Well hello and welcome again to another OpenShift Commons briefing. This time we are going to do some talking about security practices in OpenShift, and we're really happy to have with us Amadeus, who has a rather large deployment of OpenShift and has a lot of experience with it. And Ninad and Deogenes from Red Hat are going to both give us a bit of an in-depth dive into their best practices. So I'm going to let Deogenes, who I work with at Red Hat, take it away and introduce himself on the topic. So go for it. Thanks very much, Diane. My name is Deogenes Rotori. I'm one of the product managers for OpenShift and happy to have my friend now, Ninad, here from Amadeus. We've spoke together at Summit last year and now this year as well. So it's been a very, very healthy relationship for both of us so far. So this will be pretty much Ninad's role. I'll have a couple of moments. I'll be interrupting him for a few things here and there. But I'd like to say that this is like Amadeus experience in securing OpenShift. It's like being the size of the company that they are and dealing with the different number of people from groups and organizations, from different lines of businesses. Amadeus is good to hear it. The things that they have to go through, like the hoops, people they had to convince. So hopefully this will be useful for you, the same level it was for me. So Ninad, please take it away and I'll be interrupting you momentarily. Thanks, Deogenes. So let me just start about what we are. Amadeus, we provide IT services for travel industry and which basically means reservations. When you book a flight to go somewhere, you want to look at prices, a reservation and you want to have your luggage with yourself and you want to board the planes and all these things around flights or hotels. That's the kind of services that we provide. Most of them are business to business company. We operate a couple of large e-commerce websites for airlines. We do payment processing, other services and we have been using OpenShift actually up to three, actually since two years, probably since beginning, one of the first customers and we have been using it in our own data centers. We have been using it in public clouds and we had some questions around security. So let's first talk about security and why we do security in IT and hopefully we don't do one like in the picture here. That's how marketing sees security. We do IT security to protect our assets, to protect our computing capacity and data. We do because we have to protect personal information about our customers, about the users of our customers. In Europe, we have our GDPR general data production regulation, which comes from in place with some strong rules around security and as we do e-commerce and we do payment processing, we also have to be compliant with the industry standards, PCI, PSS, for example. So all these things, when you come with a new platform like OpenShift, makes you ask some questions. During my presentation, actually in the upper right corner, you would be seeing some icons. These icons will actually tell you who the slide concerns. So it actually starts first with the people who are usually the most impacted with security, which are CIS admins and DevOps. So they have the helmet to protect themselves, sometimes to protect themselves for the next guy, which is developer, which not always takes care about these things, unfortunately. So we want to educate him and of course we have our security compliance people who will take care about all these things about compliance and who will react if there are issues and we want to make them happy and to never have any security problems. So how do we do it? And first, OpenShift and containers. A lot of things change and many of the rules are not applicable. We have learned as a company, we exist for 30 years. We have learned a lot about IT security. Things change while the risks remain still out there and to our says, we have been migrating to OpenShift a lot of our products since two years and one message that I like to pass is that the best way to address security and tunneling and company, because you can have friendships between these three different kind of people, is to bring everyone at board to start talking from the beginning and to be honest about what this new thing can do or what this cannot do and what the new risk and then jointly actually address. So far, let's now really move to what we're going to do with security and OpenShift. We have to run OpenShift somewhere, so we have to put in place infrastructure. And of course, we have an OpenShift architecture and we'll not be explaining it because I assumed that anyone attending this briefing already knows this slide quite a lot because I think it was shown in a lot of presentations. And the thing we want is we want to deploy OpenShift somewhere. As I said, we deploy it on either on private cloud or in public cloud. We use usually OpenStack when it's running on our hardware or we use public cloud providers. And how do we deploy there? First, we start and this is something that concerns us as you can see in the icon above your sales admin, so your DevOps people. We first always reconstruct to VM images that we want to deploy. Everything with what the image needs is already prepared. We always use this from mirror repositories and mirror registries. We never actually download something from Internet available and Internet exposed repositories. We can also do a scan. Once we create these images, we can do a scan or use an OpenScap to check if all the patches have been applied, if the image is up to date. And once the images have been reconstructed for a given cloud provider, they are shipped to it and used there. Network design, historically, the result is this approach for especially for the Internet exposed services that you separate your application in different zones. You have DMZ and then you have layered protection for web servers and application servers. They may have several layers like that and eventually database and all these things are running different networks with firewalls inside. As we are running now in a cloud environment, these things change. When we use OpenStack, we use things like security groups from the cloud. The providers have different solutions to isolate the track. Of course, there is a need for sysadmins sometimes to access installations, so access control, which is a bastion server. There is surely the need for upgrade policy. How do we maintain this platform up to date? Basically, we have two approaches. The first approach is that some of our products are what we call boxes, which means the platform, the OpenShift and the application running inside it is one single thing. If you want to roll out a new version, beat a new version of the OpenShift or the new version of the application, we will simply rebuild a new instance. When it is up and running, we will bring down the old instance, which allows us a fairly easy way of upgrading. However, it has a cost of having, at a certain point of time, two instances running. Another approach is for more long-living platforms, would be to do a rolling upgrade by, for example, adding new nodes inside the cluster, inside the OpenShift cluster. Once they are up and running, removing the old loads from existing nodes and taking them out of the cluster. In principle, we are rebuilding machines. We are not upgrading machines in place. The frequency of upgrade policy weekly, monthly depends on the kind of the platform where actually this is running. Our internal OpenShift architecture, when actually we run it inside our premises, looks kind of like this. It may be different when we run it in the public cloud. This is a variation of the standard OpenStack reference architecture for the OpenShift. We use a little bit differently because we have strict separation of internal networks and external networks. In this slide, what is actually in boxes which are with dashes around represent security groups in an OpenStack. For example, for your worker nodes and for infrastructure nodes which share the software defined network, they would be living in one security group so they can communicate between themselves, but no one outside that can actually join this part. Infrastructure nodes, they would be accessible from a kind of DMZ or firewalls or other web protection things that you might have in front of them or my possibilities to be accessible directly from the internet. That's not the case how actually we are working. We always have firewalls in front of it. And then on the right hand side, we have our people who work and who maintain this thing. So first, we have DevOps people, people who might have need to install this platform, who might have need to react on some incidents which would be accessing it through the bastion server stage or which would be accessing OpenShift masters, either the console or command lines over HTTPS. And then we have the developers who in principle are rarely accessing OpenShift directly, especially production OpenShift directly in our case. They will be doing their CI CD development with our internal platforms, creating their artifacts, taking their doctor images, pushing into internal repository where they are validated. And only once those things have been really validated, they will be replicated inside production environment where production environment are able to load it. This is a way of protecting OpenShift environments, production OpenShift environments, loading non-validated or non-tested applications. So now we