. I kind of respond to that in part and I would also comment if they have additional comments. So this year we did add in section four of the ACO budget and financial plan there are questions six and seven so for their first year being in the all care model in 2018 we've asked them to put down what their total shared savings and losses were and provide a qualitative and quantitative summary of that shared savings distribution plan for 2018 as well as a quality with hold question providing a quantitative and qualitative summary of your quality with hold distribution plan for 2018 as well we also have a table that we've asked them to fill out back to 2017 which would show shared savings and losses both from 17 forward up to 2020 I believe. Yes, I thought. The table is by Payette. Other questions or comments from the public? Seeing none there's a motion on the floor from for the board to approve the guidance as presented June 5th 2019 with the recommended staff changes to section five questions three and nine which were presented today. Is there any further discussion by the board? If not all in favor signify by saying aye. Any opposed? Thank you, Marcia, Melissa. Thank you. Is there any old business to come before the board? Seeing none is there any new business to come before the board? Seeing none is there a motion to adjourn? Second. All those in favor signify by saying aye. Aye. Any opposed? I might have just set a record. Thank you.


How do I get rid of bubbles? Without question, the best way to take care of bubbles is with an artist's torch. So whether you use a handheld device or a bigger torch for bigger projects, the flame from a torch is hot enough to thin out the resin to allow those bubbles to escape. It's your best bet against bubbles every time. Seal anything that may contain trapped air like wood or inkjet prints. Make sure the resin is at least at room temperature. You can give your cold resin a warm water bath, if you like. Stir your resin mixture slowly. Whipping it will induce more bubbles. Pour your resin out slowly and pour close to the surface. Pour in 1 eighth of an inch layers. If you pour thicker than this, bubbles won't have a chance to escape or get torched out. Always use a torch to get rid of bubbles. Heat guns just can't match the heat of a flame. If you follow this advice, you should have a bubble-free piece every time.


Bookment has the option to display the last traded volume with two aggregate numbers. The white number here is displaying the total aggregate volume that has taken place here at this price level of $22.55 and ¾. The red number here in parentheses displays the last traded volume here that took place on the best bid. These were aggressive market sell orders for six contracts and therefore it is red because it is market sell volume. I'm using the move tool here and we'll scroll back and demo how this actually works. So last traded volume here was aggregate of nine total and all of those nine contracts were here on the best offer. As I scroll forward we see more trades or more volume that has traded here on the best offer and we're showing the aggregate. All of the volume here has traded on the best offer with aggressive market buy orders. Ninety-five contracts total and ninety-five of them were aggressive market buy orders. However, note that we see a shift here in the best bid offer. We are still trading at the same price level of twenty-two fifty-five and three-quarters. But as I scroll forward we see the distinction here. Now we are trading on the best bid. The best offer is a tick higher. We're still trading at the same price level. So we see ninety-five contracts here that have traded and all of those traded on the best offer and then as I scroll forward we see that three now have traded here on the best bid and these are aggressive market sell orders and that number is now displayed here in the aggregate view for the red number in parentheses. That has refreshed and is now displaying three but the overall number that was ninety-five previously is now showing ninety-eight. So it is aggregating all of these trades that have taken place here at this price level. Now if the price level changes and if I zoom out a little bit we can see that everything is traded still here at this same price level and we see the complete aggregate here in the white number. Okay, a hundred and fourteen contracts and nineteen of those were last traded here on the best offer and then you can see the distinction here. Now we have refreshed and we have traded at a new price level up to twenty-two fifty-six. So we see that the last traded volume up here was for seven contracts and we have the aggregate for seven here aggressive market buy orders on the best offer. In this case both numbers here have refreshed and the aggregate counters begin again. This has been a highly requested feature by professional traders for some time now they can understand areas of potential exhaustion absorption and trap volume by comparing the last traded volume here with the overall aggregate and the aggressor aggregate comparing it with the liquidity that we see in the limit order book. If you don't like this view you can always change it up here to the configurations button and we'll deselect aggregate last trade. So now book map is displaying the last traded volume was three contracts at this price level.


One of the most common questions I get asked is, you know, how do I start day trading? So what me and my mentor about it for our viewers on YouTube is create a free mentorship course that reveals our 12 secrets that every single brand new day trader should know before they get started. But please take note that there is limited seating every single week. So please reserve your spot at myinvestingclub.co link is in the description. All right. Enjoy the video guys. Okay. So today it's kind of, it's funny. I have a list of topics that I like to do every single week. And sometimes what I want to do gets interrupted between what I feel I have to do, like I feel like there's some necessity ones. Like you guys can probably tell the webinars that I do that like I really want to do, like, like moments that matter. Like I was really excited about that one. Um, and you know, I can't remember like all the other ones like evolution of a trader is one that I want to, this one is kind of one that I feel like I kind of have to do. Um, uh, just because when I get a lot of DMs about it and one, like, I, like, I'm still getting, um, it's still, it's still a flaw I see in all of the chart, chart recaps and stuff. And so today we're going to be talking about full-sized positions. We're going to, I mean, specifically this is going to be a kind of like how to really technical, like let's dig into the chart and be how do we get into full-sized, when it's the most appropriate, when to not be in full size, why we don't seem to get in full size and all, all that good stuff. I would actually say that this is probably a little bit of a squeeze. And just because like we're, you know, we got this, like this gap up green, green, green stuff. And I think it's just because people just didn't expect it. Probably a lot of shorts up here that are stopping out. So I'm guessing that's what it is. I mean, I'm sure there's probably a bullish outlook now as, I mean, it seems like, again, not to get political, but I guess I think the market kind of runs on that a little bit, but like, it seems like we're seeing less COVID headlines and more rioting headlines. And so, you know, or rioting and protesting and stuff like that. And, um, racial injustice and all that kind of stuff. And so we're seeing, like, that's more, um, dominating the headlines a little bit and less so, like all these cases, all these cases, all these cases. And, you know, with the lack of all of the, look at these new cases, look at these new cases, look at these hospitals, look at the, the outbreaks and all that stuff, because, I mean, there's still a little bit of it, but just the mass decrease of that and the more focus on the racial injustice kind of, um, you know, politics there, I think that's kind of just kind of quelled the fears just because people aren't being reminded of it every single day. Is it a sector? No, it's not a sector. There might be a sector, like the shipping, yeah, like, yeah, a sector. When these sector plays go off, right? Whether it's shipper of China, tech, energy, um, COVID, right?  