have OpenShift, it's there, it's running. And the first thing would be to log in. Here I would ask the hygienists to log in, but I will not talk to this time because the hygienists will simply type developer-developer, isn't it? That's because like from my perspective and I've been a developer in my life, like security for me, it's what was for me like only like login, but there are multiple aspects around security which we'll cover on. So some people that end up thinking that security is only our back, security is only content, but it's a huge wide array of security. And to your point, Red Hat has recently published a white paper called 10 layers of container security, which very much talk about lots of things that are concerning when using and developing containers that they spend across network security, container security, Linux process security, content security, and multiple other areas. So as a developer, he might log in with a credentials here, might also often do this thing, the command, becoming effectively root of OpenShift with all the capabilities, which is not the correct way of doing things in OpenShift. We want to have our back that Diogen has mentioned. We want to have some control of what people, who logs in, who can do what things. If it is a developer, his local machine, he might get once he logs in something like this. But if we're running something in production, we might have actually more types of users and it's our approach. Well, the way of authorizing or identifying user in production would be on something like LDAP as a company that's how we manage authentication. But there's also the possibilities of creating its own accounts, specific accounts for OpenShift using different sources of truth for authentication. As I said, LDAP is a common way and already contains sufficient information that could allow us to give different rules and different roles to different users. So, for example, in the given project, I'm the admin, I have the rights. Usually, our approach is that DevOps actually have those kinds of rights. Then we might have people who are some kind of support people can perform some actions and we can have developers. For them, we give them the view rights. They cannot modify, but they can have a look at what's going on and they can use that to investigate an issue or something that happens in production. So far for the airbag, let's now move to some nice things that exist in OpenShift, which is also security, which we like actually to use. We have, for example, OpenShift Secrets, which is a great way of decoupling sensitive information from application code. It's a way how we can manage and distribute everything which is considered confidential operation. It's like passwords, credentials, or certificates. It will not be something that will be used for business sensitivity, like credit cards. That's something else that has to be used. For something that's operationally necessary for applications, it's a really great way because it allows separating that information management from applications. It allows secure delivery of this information to the nodes. If it's present as a file, it will always be on a memory-run OpenShift node, so it doesn't go down to never be on disk, so we'll not, somehow, get hold of this disk, we'll not get hold of the Secrets. It allows access either through environment variables or through files mounted, which is basically the usual way of accessing such kinds of Secrets. It's great. We actually also separate concerns. We have a developer on the left-hand side who describes his spot and it says that he needs an environment variable here based on some Secrets. Then DevOps guy or a security guy can create this Secrets on the master and at runtime, those two will be linked together. It's actually a really great thing that facilitates this way. However, there are some less great things. This is the thing when you're talking with security people and you tell them, and it's like a regular thing to me, because effectively, today's Secrets are stored in clear, or almost clear in ETC databases on master. They're also present in temporary file system and memory on the nodes, and they're also accessible through API of the Kubernetes. Those will be really nice if we could be able to be using HSM or we can look at the vault like a software-based storage of Secrets, and it would be really nice thing to have such features inside OpenShift or some Kubernetes to be able to offload this part of security into such device. So, Diogenes, can you tell me a little bit about what's going on with the vaults and support for such things? Yeah, sure. So, important to point out that when Secrets was introduced into Kubernetes, even before RBAC, so for some people, imagine that there was no concept of RBAC in Kubernetes, that means anyone could access any object anywhere, and that means that as Secrets, they were essentially openly available to anyone that could see. So, we are working with the Kubernetes upstream community to have Secrets on OpenShift, and I think I would like to point out this, and I'm sharing this in the chat right now, and I know Nenad has it there, but I'm also sharing that all the product management that we do for OpenShift is open to the public. So, at any point in time, you can get into this URL and search if there is like any task or any work being done engineering-wise related to Secrets encryption or to vaults. So, if you search, for example, Vault, you see that there is a target for OpenShift 3.late, which is what integrates with other Vault solutions. If you search for Encrypt Secrets like Nenad did, you see we have a card. So, it's important that you keep following this link that I gave and also our Trello board and to see what things are happening. So, for example, this link mentioning that we have committed for 3.6 the encryption of Secrets at rest and what it means. Thanks, Nenad. Okay, those things are not yet there, and for example, we have things like PCI-DSS compliance which requires to have Secrets or Condenses encrypted. So, how do we address it? How can we do our move to OpenShift if we don't have such things? And there's actually a lot of discussion around this. Like, is it really an issue to have the Secrets stored in a TCD like that? Because anyway, TCD are one of the main parts of your infrastructure and if you have some compromise it, you probably have other big, maybe even bigger issues because it can compromise your master and then your cluster, then the fact that okay, they can steal this kind of secret. Then you can also encrypt the disk where TCD runs which allows the packet that are at rest and someone steals your disk, they cannot retrieve this Secrets. Of course, if someone compromises, they will be able to access them. So, there are two approaches that are possible for TCD. There's also possible that actually not all use Secrets to store them in Vault. Now, don't use what's coming with OpenShift and then put a place in the encryption service with a couple of patterns. If you stole a Vault, you might have a sidecar running inside your container that is responsible to connecting to this Vault and giving you the Secrets or you might have an init container which will read the Secrets, create a temporary file and you can use this one. We can do with Secrets is a service which is basically a service running inside OpenShift that you connect to and you get your Secrets.  Also, in terms of compliance, there are also possibilities to do things like compensating control which basically means if you can put in place something which is as good protection or even better than the protection, well, that might be enough for compliance. And let's say first thing, I said that you can access Secrets through the API. Luckily, OpenShift actually provides a log of activities, what happened. You can see someone tried to access a Secrets, like here, I tried to access the Secrets and I didn't have the right, so I get the 401 errors. So, this is something that can be activated inside in OpenShift Masters, not OpenShift by default, but when activated, you can monitor OpenShift logs and when you see a trigger like this, like 401, I mean, anyone trying to connect to Secrets, you might raise alarm to see if that person has their right or doesn't have their rights. And those works with the processes, you can also check if they are using it, not only the persons. And I don't think it replaces maybe ODD. Okay, here we're no longer talking about OpenShift, part of Linux. What is ODD? It's an ODD demo that can monitor, for example, any system call and provide logs about those. So, you can provide this either in files or you can ship them to our Syslog and then off to an alerting system, which can raise no alert. And it works on a set of rules. The rules can be like, if someone tries to access a given file, well, log something, or if someone or some process tries to do a certain system call, also do something. So, you can actually create rules based on this one or someone tried to access a given file. Let's say there's an alert and let's look if the person had the right or not had the right, or you can have a rules check. You should automatically decide those things. And it's something that plays for, for example, OpenShift Masters. To monitor if someone is really accessing, for example, a TCD. Here is just an example of the rules. A rule that could be put in place. Basically, if whenever someone tries to open a file one, any of the files belonging to a TCD database, we would be logging something via ODD. ODD can generate a lot of logs depending on what kind of system calls you listen to. We are, for example, listening just to the open. Someone may decide to listen on a read if they want to help a huge amount of data. And we can put that similar thing on the nodes. On the nodes, we might be more interested not on any access of a TCD because there's no TCD or any access to the secrets because there's a lot of access to different secrets which are generated by Kubernetes, which could be certificates, a lot of different stuff is present there. We just want to monitor some secrets that we consider important. And how do we do it? As any of the secrets might have a certain type of prefix there on infix. And we, whenever there is a new mount with this prefix in symix, whatever, we start monitoring it or do you think whenever it's down and unmounted, we would stop monitoring and then we would have rules which would say, okay, someone might try to access this secret and this is this user and this user actually has the right to read, so this process has the right to read it, or it might say, okay, no, it's not something, let's raise an alarm, let's investigate. And this at least gives you the possibility to react very quickly actually on the fact that maybe your secrets have been compromised. Mentioning ODD, there's also other interesting features because you can monitor a lot of different things. And there's an openscap tool, it can be very useful there because, for example, if you talk PCI-DSS compliance, there is a set profile which is suggested for this one and can be used as one for the blueprint of the ODD rules that you would put in place on your nodes using it. And there are a lot of different profiles which are applicable. So it's like a teaching tool, I should tell you, maybe not all the rules are really applicable in all the rights, but a lot of them are very interesting ones. There's another thing which we find very interesting in OBSHIFT, which we look into it, not to get to use it, but probably something that's where I start using at some point or something similar, is we have secured communication coming inside our cluster and our clusters are protected, they are on our premises, they're physically protected, but it would be really nice if we can add a layer on top that we can actually also encrypt the information inside our clusters between services inside, instead of using pure HTTP or encrypted MongoDB communication or whatever there is. So it would be really nice if we can always communicate using TLS as transport protocol. That's where we like service signing certificates. It's a feature that actually OpenShift can provide, which is that if we annotate a service with notation, I want to show you there, OpenShift would generate a certificate automatically, it will sign it by its root certificate, and for the more it would provide the certificate to any client services that might use it. And we can use it easily to establish the trust between those two and use it to establish the secured communication between services, consumer and service. Now we move to the containers. So I want to start with all this talk about containers. There's a lot of nice things about containers, how easy it is for them to ship into production and you use them everywhere. And I mean, developers generally, they love them, so great, and want to power developers, want to be as agile as possible. So developers, it might happen from time to time that they really want to be agile, and they really want to, so they start, and sometimes they want to expose a web service. And a web service, it will listen on a port 80, because that's the normal port that we listen to. And of course, port 80, we cannot run on, I cannot start a service which lessons on port 80 online, unless it's a rude or privileged user, because it's support below 1000. And then sometimes they might say, okay, I want to work with Apache web server, and let's take version 2.4.12, which is, I think, quite old, like several years, or they go to Docker Hub and they search and they find this cool, super powerful base image from, I know, Neverlandia somewhere, which is called Black Hat. And they just pull it and they just run it in production. And who knows what this image actually does. So I try to educate them, let's make them learn. I mean, all of these things are easily solvable in OpenShift. So our image is basically we don't allow root access on anything which is business load or functional load, which never have a root access. And one way of first of addressing that is actually OpenShift by default, when it runs application, it can run it, it will run it with arbitrary user ID. And that often comes as a problem for developers, because they take maybe one image, but this image requires a specific type of user. There's no particular reason why it has it, right, requirements, it's just, it's like that, because there are some permissions which are given for specific user, and that's how it works. It's fairly easy to address in OpenShift because this arbitrary user ID OpenShift uses, it actually belongs to a root group. A root group has no specific rights, except it's called a root group. So good practice is that for your images, whenever you need this setting of permissions, for anything that your application needs to access, you give it right to the root group and to the user, as the arbitrary user would want to root group, it will be able to read anything there. The second thing is running on the port 80, an example of Apache, actually even the base images like that come, but it's extremely easy to change that. We can lesson on a port, you know, 10,080 inside our container, in that case our container is not privileged container, and we can map this to port 80 using standard Kubernetes OpenShift services. So we can still keep our logic that, okay, it's a web service that's on port 80, or it's a website, but having sufficiently protected our container from a risk of using privileges which are not necessary there. And there are a few other also services, possibilities in OpenShift, there's possibility to use security context constraints, which maybe we have a need for a privileged container, or maybe we want to access something on a host machine, or have a given specific users, so security context constraints allows us to give this rights to some of the pods, so adding features, or we can go in the other direction, maybe we secure computing and we can set up and we can decide to even restrict even more to say, okay, our pods, they are not allowed to ask for time, we consider asking for time is very restrictive. We can restrict actually, it allows us to restrict calling different system calls. So also these two approaches one for going further, giving more permissions, one going towards giving less permissions for the applications. And of course, I don't want to pull things as as from untrusted sources internet. So in NMDs, all images actually come from our internal registry and we often use this redhead as base images. So we mirror for example, redhead's repository into our own one. If images cannot be mirrored from a trusted source, we rebuild them internally from source code, our internal infrastructure, and when our internal infrastructure never accesses Docker Hub directly from the build machine, so all the builds must be done from actually images which are already present and already trusted. And in production, we'll only give the access to images that have been validated and then we'll mirror them. And one other possibility is actually to run checks about across images to see if they have a security scan. So there's actually two tools there, image inspector, openscap Docker come from redhead. There are other actual tools which do these things. We are using Jenkins pipeline. So one step in the pipeline could be validation of the images that if they have security vulnerabilities are not. It's not something that we consider blocking actually today as we have experienced with images that are marked with security vulnerabilities because I know there's a JDK 1.7 inside and we never use JDK 1.7. It's more for the informational purposes. But I think there are some things coming there to help us also on the redhead site, isn't it? Thanks very much. And I can, yeah, so what you're seeing here in the screen, it's a recently launched container catalog at Red Hat. It has a few interesting things. So we launched this idea of a health index which will tell from a redhead perspective how healthy we think the content of that image is, right? So and here's the example of the JbOS CAP7 image. And if you see from our perspective, we classify it as a B. For B redhead, we still consider it to be a healthy container. So if you click on a specific tag, can you please click on a tag? Yeah. Do you want the security? Yeah. So if you click on a specific tag, it will tell you why do we think that that image is a B. And it will tell like for example, this image has one important vulnerability that has not yet been fixed for at least 30 days. So our health thing is we'll say that there should be no critical vulnerabilities in the image for more than seven days and no important vulnerabilities for more than 30 days. So for the contents we create, ship and package, we own the lifecycle. That means that customers like Amadeus, they can trust our images that they will always be safe. Just an interesting point is that having redhead owning the images is and shipping them into the lifecycle, it's a key point for more business. And I was just recently checking a