Well, at the tail end of the sector is when people stop caring about the PRs. Yeah, it's like a, yeah, people stop caring about these, these PRs.  And so we're kind of seeing that, right? When COVID PRs come up, people don't care, right? People just don't care. Like we're, you know, like people think that like bigger companies are on, on the, like we're already starting to get an edge of the vaccine kind of stuff.  So if you're along good, I mean, good luck, man. It's really difficult. Like I'm, I'm more of a long and I like to just, I've just been toning it back. Um, and I want to talk about that after once I finished this slide. Barrage factors, obviously the works that works, that kind of stuff. Givo XSPA offering and even, even the, uh, actually I'm kind of lazy. I didn't see the end of PED today, but didn't like epically get down. Hey guys, my name is Tosh Bradley. I'm one of the head mentors and moderators at my investing club. If you have any questions about getting started in trading, getting started in the MIC, MIC in general, text me at<PHONE_NUMBER>. This is not a robot. It was me directly on the other end of my business line. And we'll get you in the club. We also have special promotions going on that I can get to you depending on your trading needs. Hit me up. Back to the video. Anyway, uh, so I, so basically CJI XS was my trade on it. I just bought the VWAP reclaim and sold into 950. Um, because it's kind of just what I said, it's a VWAP reclaim. It didn't have power. I didn't like that a VWAP reclaim and I thought it could run into resistance at nine and it did. That's like, well, shit, I'm probably selling it all right here. And it did. Like good thing I did is it dropped mass weight of 750. And the stock is hard to borrow and has options available. Do I trade the put options? I don't trade options. I should, but I don't know. I'm kind of lazy. I mean, options is kind of like the small caps of large caps. Like I should. Um, yeah, it's just a VWAP reclaim, no power. If it was going up, it was going to do so either grindy or rangy, kind of what I just talked about. If this was going to go up, it would have been grindy or it would have been rangy, right? And both of those I'm not good at. So I don't like to be a part of it. I like taking the shots that I like to take and very few shorts. You never want, yeah, you never want a stock that went from weak to strong. You never want a shorter stock that went from weak to strong. And so order a couple of ways to identify that this was weak to strong.  That's what shorts see out of this stock. I know I'm a short, right? If I'm shorting the stock kind of sub VWAP thinking fade and are cracked at the open, right? This is what I see. So I see that there are shorts down here hoping for this fade that chasers and there's also people, some VWAP shorts, but there's also some fantasy orders here. So here's the thing. When this pops up and hits all of them, all of them in one swipe, right? Like if you did a two minute charts in one swipe, right? You do a two minute charts in one swipe. Not like I really do that. And so, I mean, naturally it squeezes, right? Naturally it squeezes. Yeah, I would consider this. I would definitely consider that a short shot because the strong move happened too fast, right? Like, you know, if it's slower, if it pushes, if it kind of rejects harshly, like if this reject would have came back sub VWAP, different story, right? But it held and it stayed. And that's what caused the trap is because it kept people, it kept shorts unhappy for a long enough period of time. And of course, this was the easy to borrow one, right? So naturally you have a lot more shorts than because everyone can short this one. And for a week, there's been no borrows on anything. So everyone's shorting this one because they can. This was actually a solid trade.  Someone actually messes me about this. And here's, here's what I want to talk about. Like this is a really good example of starting late and starting slow and kind of like how you can use that one here. When you have one really solid line, the starting late and the starting late and starting slow strategy would say just put your order at 550, small order and just kind of give it an hour, right? That's kind of like the start low and start late webinar. I think that's, I think I called it the powerful pair or something. That's a webinar I talked about that. This is the only really trade setup I saw on this. There was a VWAP reclaim down here. I mean, look at the volume. You can't, you can't take this trade on the VWAP reclaim trade. You can't really take this. Like that's really hard. Like it's in the middle of the day. Like you got it. Like this is hard. Like you can put a stab on here, I guess. I mean, I don't know. Did news come out maybe then? Like because the light, like, I don't know. This is a very hard long to capture because of the low volume makes it really difficult to catch on your radar. And in this week, where longs kind of suck. This and this kind of price action when it kind of, everyone knows like there's like a level here at 550 from the pre-market. So like 540 kind of stuff here. So like, you know, if you missed it, it's kind of hard. That's why you just kind of, this is the kind of trade where you kind of have to, if you're going to short it, you're going to short it on this line. You're going to go small and like just give it time. That's the kind of trade that you need to take with this kind of stock. I feel these kinds of like stocks with super obvious lines, but it's kind of like making it, making it look like it can break like this, like a consolidation kind of stuff. This small size in the way.


We've actually successfully raised a whole generation of kids now in virtual complete disconnect with nature. And when you reconnect that, you'll suddenly realise that you have the whole curriculum on one square metre of vegetable garden. It's not necessarily the information that you remember from your educational experiences, it's the actual experience. So the pace thing for me is that we want to be fast, but in some ways we can be faster if we can be slower. As a strategist, I'm really delighted and excited when I see discussion about a certain topic which is education for our planet across all of these scales. We've gone from bugs to insects to products to 3D printing to indigenous and ancient wisdom. As indigenous people we have a story, we have a connection, we have practices and behaviours that reaffirm this connection. But that is not something that is just strictly for indigenous people only. I feel that that's something that we all as human beings have a role and responsibility for. Until we reconcile our relationship with Papatūānuku, it's going to be very difficult for us to reconcile our relationship with each other. And so how do we do that?