thread that a lot of people use the Busybox image to build their own containers. And the version that was up until a few days ago had even malware inside the image. So just imagine that the type of impact having malware inside a container image would affect your company. So Theogeny, this is just this morning, one of the ISV's rocket chat put theirs into the catalog. Is that checkable using the same? Yes, it is. So it's the exact same catalog that's used for for our own software. It's also used for any of our ISV images or ISV partner images. So you can go, like anyone can go to access.redhat.com slash containers and search for images that are available there. And they will follow and be and go through the same level of updates and lifecycle management that we apply to our own images. Totally cool. Thanks. Finally some final thoughts about how do we guide ourselves when doing security. So first, we are quite confident we can manage the platform which is secured for unknown container vulnerabilities and make something unknown. There are risks and we are sure that we actually can manage those. It's definitely not a sole application vulnerabilities. It can help the things like secrets, some management, the things like certificates can manage. There's also the question of a multi tenancy. True multi tenancy would be some applications that are completely isolated, something which OpenShift supports. We find this quite a complex solution, still working on it, trying to figure it out. And we always start with principally successful. They are granting new capabilities as applications only not starting with privileged containers at the beginning. There are a couple of things that we will miss and actually many of those are on the wrong map and even implemented. Encryption for secrets, clearly we see that it's coming. We network pull essays to manage who has access to what internal and the grasp. It's actually I think already part of the latest version of OpenShift. It would be really nice to have an image inspector which is something integrated more with the platform itself. So something currently works in an outside tool. It would be nice to have it here. Our back, great thing. Maybe some out of the box new groups, security manager that hasn't managed what has been deployed, managed secrets, all the things that we're really nice to have in OpenShift. Anyway, as I said, we already have something we can fairly operate in very fairly secure manner. And that would be it. Thank you. Awesome. Well, I saw bits and pieces of this at Red Hat Summit, the video and things. So I'm really appreciative of the time you guys have taken to come and give us this briefing. Though the secret stuff in the chat, I was talking with Diogenes and it should be coming out in 1.7, which if I read my release cycle is actually the end of June. So how long would you think it would take you to, if it gets pulled in, would you be incorporating that into what you're doing at Amadeus in the next release of OpenShift and taking advantage of it that soon? So from an OpenShift roadmap perspective, we often are behind Q, it varies between 8 to 10 weeks. And so should be coming OpenShift 3.7, which is around 8 to 10 weeks after that. Yeah, because we do a lot more around the stability and checking it than a few others. So that'll give you probably the encryption of the secrets that you're looking for, hopefully, and we can have you back on talking about other things that are not working. And maybe some things that you're doing. And the other thing that I wanted to say is I wanted really to thank Amadeus for all the contributions you guys have given to OpenShift Origin and the give back and collaboration with you guys has been pretty awesome. So they're a shining example of collaborating with customers and getting contributors into the fold. So this has been very great and I really appreciate it. I'm not looking at any questions though. So you've done an incredibly thorough job. Oh, here's one. How are you preventing images containers from taking all the compute resources of a node? Are you implementing resource limits in Kubernetes OpenShift and or do you monitor customers for abuse cases? Okay, yes. You implement resource limits. That's one way. And we do separately, of course, we do monitor what the applications do because there's also other interests. Do we want to scale up? What are really the needs of applications? And in our case, the customers are currently on voice. No, turn customers, we have quite good control on what they do. But indeed, the principle approach is putting place resource limits and then monitoring would be more like overall seeing what happens. And I can ask for the second question, which is what are we using monitoring? We have our internal monitoring stack if we develop because we already operate something. We have developed stack which we use for monitoring. It's not based on hopefully our monitoring or an OpenShift monitoring at the moment. Are you using Prometheus at all? We're thinking about it? We are looking at it. Can I move? That was last week. Perfect. They have in-house monitoring, yes. Perfect. All right. Going once, going twice, is there and oh, here comes another question. Do you do application security, user authentication, authorizations via OpenShift mechanisms? Or is it inside the application, i.e., external to OpenShift? We have our, for our customers, we have our identification authorization solution, which I've been using for decades. And so we don't rely on OpenShift mechanisms or SSO. We have our own solution, which we actually can run in OpenShift. And they're still asking you more questions about monitoring. What is it based on? How custom is it? What are you using? When we run OpenShift, it's pretty much something which we built for OpenShift. So we do use some nangios for infrastructure things, but it's more of for the legacy stuff or for infrastructure stuff for which is OpenShift, as something which we developed bespoke internally based on open source technologies. Prometheus is one thing that we are looking into. We're going to use a Grafana for displays. And then we have actually already some ways of collecting metrics which have been developed in-house and which we are using. Now we don't have a GitHub link for the solution. It's not something that we have open sourced. We have open sourced other things and we contribute to Kubernetes, but not for this solution. Yes. So there's lots of people, and I think monitoring has become one of the hot topics actually within the comments briefings. And I think next week we're doing another one, Robust Perceptions, Brian Brazil, the gentleman who spoke on Prometheus is going to come back and talk about high level perspectives on monitoring and different solutions and what monitoring actually means. And I think we'll be doing a lot of monitoring talks because there are lots of approaches and everybody has their own special saw. So it would be wonderful if there was one way or one stack that we could recommend. And I think some of the stuff that you were mentioning, Grafana and others are pieces of everybody's puzzle. I can talk a little bit about what we have in mind from a product managing perspective. And this is so far upstream work we're doing. So we're doing upstream work with Prometheus. I've seen that. So there should be a formal integration for Prometheus in an OpenShift upstream. That means OpenShift Origin. If you saw the announcements around Yeager, which is for distributed tracing. So we're working upstream on that as well. So another area we're working on on someone related to monitoring was the Istio announcement for a service mesh that has distributed tracing and overall monitoring on that. So there are lots of fronts where we're tackling upstream. And some of them will be coming to the product. We have the Yeager team, Yuri from Uber and a couple of Red Haters are going to give a comments briefing in the next month or so. So as I said, there'll be lots of on briefing and open tracing and Prometheus coming down the pike soon because we know it's important to everybody. And those are the things that we are interested in. It's like open tracing and the Yeager will be very interesting to look into. And Prometheus integration we're looking at maybe ourselves. If it comes with the product, it will also be a great thing to have it. I'm looking forward for those comments briefings. Well, they're all on the events calendar. So if you go to OpenShift commons.openship.org slash events.html, you'll get there. And there's a whole slew of things coming up. We're going to two days a week, Wednesdays and Thursdays because there's so much coming down the pike. And I think we're almost to our 300th member organization. So we've got lots of people who want to talk about lots of things and different aspects. So it's going to get busy. So in all of this stuff that we talked about today, including the PDF of the slides and the video of the slides will be up on blog.openshift.com shortly, usually by Monday or Tuesday of the next week at the latest. And you can find all of the other almost 75 or I think this is the 76 podcast I've done so far up on RH OpenShift on YouTube. And there's a playlist for it. So stay tuned. There'll be more next week. And it's keep keep it coming because it's been great working with Amadeus and with having folks join us and ask these questions and push the product forward even further. So it's all about you guys. So thanks very much. And thanks again to Amadeus and Diogenes for taking the time today. And thank you Dan and thank you community for the product.


Hello everyone, hope you are safe. I am Dr. Vinit Mannan. I am a consultant laparoscopic laser and general surgeon at Manipal Northside Hospital in Malaysia. My area of expertise is laparoscopic and laser surgery. In laparoscopic surgeries, we do laparoscopic cholecystectomy that is gallbladder surgery, laparoscopic herniaplasty that is hernia repair surgery and laparoscopic appendicectomy which is removal of inflamed or infected appendix using laparoscopic techniques, which is nothing but using small incisions over the abdominal wall to enter into the abdomen and remove the affected part or fix it. I also specialize in laser proctology, which is essentially use of laser in treating conditions like piles, which is broadly called so. But in essentiality, it has smaller conditions like hemorrhoids, fistula and fissure. We use laser in order to burn these piles, masses or destroy the fistula extract and therefore cure the patient. We are told that the COVID-19 pandemic is coming here to stay. Every precaution we take to prevent the exposure to the novel coronavirus is not only a smart move but a necessity. As important as it is to keep ourselves safe and distance ourselves socially, we must not ignore other health problems that may arise in our bodies. Therefore, any such problems, please contact your doctor or come and visit the hospital. At Manipal Hospital, we are prepared in every way to keep you and your loved ones safe and to provide the best treatment possible even in this testing times. I wish you the best of health and a very speedy recovery for any ailments that you may be having.


Hi, welcome everyone. My name is Angela Mills. I work for the town of Amherst. We are holding on this meeting as we wait to achieve quorum. Many of us have reached out to other members to see if they could join in, but welcome to our attendees. Jonathan, I'm going to go ahead and give Kathy a phone call. Okay, thank you.  Well, at the moment, it's just you and me. We're in for Rupert. Can't remember if Ben's on this one or not. Mike will not be here, right? So we need Rupert and Kathy. Kathy the fourth. I think Ben's on the other one, right? I think so. Hello, Donna. Hello, everyone. We're waiting for quorum. Tim, we're clearly not in the same space. Pardon me. When you send out those invites going forward, make sure you do it from the calendar. And I can show you how if you need to know how. Margaret said she couldn't. I'll talk to you after. I just have been on 20 calls this morning. I haven't even gotten up or had lunch on or had lunch on. So these are our healthy snack delivery that we get through Blue Cross Blue Shields on pumpkin seeds, roasted, unsalted pumpkin seeds. I have an extra bag if you want one. Yeah, sure. Come and get it, right? Which actually we do need to show up soon. But I don't know if anyone, everyone knows this is Phillip with our office. You're going to see more, more people joining us from our team. Angela, were you able to reach Kathy? And if Rupert joins, you'll have quorum without me, right, Jonathan? One, two. Do you remember who the full committee was, Kathy? Kathy just joined the committee, subcommittee. She will assign herself to it. I've been the ex-officio member until now. Kathy, we're already recording and I've made you host. So thanks everyone for the teamwork. Thank you. Thank you. Well, I think at three we have a technical quorum and I would like to be able to have us be able to do some work. Hopefully Rupert will join so that Sean can go to his other meeting. But I don't know. But I think we should probably get started. Kathy, I don't mind chairing this one again for today, but as I had said at the last one, I would like to chair just one subcommittee. And so I will chair today and do my best to take some notes, which I need to do for my last meeting as well. But hopefully we may have to add another person to the committee. I'll officially add myself and I'm going to chair. I can block out the time easily. If you want to chair today, I'll take notes. Okay. And I think Margaret or Keznia is. So I sure I will chair. Okay. I'm calling them. Thank you. Madam, Madam chair, could you have Benium and. Yes. Thank you. Remote. That should bring them in. Thank you. Thank you. So I'm going to call the meeting to order and, you know, just as we look to the future of these subcommittees, I will try to send up, you know, we can double check to people that we haven't set up a time where they can't make it since I don't see Rupert here and neither Tammy or Allison. So I'm calling the meeting to order and I will first call on people to make sure they can hear and be heard, although we've all been talking to each other. So I thought, here's Rupert. Great. So Jonathan, here. Kathy is here. Sean here and Rupert. Yes, I'm here. I think that's great. Kathy. So if I believe you have quorum, I have to hop off for another meeting now that Rupert's joined. Do you have quorum without me? Let's just say we do. I'm going to try to get back at this on the main incident. Yeah, no, I think it's, you know, I think it's important to lay the issues on the table and start a discussion, Sean, and we're not making decisions now. So that's fine. All right. I will try to be back. Thank you. So Tim, I'm turning this over. Tim, Donna, Rick, I'm turning this over to you at this point. Great. Thank you. All right. Just to see where we are. The originally published agenda for this meeting was lobbies, entries and canopies. And there's a whole lot to talk about there in terms of the mechanics of how you enter the building, what needs to be accommodated in the lobby, everything from space for people to wait to display to the lost and found area. And we haven't had discussions with the administration staff yet. So we were in the process of scheduling all those meetings, as you know. So that part, we can't really talk about today. But there is some work that we've been doing as it relates to the changes in the site plan. So I'm starting to bring that to the screen. Kathy, if you would allow me to share my screen. Okay. Okay. I think I just did. Tell me if it didn't work. All right. So here we go. So a lot of our focus is going to be on the south entrance today from the bus drop off loop. As you recall, we adjusted both of the loops to sort of shift the center of gravity to the front of the building for pedestrians and walkers. But this is still the major entry for the building. Depending on how operationally the staff wants to use the building, it could be either morning drop off or just after the pick up or we have to have that discussion. But it remains an important part of the building. And then there's an important function in the service area. And we carried what we needed to carry at schematic design, but we want to develop to make sure that this entrance is welcoming and functions the way it has to. So just to review, this is what we carried for the service area, south entrance and canopy at the south of the building. It provided shade for one of the kindergarten rooms. It has a column because it was pretty sizable, which is a choirs of foundation. And then there was a canopy at the entrance itself in the same language to provide shelter from weather. Then we did have a small fence that was not shown here, but the service area is right here. So the dumpsters and the transformer will be here. And part of the reason that we heard for making those adjustments to the site plan in general, so the experience of all approaching the building would be the same. You wouldn't want a certain subset of the population going in past the dumpsters and certain going in, you know, the main front door that we've designed. So in an attempt to sort of make them more equal, we just want to look at a few studies that we've done today and and confirm with Rupert that everything that we're doing here is going to work with the operation of the building. This is just another closer to eye level view of what was included in the schematic documents. So we're looking now at ways to adjust it to one, simplify the canopy, because simple means less detailing and, you know, to cut to the chase, less money. It will still provide the shading that is required for the classrooms and shelter at the door. And then we also want to talk about what we could do in terms of a wall or fencing around the service area and still allow the staff to and deliveries and services that come to school to do what they need to do without obstruction. So this simplifies the canopy and that it's all at one level. It's maybe a little bit deeper in some areas. We've introduced a slight curve and something we want to talk about. There are no curves anywhere else on the building. Maybe that separates the north and south country. Maybe it does. It's just one of many ideas that we've looked at that we just want to put out there for consideration. Here is what it would look like from eye level, looking toward the south entrance of the building. Here you can see a solid wall that has extended almost to the drop off in the service area that the dumpster is open. This shows the swing open gate swinging out, whether the gate were string to slide, you know, all things that we need to talk about. And we need to confirm with Robert that the gate would actually be used not just be left open full time and sort of defeating the purpose of this. Here's a view of the same configuration that shows a bit more of the service at that. So here gate swinging out almost to the corner of the