Hi guys, welcome back to Daniel's Tech World on YouTube, Medium, and DanielRosal.tech. So for today's video, I want to just quickly, this is not a five minute long plug for my book on Amazon, The Confused Freelancers Guide to Technology, but I have it up here because it is one of the topics I cover, and this is something that I see a lot whereby people will buy their domain, which is always good to buy your own domain name and not to be using something like a branded subdomain on Wix.com or one of these other, I keep calling them all you can eat, Click and Point DIY website builders that anyone who has bought this book and they haven't started marketing it yet, so it's just fresh on the market, but anybody who reads this will know very quickly that I'm not much of a fan of these all-in-one editors because if you want to build something with skill, now some people say do stuff that doesn't scale, but if you do want to take the opposite approach and do things that have a chance of scaling, you're much better off separating out your provider between your hosting company, your domain name company, and actually understanding what's going into making your website tick on the internet, including the DNS records. All of these things, if you're going to be moving around to different infrastructure providers, are going to matter some day. They may not matter now, but when you get to your world domination stage, they will. Okay, so basically if you've gone ahead and let's just do a real example here, it'll be easier to explain like this. I'm going to go back into this demo account that I use in all my videos and let me just sign in quickly. Okay, so I've just signed into my demonstration Gmail and there's really not much in here just used for these videos. So what I'm going to do is show you where you can add more email addresses. So if you click on the accounts and imports, that's the fourth tab across to the right at the time of writing. Now if you haven't set up any additional sending accounts, then you're just going to have the Gmail address itself as sent as. Now the Gmail UI has a habit of changing quite frequently. Used to be able to set up your signatures here. Now signatures are taken care of somewhere in the signature. So you don't want to generally do that as well. And let's firstly add the second our new email address. So I have just in the last week set up again for these videos this this domain called DanielRosal.Tech. So what I'm going to go ahead and do is log into my cPanel and I'm going to create an email at DanielRosal.Tech and then I'm going to add that as a sending address in Gmail. Okay so I've gone ahead and loaded up my cPanel for this domain name and if you scroll down a little I scroll down a bit from the top your cPanel might look a bit different. It varies a lot between hosts. This is actually part of a reseller hosting account so there's actually quite a lot. If you have a like a little cheap shared hosting thing they may restrict this but this is a quite decent array of cPanel options but irrespective of whether you have a lot or a little you should have the few things that I'm going to show in order to make this system work for you. So they're all email related. One is email accounts. The second is forwarders. The third is default address. Now you might see this described as catch all and the next thing is some kind of spam filtering. It depends what spam filter your web host uses but this one's called spam experts and I explained in the book why you want to basically take off spam filtering at the host level and that's because Gmail has its own spam filter. As you know if you just jump back to our inbox for a second we have the spam inbox here and Gmail will process whatever you send its way and apply spam filtering so it doesn't you might think it makes more sense to do spam filtering twice. It actually doesn't because you're just going to increase the risk of legitimate email being caught in one or the other spam filter and additionally in Gmail there is this nice feature. If I can for example use my own website here the email I sent you have this option that if I want to send an email to myself let's say what I'm putting in a wildcard here. Wildcard stands for any email address at dsrghostwriting.com and I can create a filter that never send it to spam. So basically the Gmail spam filter or the G Suite spam filter if you're using your own domain on G Suite is very good and it is disadvantageous to use spam filtering at both levels. So what I do is go into spam experts which is the one that my host has got running over here and you will want to basically disable. Now you can also if I go back up you can also just search for spam and you can see spam filters there might even be a couple of overlapping systems sometimes. So I'm just going to go to spam filters here and I've already actually disabled. You can see here process now when I got the account it looked like this. So I basically disabled process new emails I marked them as spam so that means that there's no spam filtering happening at my C panel it's just going to pass stuff on. So let's go and set up an email just to associate with this Gmail over here. So the first thing I'm going to do is jump up to email accounts and I'm going to go ahead you can see I've already set up demos and Daniel and Dero's little tech. I'm just going to create a new one from scratch over here and I'm going to click on the create button to do that. This is a screen and I'm just going to call this Gmail underscore demo because I'm going to be showing how to attach that to Gmail and I'm going to give myself a password as well. Now you can see that the storage space here is set to just a little bit over a gigabyte 1,024 megs. Now you this is one way of setting it up there is another way that I discussed in the book and that's just creating a forward rule. If you do it this way it's going to mean that you're going to have an inbox on C panel. To be honest if you have storage space in your C panel because emails are relatively light I would put this to a limited and just create the inbox in your C panel that means that but that does mean that it's going to be existing. The emails are going to live on the web server and they're going to be forwarded to your Gmail so that's one way to set it up. So I'm going to go ahead and create this and then when we're creating the forward I'll explain your second option. So I've just gone ahead and I have created a Gmail underscore demo and this in my C panel if you look at the connected devices this will give you the server information for the outbound server which is the SMTP server and for the inbound server which these days is IMAP. If you're still you don't use pop even if it's an option it's antiquated and unencrypted. So I'm just going to click on connect devices and I'll just show you what C panel tells me. This is a screen we get to and as you can see in my C panel I have two options one is for one set secure SSL TLS settings and the other one is not secure and you can see remember I mentioned the antiquated pop three that still exists and it's got port 995 here for the inbound. So basically you want to use these basically secure SSL TLS as to which it doesn't usually matter except that there's different ports. The ports for the outbound are typically port 465 is for SSL authentication over SSL and port 587 is typically for the one used for authentication over the TLS protocol but basically let's just stick for stick to SSL and 465 and the important information here is the outgoing server is this one mail.danielrosil.tech and username is the address itself password is a password we configured. Now you have a nice little option here just to point this out of you can actually send yourself the setup instructions. So this is nice if you're working with a couple of less technically savvy colleagues like let's say and you want to you know help them set up their their account so you can just put in there after setting up their accounts pop in their Gmail address and send them out some setup instructions. So I've just done that and the email is going to come through. So now let's go ahead and so we've created an email for us first off that's going to allow us to send through our Gmail and that's we need we also need to make sure that the email loops back to Gmail and that's going to be setting up a forward so let's go ahead and do that now. So I've just jumped back to my cPanel home and you can see where forward is it's the next option over so I'm just going to go and click on that. This is the main screen you'll get to when you're setting up forwards. Now remember remember what I said before that you can create an inbox on the server that's going to be living on your hosting and using up space on your hosting so if you have a certain storage allocation that's going to count against that. So what you can do instead I did set up the account so it's going to be a real outbound account but if you're only receiving mail now in order to send through Gmail you do need the real account if you only want to receive mail to your branded domain put that on through Gmail you can just go ahead and set up a forward but if you're going to be sending and receiving you need both. So let me now go ahead and create this forward. So I just clicked on add forwarder and Gmail underscore demo is what we want to forward address to forward. Ask and then the domain and then we're forwarding this to Daniel roseldemo at gmail.com. There are advanced options to let you do some more interesting things but that's basically what you need to do and click add for it and we get a confirmation message saying all email sent to Gmail ask will now be copied to Daniel Roseldemo why this matters is that when you are setting up the Gmail address Gmail will send a verification code you want that verification code to loop back so that you can get pick it up right there in your Gmail and allow you authentication to take place and just remember that we also disabled the spam protection just in case that got caught up in spam on the cPanel site. So I'm back in my Gmail here and now what I want to do is click on settings see all settings and jump across to the accounts accounts and import setting we were up before send mail as you have this we have this option under your default address called add another email address we're going to be clicking on it pretty self-explanatory from this point forward so we're just we're going to put in Gmail underscore demo ask Danielroseldottech now this treat is an alias button you can learn more here about what this does it's by default turn on Gmail's documentation will explain when you want to take it and when you don't want to take it basically for most use cases treating as an alias is is the option that's going to be useful so I'm going to I'm going to leave that turned on so then I'm just going to click on the next step option now you do have the option to specify different reply to address that's not recommended we could put in the Gmail address but you know for the sake of us the reply to is another kind of made a field header field in the email and by default that set to the sending address you can have a different reply to and just make sure that it goes to somewhere else it's not there aren't that many cases in which it's useful to do that so you don't need to specify that address you can just proceed to the next step here now you can see SMT SMTP server has been automatically populated and what you might notice here is that it is different than the server address that cPanel told us to now this is happening because I'm using cloudflare on this domain cloudflare which I've talked about a few times is this really amazing service that sits between your website your web hosting and the internet and creates proxies so what you're looking at here is the is actually the proxy SMTP server it's not the SMTP server it's the proxy that cloudflare has generated so that people that are doing stuff like scanning your network malicious maliciously and that's pretty easy to do you can just hackers people to try and break into your domain can literally just see all the infrastructure that you've set up including your SMTP server and your web server and everything you have on the internet so cloudflare has a few it's not just for proxying but one of the things it does is a proxy servers so this automatically detects and you can if this has happened you can go ahead and use this you may be unable to use the actual mail server if that does happen then what you need to do is go into cloudflare and you need to actually turn off the proxying for the MX records they're getting a bit complicated here the MX records are what tells the server where to go to for mail so you can just disable the proxy in cloudflare for that I just wanted to quickly show what that looks like so this is your cloud flare and this is your you'll see MX your mail records here if it's if it's orange that means the cloud flare proxy is running you click that it'll go back to gray and if you do that the mail servers the MX records will no longer be proxied and you will not run into this thing when you're trying to set up sending through Gmail so I've just gone ahead and added my username and password into the appropriate fields it's automatically detected as I said the cloud flare and it's detected the port 587 so I'm just gonna go ahead and click on add account for that okay so after going through this process I you will get add another email address you own and it'll set an email with a confirmation code was sent to the address now remember that we created a forward to the beauty of the system is that the code should loop back so I'm just gonna move this over now you could of course go into the webmail of your cPanel email and use the code that way but this is easier you may as well if you set it up take advantage all right so we did have about a 20 to 30 second time delay over there but it did it did make its way to us in the end so this is the email you get from Gmail it's got a link or you can just do the code so let's just do the code to the window open pop that in and then click on the verify button so that's been successfully verified and you can now see that if you go into all settings accounts and import and you have your branded email address connecting over SSL and port 465 so you can go ahead and make that default and that means that you'll basically your default sending email is gonna be that so this is where the signature comes in I would go ahead and I would just create a new signature for yourself whoops alright just gone ahead and made myself a very basic signature just dropped in little tucks guy and that line of texts now I'm gonna just save my signature and just make sure that that's associated they've changed this recently in Gmail that when I send email address the Daniel Rose low tech for new email and on reply for it it's now a bit more granular so I'm just gonna say for both new emails and for that reply I'm gonna use my Daniel Rose low tech signature I also typically do this insert the signature before the quota text and again save my changes so now if we click on compose in Gmail the tucks guy is broken let's not worry about that I'm sending from Gmail demo at Daniel Rose low tech as opposed to my Gmail address they can send to anyone in the world I always wonder who operates test-to-test.com because they've probably received quite a few emails from me over the years and this message that we're sending now is actually sending through the cPanel or the in other words the email that our host manages it's sending through that if we go send this test message to test-to-test.com and we can go into our webmail interface on the hosting email and we can find our message should be there as well if you're not sure that your email address is working to receive email we know it is because we just received the verification code you can go ahead and want to use use one of these online email diagnostic utilities but it shouldn't really be necessary it's pretty straightforward to set up and now we can use our we can use our branded email address or cPanel without ever having to go near our hosting dashboard or cPanel and just use everything from the convenience of Gmail this will inherit so if you're using your email from the app on your smartphone you will pick up the sending address and you don't need to worry about the receiving site because that's already configured on the host on the cPanel and it'll all come back to you so you can really use Gmail from wherever you typically use Gmail whether that's your laptop your desktop or your smartphone. Thanks for watching the video if you have enjoyed then please or you just want to get in touch you can reach out to me at danielrosil.co.io