gym, dumpsters straight back from the gate and then the transformer area here outside the doors of the service area. Another option simplifies the canopy even more. As designed, there is an overhang of the landing in the stair already and that is enough potentially, sorry, let's give it a slide, to protect you from the elements as you enter this south door. So this shows a simplified canopy still including the curb, still bringing it back to the building and producing details. Another difference in this option is it has the semi-transparent fence on the wall against the drop-off area. You know, whether or not you want that to be absolutely solid or a screen is enough to create that separation is something we want to talk about. And here you are at eye level looking to that south entrance of the building. Another configuration has a step back. So the canopy itself in the building area is really quite modest and the canopy is doing all of the work at the entrance itself. But this still achieves, we think, some of the things that we liked about this feature at SD. We heard that it, the bright colorful nature of it adds a little bit of whimsy to the building. It sort of separates the kindergarten classrooms areas, makes them separate. It also identifies entrance. We do a similar thing on the north side. We believe with this sort of reduction of the canopy, you still get the daylighting obstruction that you need or control that you need at the classrooms. You still get weather coverage at the door. A skylight in a canopy is something that we've used successfully on other projects. Single piece polycarbonate skylight allows light so you don't get a dark spot. I don't think dark is going to really be an issue at this entrance. It's facing directly south but it's something to consider. Then with each of these, we look at them from the eye level to see if we are appropriately screening the service area and if we can actually make an entrance out of it. Tim, if you could bring up the site plan though because I think there's sufficient space in the loop or the drop-off area where the students really could enter through the front door. While Rupert's here. That's helpful, Rupert. The morning doesn't seem to be the issue. The buses come in. They're staggered or they're there for two minutes. They drop off and they leave. The arrival, Cathy and Gang, we believe we should be able to accommodate having every student enter the front or if they arrive early go to the playground, Rupert, if that's the policy before they're let in and then everyone can enter through the cafeteria or that door on the north side of the building. This is more about departure and I believe that the school does separate the students based on walkers, buses, and cars. I don't want to minimize the importance of this egress or entry point but it really would just be for students probably being dismissed in the afternoon. Yeah please, Rupert. Thank you. Yeah that's very helpful because I had thought that we were doing students all coming in on the west entrance and off the south entrance. That might be a larger discussion to involve Tammy and Allison in but my sense is that in terms of morning staffing, funneling all the kids in one entrance will be the way we want to go but for the afternoon and the other thing is that typically we don't have a long line of buses in the morning. A bus pulls up, it unloads, it pulls away so I think aiming towards the front entrance in the per morning drop off is still the way to go. Yeah so the changes that we've recently made to the site plan are reflected in this updated model. They're still tweaking to do this so it's sort of a large expanse of a hardscape in front that would probably punctuate it with planting but this if there's only a bus or two at a time it could pull all the way up to here without obstructing the vans which is pretty much a straight shot to the front entrance and there is more than enough room now for almost the entire certainly all the student population that would be arriving at one time to arrive in front you know just just to give you a sense visually of what is happening so I think it you have to reiterate that there's certainly enough room for drop off it is a matter of one what you see at pick up in the afternoon and just the general identity of the building for people on the south side of it. Kathy? Kathy? Yeah I had a question on the side entrance and the canopies and this is also for Rupert to think of when you get that flat extension well I have a couple questions but when you get that flat extension across from the kindergartens and over what does it look like three or four years from now in terms of dirt and how would you clean it is my you know the so more of it and more unevenness where you can't just walk out so the continuous one I can so that was my one question on whether you want that continuous thing as in A and then later you had it in C or not and then my other question on this this this diagram is showing the kindergartens with doors to the outside of the classroom with pathways to the door and that was a decision I think that we were still leaving to say whether we want all the kindergarten classrooms to have a door that opens outside so I think am I right in what I saw because when you did the upper level you saw a walkway to that outside door both from the one classroom and from another so one is a question about doors and walkways and the other is how do you keep that nice white with a orange trim surface clean to answer the questions one the exterior door is required for regress for classrooms of that size and we did have a discussion with the building commissioner and he well didn't outright say no he was very skeptical of removing that door so we did have that as a ve and we did not exercise it because we don't think that's going to happen so unless we hear otherwise those doors aren't and then honestly part of the reason for reducing or simplifying the canopy is the top of it will be a membrane roof below windows and you are correct they do get a little bit different there are things that we can do about that in terms of either a color or maybe using a ballast instead of instead of a membrane Tim they're about to install the ballast at Deberry on those similar roof areas maybe Neil and I can bring some photos back to share but it's nice round river wash natural rock that doesn't look black and dingy okay so that that was my question on that and and I'm just seeing you know I like the green and the grass but these are all areas that have to be maintained and we're not otherwise using them it's just that's a comment rather than a should be that be there or not you know I suppose it can't really be a playground it's not big enough for a playground although it the kids could go out and sit outside I mean they could actually have a class it looks big enough that for kindergarten they could sit outside which is is nice um that's I'll stop uh with Jonathan so a couple what one is really questions Rupert which is that I am I correct to assume that the number of van parking locations that they're showing that's that's really about the the afternoon pickup all the vans arrive at once they all get kind of loaded up simultaneously and then they depart um and that's that's what sets that dimension of that space um is that is that a correct assumption yeah I think I think that's right I think that the van drop-offs in the morning like the buses will be as close to the front door as possible um and I do have a question about the van section for later when it's my time and so then I think of all the options that you were showing I think it's C that I like the most but the canopy I don't mind that it kind of steps in steps out and kind of works with the the building a little more I would tend to favor um more uh enclosure on the trash and uh and transformer service area although not necessarily a wall I worry you know the long term maintenance of a wall that doesn't have you know space behind it is is often problematic um because the the caps wear out and you know you don't see water leaking in like you do in the building so um but uh I guess I opt for more screening versus less at that at that condition Rupert thank you yes um in terms of the screening uh because this is uh the deliveries as I understand it are going in through that door for the kitchen um my guess is that any screening gate that we have would be wide open all day long to speak to all the deliveries that come and go uh so it you know practically speaking you know it's potentially in the way of clearing snow um and you know something extra to deal with but um but I understand visually uh it it has its value at some point we might want to consider whether it's lockable so that we don't get people using the dumpsters that aren't part of the school um so that's that's part of it if you could go to the uh the slide that shows the front door the west entrance this yes that's the one so um we have uh maybe it's just this model so far but there's an issue if vans are loading or unloading they're going to have their uh red flashers on and their stop signs out and so the buses that are loading or unloading won't be able to pass them and sometimes it can take a while to do the van loading so I was hoping that we could look at some kind of um island or something so that it's not the bus roadway and then the buses could legally pass vans that were in the process okay um this cut through the center of the loop was added specifically so the vans could get by the buses uh but hearing that it needs to work both ways uh we will have to look at that here yeah I don't know what could be done but it's an idea is rick saying something yeah that would only have to that could be a two-foot island right with a curb along the side of it yeah just to make it because they're all professional drivers that's a plus so that would make it the legal legally be able to pass a stopped van rupert is it problematic to plow though if you've got that a little tiny island so if there's signs on the island there's not going to be any plowing on it if the island has um sloping curves it may be that we the plow will hit it while it's doing the rest of the driveway um or we may end up having to pull a snow blower out there to the island to clear it you're muted again right what an island with slope curves meet the legal requirement for separation between a travel lane and a bus drop off I have no idea um you know there may not be any choices here yeah so yes Kathy you have yeah I'm on a different topic so I just want to if there was anything more um so when Jonathan liked option c I did also but I thought the skylight is asking for trouble um both when I asked if you can keep the roof clean um um dirty skylights are are dirty um so it feels like you've got enough light coming in and it's a nice it's a really nice protection if it's raining or snowy um to come in there um so come in or come out um so I would just even though that one picture you showed overhead Tim shows that nice ray of light coming downwards it doesn't seem to me like it would be too dark in there given the night of the the building that it's on yeah I agree with you Kathy I had meant to add that I don't think we need the the skylight so that's enough that that's options option D is C without skylight is that what we are Tim uh well there's also a break in the the plane at the middle of the where you turn the corner in the building but it's they're very similar okay hold on so if you look at option C there's only one roof elevation and then when you go down to option D there's a break in the plane subtle granted so just just on a when you is it less expensive to have no break or just is it basically the same because these are facade facade like attachments um I every every every detail every corner every turn you make just in in a real sense as cost but I I think for the sake of design at you're you're getting into the level of the hundreds of dollars yes yes it's yeah the answer is yes but not that much okay I'm not enough of a designer to know whether I like C or D better so I will leave that to the world that looks carefully at lines um and breakups in lot of lines yeah can I can I just can you all hear me yes that's Margaret yes okay so can I just chime in and say another component of this it is and it is really kind of in the details is how those roofs are going to drain I mean I actually like the visually I like the fact that they are offset a little bit I think it looks good but I my primary concern here would probably I think needs to be you know which everyone you think is going to drain more efficiently because I do think the difference in cost would be de minimis but um you know it's about to me it's about the details of how you drain them understood um yeah and and we will obviously be looking very closely at that and what is not super apparent here is that there is a um a slight projection of the kindergarten rooms because they are taller and so there's actually some roof area there that makes it more than just the return of the canopy that gives you the room to either slope insulation or add the roof drain or or and a lot of our projects in fact all of our elementary school projects probably recently have a detailed similar to this so we are well aware of it thank you project um and then I don't even know that I got to E yet which is an um it simply stops the canopy short allows you to enter straight to the door but this does not have a canopy at the coverage uh at the door so so it was just there for visual exploration yeah I hear Kathy's opinion of a facial expression that's okay bad ideas allow you to know what the good ideas are so I say rupert's hand is up but I was wondering on the swinging gates is it possible to have a sliding gate that just slides over and back um instead of two that opened one that goes over to have it basically open when you want it to be but then able to shut it did does that is that uh sliding sliding gates are certainly possible um the amount of area that you can open up becomes a bit more limited um and then if the real issue with the gate is it will never be closed I don't know that sliding first swing addresses that but rupert has his hand up and maybe he can offer a bit more insight um yeah I'm I'm gonna team back with folks I mean I think from practical standpoint the custodians would rather have no gate at all because it's just an impediment um um uh for and and the uh the flowers will probably still bloom all those guys would probably feel the same um it does increase security a little bit to be able to walk off the dumpsters uh with a gate but we could physically lock the dumpsters we just have not had the uh consistency in practice to do that um I was uh I had my hand up though just to comment that I have no objection to curvy roofs on square buildings um I don't find it visually unfortunate in any way um and in some ways I think it's kind of add interest but that's that's a personal visual perspective no functional one yeah I will say that the the study of of these entrances and canopies is in no way complete yet but we're just trying to you know hear what your preferences are what you want to publish um then and you will be revisiting this sure and then with the added layer of function uh after we speak to somebody administrators basically how things work how you know making sure that we're covering their right amount of kids coming in and leaving the building that there's enough area for assembly for whatever has to happen and then Rick what is the underside the the finish of the underside of the canopy and the pre-finished aluminum of some sort socket panels got it okay Jonathan I don't necessarily object to the curves the if we had a curve here though then I would want you to explore a curve at the front entry and it's just a little bit about the you know the hierarchy of that front entry having kind of the most visual interest and this one needs to be you know call out entrance but but you know if it's not our primary entrance somehow it needs to kind of step down a little bit in in the level of elaboration at least in my mind um and the I guess the other thing I wanted to note on this view is uh you know I I'm interested by Rick's idea of putting um you know the the gravel up on that roof to so that we don't have uh both you know the issue of a dingy looking white EPM roof eventually um but also I think there'd be an issue with the uh screwing up the um the daylighting because you would get a lot of light bounce on the south side you know off these roofs into these classrooms and it makes me wonder if that same gravel treatment might need to happen over the service entrance I can't quite remember what the the roofs to the left of the stair hall are I can't remember those rooms or classrooms or if those are administrative rooms or there are two offices there at OTPT so there will certainly be occupants and um you know as you're pointing out south facing light on a white roof or a very light roof can bounce an incredible amount of light so that is definitely something that we're going to have to pay attention to there are other low roofs that are in front of windows on the north side of the building obviously Claire will not be in issue there to the same extent but the dingy roof effect is real so I have to think about all so on the enclosure um you know I I think we you know if if the gate is not going to be used then we've got an object that we're maintaining but not using um and it you know as as much as I would like to screen as much of this as we can there's really no point in building a gate that will not be used it wouldn't be a cheap gate one way or the other that's a that's an awfully wide opening um Rupert do you know are you anticipating like a food truck kind of backing up here or would they just kind of parallel park in where the buses are shown now and they would just kind of be dollying stuff through here um well I think right now we have both things happening at the middle school where where food service unloads I'm not quite sure at the elementary schools how much that is but this is going to have a bigger kitchen than the other elementary schools so I'm imagining that both will happen depending on which purveyor it is and and and what vehicles they use the bread trucks might just load out the side but the produce trucks and the saturated trucks might back in okay um it's something that I don't know exactly it's worth looking into Rupert are the dumpsters front or rear loading we are switching uh vendors this year right now the dumpsters are all front loading I'm not sure who the how the new vendor will work at but I assume that it will the the truck will pull up forwards empty the dumpster and then back out okay maybe there's a way to limit an always open opening that would allow access to both the dumpsters the a more direct food entry and and give every source what they want for getting 10 feet away from the transformer yeah I think that would be a good thing to look at yeah are you thinking of like a partial screen or