Thank you so much. Welcome, everyone. It's nice to just kind of have my very first conference as an international one. So I'm quite excited for that. And I'm really looking forward to at least kind of sharing some knowledge that I have gained over the past one or two years about cloud and Kubernetes itself and also about the developmental knowledge that I've gained so far with my internship at Nirmata. So a little bit about me. I'm a software engineering intern at Nirmata. And currently, I'm also a CSE senior. I'm still studying in college. And I'm in the final year right now, pursuing my computer science degree from K.R. Mangalam University. And I have also been the Linux Foundations LFX mentee at the cluster API provider AWS project, which falls under the Kubernetes SIG cluster lifecycle. And I'm also the creator and the maintainer of Kvernow AWS adapter, which was just recently released just around the time of AWS re-invent. And I've also been the former secretary of Computer Society of India, KRMU chapter. So let's get started. Well, when we talk about port security itself, we know what security is. But when it's about port security, there are different levels of complexities when it comes to containers. So if we need to access specific host services, for example, Linux services, we might not want to because it might be very risky for any unintentional access being provided to any kind of image. So please let me know if anybody has any kind of questions, if any terminology gets complex because it's a beginner's talk. And I'll be very happy to even address your questions midway. So in Kubernetes, port security, it kind of ensures that your Kubernetes pods are safe and secure from any security-specific misconfigurations. And these security issues might arise, such as the example that I just gave. You might not want any host processes to be accessed by Kubernetes pods. So that is just one example. And it also led to the creation of pod security standards. And pod security standards were basically derived from the experience that was gained by implementing pod security policies. And pod security policies were actually introduced in the Kubernetes v1.3. But now they have been deprecated in the v1.21. And finally, they were entirely removed from the version 1.25 of Kubernetes. But this removal did not just come as is. There was also a pod security admission controller, which was introduced in Kubernetes v1.25. And it essentially just kind of enforces whatever standards we have right now, pod security standards. And it creates policies out of those and only deals with those standards as specific, like, enforcements within your Kubernetes clusters, right? But now, what are pod security standards? So as I just mentioned, there are specific standards. And these have been divided into three different kind of policies that are pretty much generalized for our use case, right? So there might be a privileged standard, which is extremely not recommended because you basically provide all the access to your resources using this mode, privileged mode. And then there is the baseline mode. So baseline mode is essentially the kind of policies, the kind of standards that are enforced whenever you create any generic Kubernetes pod, right? So if you just use the kubectl run command, then you are basically creating pods which are following the standard baseline profile of pod security standards. And then there is restricted mode. It is actually heavily restricted. And we will kind of see what these look like when it comes to the actual Kubernetes implementation later on. But now let's see what's a pod security admission controller. So an admission controller in Kubernetes essentially means that whenever there is any kind of resource admission within the cluster itself, there might be a few webhooks which would be looking at the resources, right? So these webhooks might be able to either validate whatever the payload was when the resource was kind of getting into the cluster itself. And then we can basically make some decisions on the basis of whatever payload consists, right? So for example, if let's say there is a specific mode, then the webhook will see. So before getting to the mode itself, we also have namespaces, so pod security standards. In case of pod security admission controller, itself is applied on a namespace scope, right? So the way to implement this is by adding a label to the namespace itself. And essentially it's the same format as I've mentioned over here. So it would be pod-security.cubinities.io slash mode. And this mode has to be anything between Enforce, or Audit, or Warn. So these are the only acceptable values for the mode. And then in the case of level, we would mention which kind of pod security standards we want to apply for that entire namespace. So you cannot apply these standards for specific pods, right? You will have to apply this on the entire namespace. So all the pods, all the containers that are present in that entire namespace would be affected by this pod security standard. So be very careful about whatever standards you're using and what pods those standards are going to affect. And again, these will be privileged, baseline, or restricted. Now, since the title itself mentions Kvernow, I'm not sure how many of you, I mean, this is entirely voluntarily, how many of you have heard about Kvernow before? Anybody? OK, I can see four or five hands. That's great. It's even a better session. So Kvernow in Greek means to govern. Now, what we mean by governance in Kubernetes is that we are essentially having control over what resources are making way into our Kubernetes clusters, right? And then we can make decisions on the basis of those resource specifications. And by this implementation, it just means that it's a policy engine. So we can write policies for Kubernetes in Kvernow. And these are entirely Kubernetes native resources, which means that if you want to deploy a Kvernow policy in a Kubernetes cluster, you just have to write YAML. There's no other language required. And that is one of the coolest things about Kvernow. There are other implementations for policy enforcement in Kubernetes, such as OPA gatekeeper. But as you might have heard of it, it also requires the usage of regolanguage that is very specific to OPA. But OPA definitely has a lot of different use cases. It's not just restricted to Kubernetes. But if it comes to the ease of use, Kvernow is definitely a step ahead of it because it just requires YAML. There's nothing else. And you can essentially audit or enforce the policies. So by audit, we mean that we will have an entire log of whatever resource has tried to make their way into the cluster. And we also have three different kind of rules. And I forgot to mention enforce. Enforce essentially just entirely rejects the admission of a resource in the cluster if it does not follow whatever Kvernow policy we have written. So it's very restrictive. If you have just one specification that is misconfigured in your, for example, Kubernetes pod, then it will just not allow the creation of that pod itself. Well, now there are three types of rules. Actually, if there are four types of rules now, there is validate rule in which we kind of just validate whether or not a specific resource that's trying to make the way into the cluster is valid, as the name itself specifies. If it's not valid, then you have the option of either just auditing this event in the form of cluster policy or policy reports in your Kubernetes cluster itself, or you can also enforce the policy and you can instantly make a decision whether this has to get in the cluster or does not. Then there is a mutate rule. Mutate rule is pretty cool, actually. If, let's say, you have any kind of resource that you forcefully want to modify on the spot as and when it tries to make the way into the cluster, you can simply modify its specification, whatever specification you want. And on the basis of that payload itself, whatever it's getting from the Kubernetes API server, it will be able to make that decision just in the way of whatever policy you define. And then there is a generate resource rule. You can also generate resources, for example, if there is a specific resource that requires the creation of a secret, of a Kubernetes secret. You can just kind of see if this is that specific resource and you can generate a new resource or a new secret on the basis of that Kubernetes resource, which we're trying to validate. And then, yeah, the fourth rule is the image verification rule, which is still currently in progress, but it's pretty much about to be standardized, get in the way of its standard usage across the community. It is essentially able to verify any OCI images and attestations that are associated with the Kubernetes spot. So you can also verify whether or not this is an image that you want to be associated with a pod or any kind of, let's say, even a deployment. So one of the cool things about Kivano is that you also don't need to worry about whether you have to write, if you're trying to write a rule about pod or a deployment, you can use autogen controllers, which are very specific to Kivano itself. And it will create specific auto-generated rules for whatever pod controllers we have. So if you create a rule for a pod, then it will be automatically applied to, for example, replica sets or deployments. So that's one cool thing about Kivano. So let's just try to understand the architecture of Kivano. At a very high level, as I've already told that an admission controller keeps an eye on whatever resource is getting into the cluster. So on the basis of that payload, the admission webhook, Kivano has an admission webhook. Actually, there are multiple webhooks in Kivano. But essentially, in Kubernetes, there are two kinds of webhooks, which are the mutating webhook and the validating webhook. The validating webhook takes care of any kind of validation that is to be performed on the resources. And the mutating webhook takes care of modifications in that resource. And in this case, the admission controller, the Kivano admission controller, it utilizes the Kubernetes webhooks to make such decisions. And on the basis of that, it is able to create RCRs or policies or generate requests, so on and so forth. So this is a very high-level architecture of it. You don't really need to understand all of this if you just want to implement any kind of Kivano policy. You can just start right away if you want to implement any such policy in your clusters today itself without any such knowledge. All you need to know about is the kind of specification that we use in creating a Kivano policy. So here we have a really standard sample policy. I'm not sure if you're, I hope everybody is able to see the content here. So let's try to understand what we have here step by step. The API version for a Kivano policy is just kivano.io slash v1. And the kind would be cluster policy in this case, although we have two kinds of policies in Kivano. One is a cluster policy and the other is just policy, which refers to any namespace policy. So we can create policies that are applicable throughout the entire cluster. Or we can also create policies that are applicable to just specific namespaces. And in that case, we won't be using a cluster policy, but instead, just a policy. And the API version would be the same in that case as well. Next, we have the metadata. You can see a lot of different annotations here. These are not at all required if you just want to try out Kivano for the first time. These just kind of provide you with additional information about that specific policy. And for example, you can categorize what this specific policy is related to. So in this case, it's a best practices policy from the Kivano website itself. And we can also provide a description if that's needed. Then let's get back to the actual real deal, that is the specification of a Kivano policy. So here's what the real action happens. And this, we have a validation failure action where we have set it to audit. And in case of audit mode, it will just create events and policy reports for any kind of events that happen, which are not really intended. Then we have background mode. So background mode basically ensures that it is able to keep track of any previous resources that have existed in the cluster to be checked even after this policy has been applied at a later stage. Then we have the rules that we need to define for our policy. So a policy need not contain just one rule. It can contain many rules. So in this case, that is why it is a list of rules present here. So we just have one rule mentioned here. That is check for labels. And this policy just checks for the existence of this label here, that is app.cubinities.io slash name. As long as this label is mentioned, it's present in the metadata of any pod. So you can also see that we are currently matching against all the resources that have a kind of pod. You can also mention multiple resources here. It just does not need to be a pod. It can also be a namespace. It can also be a deployment. You can mention as many resources you want in the kinds list. And it will validate all those lists, all those resources for this namespace. And that's basically the purpose of this policy. It's as simple as writing just plain YAML for deploying your first Kubernetes Kivano policy. Now here's a policy to restrict privileged pods. Now this is very specific to pod security itself. So just looking at the pattern here, we can see that there are specific specifications of that pod. In this case, this is something new for you, I guess. It's a syntax that is specific to Kivano, although that is the only syntax you would need to understand about Kivano. It's called an anchor. And there are only about five or six of these anchors, which are used for comparing the values or like validating the values within fields and their children fields in any kind of specification. So in this case, it's just trying to see if any init container exists, then proceed to its child elements. And if the child elements exist named as security context, then look for its children as well. And if this privileged field exists, then it needs to be false. That is basically the idea behind this entire syntax. So this is just one syntax that is equality syntax. There are multiple different, like four or five different syntaxes or anchors, as they are known in terms of Kivano. There are multiple anchors, five or six of them. It's very easy to implement. And on the basis of such logical decisions, you can pretty much decide what pattern, any kind of Kubernetes pod in this case, since we are matching against all, any kind of Kubernetes pods, it will be validating for these specifications in that Kubernetes pod. Now, there is a new rule that is implemented in Kivano after the version 1.8 release. And this is known as the pod security validation rule. Earlier, there was no such rule that was dedicated towards just pod security standards or pod security policies. But with this rule, we are able to even make it a lot more fine-grained, a lot more granular to implement pod security standards. Because pod security standards by themselves do not provide you with any such way to make any modifications in the standards that are already defined. So this is where Kivano comes in. It also gives you the ability to kind of make exceptions for, or exclusions for different control names. So what is a control name? What are the restricted fields? I will basically get you through it as well. But this is essentially the syntax of any pod security rule in Kivano. So in the pod security, so the parent field here is the validate field, which falls under the Kivano cluster policy spec itself. And in the pod security field, we have profile which mentions which pod security standard profile we are aiming for. That needs to be enforced on the concerned resources, which are pods in our case. And we will mention which Kubernetes version are we going to validate this against. So you can also specify which version. You can make different pod security standard policies on the basis of different versions of Kubernetes. Then you can make exceptions for different control names and make exceptions for specific restricted fields in those control names. So I'm not sure. So there's just one more example for this. In this example, for the same previous syntax, we have a baseline profile. This baseline profile is being used for all the latest Kubernetes versions. And then we are just trying to exclude the control name for capabilities. And what these capabilities are, it's very specific to just Linux distributions. It essentially tells you what host capabilities you want the system, the Kubernetes pod to have. In this case, we are modifying the capabilities for this specific profile, that is baseline profile. And we are adding, we are making modifications to the restricted field, which is mentioned as any containers. So this asterisk represents the wildcard symbol. Any container that is present with a security context capability, the add capability within the security context, it is allowed to have any value such as a kill, setGID, and setUID. So these are the different values that we are making exceptions for. Apart from this, every other values will be excluded. Like they will be validated against. And so I guess it's time for a demo. I think this might be a lot of just jargon, but let's kind of see if you're making some sense here now. So okay, this might be very small. Please let me know if you're able to see this. I think that might be good. All right. So in fact, let me just use the terminal that might be more appropriate. Yeah. So for the demo, I'm not using any kind cluster or many cube cluster. I'm just using an EKS cluster. There's no specific reason for that, except that my system might cry a lot for resources, which it might not have right now. It happens a lot. So I'm just, these steps are something that you know you don't need to take care of. It's just so that I have access to the Kubernetes cluster. All right. So there is no other resource on the system. If you want to install Kvernow, there's a very beautiful documentation out there on the Kvernow website itself. You can just go to the documentation and there are installation steps. In my case, I'll be specifically using the Helm chart for Kvernow. Yeah. So you just have to add the depository for Kvernow Helm chart and you will be good to install it as well. And it seems like my system has already started trying for some reason. Yeah. Okay. So, yeah. So let me first install Kvernow. For this, I'm using the repository that I've already added. So I don't need to add it again. And I'm using the version 2.6.3. It's the latest stable release for Kvernow right now. And I will just use this command and it will deal with all the stuff that I need to take care of in order to install Kvernow. Okay. It's taking some time. All right. It's done. So let's look into the Kvernow namespace itself. We will certainly have some pods for Kvernow, hyphen and Kvernow namespace. Yeah. It's currently in the initiating stage. And yeah. It's running now. So let's just try to, so now that we have already installed Kvernow, first let me demonstrate how the actual pod security policies work in terms of like the pod security admission controller itself. So if I want to enforce, we are not dealing with Kvernow right now. We are just using the native Kubernetes pod security admission controller. If we want to enforce the admission controller right now, all we need to do is we just need to create a namespace. So in this case, let me just create a namespace called baseline. And if I want to enforce pod security, pod security admission on this, I will simply label this namespace as baseline. So this is the baseline profile I'm using, which means that whatever the default pod security standards are for kubectl run command, those will be enforced here. So now our pod has been labeled. So if I just run the nginx image in the baseline namespace, it won't show any kind of policy violations, but let's say that if I create this resource, which is a pod that has a privileged mode enabled basically. So privileged mode means that you will be able to access all the host resources of this pod. So if I just try to apply this pod, I'm pretty sure, okay. Once again, I'll just copy this, yep. So it's telling me that the CTX demo container must not set the security context dot privileged equals true value. What we have seen right now is essentially the pod security admission controller. Now, if I set this to false, it should be working as good as it would previously. So if I set this to false, let's see what happens now. It should work pretty fine and it's created. So the problem with this is that it's very much rigid in terms of whatever capabilities or whatever kind of standards are being enforced here. So if I just show you the pod security standards, these are pretty much well-defined already. You cannot customize these. If you are kind of enforcing these standards on any namespace, then they have to follow these different practices. For example, in case of privileged pods, you don't need to take care of anything. It's basically just giving the key to your door to any kind of thieves or stranger. That's how privileged it makes your pods or resources. But in case of baseline, it has some different practices or values defined for the different control names. So we have already seen control names in Kubernetes Kivano policy specification earlier. So these are the control names that we were essentially talking about earlier. And you can see that there are some restricted fields and it has stopped scrolling. Yeah, all right. So it has some restricted fields and these are the restricted fields that we have seen earlier in the Kivano policy. And these are the allowed values. So essentially in this control name, we are just restricting all these fields to these specified values. If there is any other value for this host process control or for these fields within any pod specification in Kubernetes, then only these values are allowed. And if you try to set it to true, then it'll fail immediately. So this is the baseline profiles. Just one control name. There are multiple control names across different restricted fields. So that's why it's pretty much rigid. You cannot make any changes to these existing standards. And that's how it is implemented in Kubernetes as well. But in case of Kivano, as we mentioned, that we can make it a lot more fine-grained. So let's have a look at what a Kivano policy essentially looks like. So here's a policy for checking the labels as we have already seen. And let me just demonstrate creating a pod which does not have this specified label. All right. So if I create this policy, and let me also change the label name here, yeah. Here we can see the cluster policy is created. And if I try to apply, for example, if I try to run an Nginx container, let's see what it says. It's currently created. And it is, let me see if it's an audit policy or an enforced policy. So it's an audit policy. So I must have got an event for this. It's getting stuck. It's already starting to try for resources now. Get Cpaul. If I try to get cluster policies now, it would say that we have these cluster policies. And if I try to get Cpaul resources now, sorry. Then we could see that there are two failed resources here. And this is essentially, if I even, I don't know, we amel this, then we can also see that there are these two failing resources also contain this failed policy. So it's an indication that our policy has worked. But it's only in audit mode right now. That's why it has not taken any action. If it was enforced, then let's also see what would happen if it was enforced. Let me create another image that is in the next one. It has simply stopped the creation of this pod. And it has shown us the error that the admission web book has denied the request, which means your pod could not make its way to the cluster itself. Now let's have a look at the pod security policy that we talked about earlier. So in its current state, if we don't include the commented section of it right now, it will work pretty much the same as the baseline profile does. So here we have the pod security rule. And in this we have specified the level of pod security that is baseline. And then we have the version that is latest. So if we apply this cluster policy, okay. Oh, it's C-Pol2, my bad. We have created this and it's only applied to the baseline namespace, sorry. Yeah. And if I try to create the pod as earlier, let me see if it has privileged, let's set it to true. And okay, let me delete, let me first delete the pod itself. I believe I'm taking a bit more than my expected time. But now as you can see, so it currently gets restricted by the baseline profile. If I disable the label itself, and then I try to apply the policy, then Kvernow is the one that's making the decision that this pod is not allowed in the cluster itself. So that's basically the demonstration of the pod security rule in Kvernow. There's a lot more detailed, there are a lot more detailed policies out there on the Kvernow website itself. If you want to have a look at the policies, then you can just go to the policies section on the Kvernow website. We have tons of different policies uploaded over here. Those are all created by the Kvernow community. And if we just have a look at it, we have two, three, seven different policies created by the community, which is always going to be increasing, by the way. Now let's have a look at what we have remaining. I'm pretty sure there's nothing else remaining for the demonstration. Yeah. So this was pretty much the final point of my presentation. Thank you. Arigato and thank you everybody. Okay. Thank you very much. Are there any questions? Thank you for a really interesting presentation. Hi, my name is Kentaro. I'm from Japan. And yeah, actually the pod security policy is really, I think it's really a big problem. And then I was at previous company, I was a developer, and then the pod security policies is deprecated and then erased. So, sorry. My main question is, which is the best migration software is the Kvernow or open policy agent? Or the cloud native service, many policy pod security services. And today I really interested the Kvernow. I am not hands on yet. I'm trying, I would like to try to use it. So how do you think the Kvernow or OBA or other open sources, which is the good one to determine the benefits of substance? If you know that. That's actually a really great question. And there's been a lot of debates in the past as well, and even ongoing debates. As for what is the most appropriate policy agent to use, right? In case of Kvernow, it's definitely a lot more easier to use when compared to OPA because nobody wants to learn anything new in order to apply what they already know. They just have to implement it in a way that is acceptable by Kubernetes itself, right? So, Kvernow just utilizes those webhooks that we talked about. I'm not entirely sure how OPA is implemented as a developer. So I cannot speak for the internal complications or like features that are present over there. But in case of Kvernow, I'm pretty sure that as compared to other policy engines, I believe that's the only policy engine we have right now, which allows us to create policies in just Kubernetes native fashion. And there are also increasing use cases for Kvernow as in when the community demands. So just as I mentioned, even the image verification rule, that's again increasing, that's being supported by the help of Cosine also, created by ChainGuard. So we implement Cosine in our Kvernow development just to verify the image verification as well. As for the pod security part, I believe that was your question, right? For pod security, definitely we are still working on making it a lot more like appropriate to make it production ready, right? In case of Kvernow. But it was just recently released. I believe it's, it might need some community contributions as well. I'm not entirely sure because I'm not right now on the Kvernow development team. But as for pod security standards themselves or pod security policies, it's definitely a good option if you want to get started with implementing pod security policies in your clusters and make it a lot more like, you just want, you just don't want to learn new, like redundant things. You just want to know, you just want to implement whatever you are already aware of, right? So in that fashion, in that sense, Kvernow is definitely the option to go. But OPA and other engines might have their own features, pros and cons. As for this debate, I think we already have one article here. This article as well was also written by me only. And it mentions, it has actually referenced specific talk by one of our co-maintenors, Chip Zoller. And also by shootings out, who is also one of the co-creators of Kvernow and also the maintainer right now. And in that talk, it's actually mentioned in the slide itself. In that talk, they have pretty much tried to bring up all the differences between Kvernow and the pod security policies or the pod security admission controller as well. And there are also a different comparisons present on the NIMATA website itself and also on Chip's website, neon mirrors as well. So you can just kind of find all the different comparisons made by someone who's more qualified as I am to do that comparison. Yeah. Thank you very much. Thank you very much. Thank you so much. Any other comments? No? Okay, from me. Could you say anything if there is how much performance degradation is using Kvernow? I see. For example, if there are so many policies in the table, it seems to take a long time to look up the table. Yeah. So it's again a really good question and there was one recent change in Kvernow made by one of our maintainers. We have basically, so earlier what was happening was we were keeping track of policy reports in just one YAML file or like one custom resource. That is the policy report itself. It's either policy report or the cluster policy report itself. And we were not splitting those in any fashion just as of recently. But now we have made some modifications in how Kvernow policy reports are implemented. And we are now splitting them. We have provided people with the ability to split policy reports per namespace. So you could have different policy reports for different namespaces as compared to like having just one single policy report and that containing all the details of whatever admissions were made in the previous requests. So that's one optimization we have done previously. As for the performance, I think there were some issues but we have resolved most of the performance issues in our previous pull requests. I cannot provide an exact benchmark as I don't have any graphs to show you right now. But yeah, there have been some improvements in the previous pull requests that were made on the Kvernow project at least from what I've observed right now. Yeah. Thank you very much. Thank you. Any other questions? Okay, so we have covered everything on the agenda. So let's end it here. I would like to express my appreciation for all the speakers and the participants. Thank you very much. Thank you so much for having me.


There's Brown trying to leave on the front himself inside the box. Brown, still Brown! Advantage! What a way to score your first goal of the season. Kelvin Brown had been causing problems on the right-hand side for the duration of the second half so far. Just look at this. Walsing pass, the Campadon defenders thought it was a heavy touch. Oda's rosy pass. Good intuition as well by Brown and then the Topo pass, Clarke, who certainly was beaten for pace. He did well there. Williams, taking down. Who will take it? It's over St. George's College! Yeah, pace and precision was on that strike. Always going away from Davis, hitting the side netting as well. The back sanction there of the goal. Yeah, he just took a step to his left, Davis. And I don't think if he had even taken the first one to his right, he would have gotten there. From St. Jago with the free kick. Maybe we should. And honestly I'm lost for words. And maybe Johnny Gill could describe this goal a bit better. Because my, my, my, my, my, my, my, my, my, my water strike late Murray and it's St. Jago. One Wolmer's high school meal.