something like a partial screen and I think that maybe the screened area might want might need to come out to be flush with the south side of the gym to get the room to do that but I think that that might be a possibility yeah are you thinking a wall that is there at the south side but maybe returns one bay of the fence it can be a combination of wall and perf metal got a couple of examples that we've done a similar thing a sliding gate I think sliding gates and like like to have a wheel at the end and that can complicate snow removal and making sure it can always roll swing gates are the most foolproof you might be able to locate a swing gate in such a manner that it's always open but you can lock it if you think you have to I'm looking at one opening and basically you go off your back in or drive in at three forks to access what you want and and through something that's perforated and something that's solid you can get the screening there's something to be said about seeing behind the wall too and being able to yeah not a hiding place yeah yeah good point good point I like what you're thinking and Rick could it swing in rather than out if you move it out it could it could swing in rather than out I mean if you you could swing it imagine if you will an opening on the right hand side and that fence line came out and if it swung in and swung tight against the walls was able to swing you know 360 against the inside face of another wall of the other area that could be a possibility because the trouble with having a gate swing out is you can't swing out into the vehicle that's approaching it if it happens to be closed when you when you swing it on the other thing I would throw out there is you know it's nice to screen the the transformer um but the thing to me that we really would the you know the highest priority to me is screening the the dumpsters and so if the screening was really focused on the dumpsters and the path to the service entrance and the and the transformer were exposed to view um at least visually I would be okay with that you know our eyes get used to seeing things like transformers we see them every day um but the you know the dumpsters are nice to screen um and and kind of keep people away from them too and then you're not having to worry about opening and closing a gate for all those dumpsters I mean all those deliveries so I don't know and and frankly have we thought at all Tim about having an overhang over the delivery door uh we have uh one of the options yeah one of those that yep there you go yeah yeah I was gonna say also if it swings in we need to figure out how to clear the snow out to be able to open the gate without opening the gate to get the snow clearing stuff in very practical issue yeah this this this area certainly um requires more thought like just off the back we probably wouldn't make the cover over the service entrance store the same language as the building entrance on this side but um but yeah we we're hoping to you know get a good sense of your priorities you know what is important to screen what is not whether it should be screened so I think we are some good feedback here Sean quick question and again not a building person is the transformer where the electricity comes into the building from the from the road yes that's where the high voltage electricity from the road is reduced to building voltage and as the um I can't remember the layout of the site does electricity come in from the road on this side of the street or will it in the future it with the new building the service for the electricity will be switched to the south entrance and okay in the drive to that transformer okay okay thank you at one point I seem to remember we were talking about transformers out uh farther away and there was a sort of a cost analysis about whether it made sense to pull the lower voltage all the way in from across the parking lot or not and I'm not sure how that's setting one of the driving factors for putting the transformer there as you're saying was you know the project pays for the wire from the transformer and ever source pays for the wire to the transformer so the closer the transformer is to the electric room which is right here uh the less those feeders are charged and and honestly they're expensive so that is why it's there I know I should know this do we have a emergency generator we do um let me where is that looks like you can barely see it um but there's a dash rectangle there and that that might that rectangle might be a bit too far left what versus what's on the electrical drawings but uh a similar discussion about the generator placed it about here um because those feeders to get from the building to the generator are also present I mean in a perfect world we would put it as close to this um storage building as possible but uh you know as a as a nod to cost we sort of split the difference but it is I you know visually out of the way and then there's also the possibility of building a fence around it Tim what is this a 600 is this currently what was priced was a 600 I guess okay on a on a day take yes this will be a very very large tall generator so I don't think a a fence a fence will hide a fence will hide the lower half the lower half to maybe two thirds that that is the realistic few yes and then I mean there are also pads that have the services and infrastructure for the PV array so there's going to be stuff here pads for the vehicle charging there's going to be stuff so one of the things I was going to ask about the stuff that we're not necessarily paying for now is if we ever had a backup backup battery a backup battery for solar would it go next to the would it go out in that general area where where would it be it's a better way of asking it I think it would go out in that general area the same sort of parameters that that cause you to locate the generator and the transformer a close um the feeders all come with a price and the the closer it is to the switch here and the connection to the building the lower those costs I mean technically it could be anywhere but it wants to be close to the PV and it wants to be close to where it feeds the building for the sake of reducing cost on that transmission line yeah and that battery is about parking space size so it would most likely be in the in the neighborhood of the generator the car charging infrastructure yeah because we've run out of parking space size things near the transformer yeah you have it at the um Lexington school it's behind just in a that was the battery I saw um that wasn't I think linked up yet that tesla battery that was what we're talking about right in terms of a visual but I can see yeah okay yeah you know they come in they're all different sizes um cat these so they went back and forth and um ultimately it's really hard to plan right we needed to plan we needed to know the size of the pad um and you need to do that we need to know what pads we're placing now for this project right because we have to go before conservation commission as we did in Lexington and um so they estimated the size of the pad and so now they're kind of backfilling the amount of battery that will fit on that pad yeah any other hands um in terms of materials that we have to present um until we have the meetings with the administrators and school staff that is what we have on this particular topic the upcoming building design subcommittee meetings will most likely get more packed with more materials as each one goes but that is what we have to present today thank you for your thoughts and I think you were pretty clear on some of your priorities and how we want to adjust the design and rethink the service area on the south side of the building. But Tim and Donna if I know Wednesdays were good days for you for these meetings and you at one point it said Tuesday afternoon so if in the interest of efficiency as you are talking with Tammy and Allison about staff you need on this if the building subcommittee needs to meet at a different time you know we can you we should just have a conversation about it you know if we want to bring everybody together at one point so right now this is then the time slot so I'm just saying it as a as a gender setting we had we haven't I don't think we have but I'll double check because when I was away on vacation everything got posted but we haven't necessarily posted them but I can change the postings if we need to okay yeah so I think Kathy our conversations well it's two full right so having conversations with Tammy and Allison as it relates to some of the function spaces inside the building those those are going to occur outside of this building committee subcommittee um but then we also do want their input um on discussion decisions that are made or recommended I should say in this group as well as the site subcommittee and their time is a challenge right now so that we may need to shift or if you're comfortable we yeah or we could have it with them while we're meeting with them about the other stuff and bring bring back to the to this group what their comments are yeah my main point was do what makes sense to get the input you need and then we can bring it together so just on a you know so that we're not asking this subcommittee to make decisions or even think about some of the options that need input from the users of the building I mean we have work here but we may you know when you start talking about some some of these it may be other staff yeah are there any other questions or comments today we do have public so I will see if we have any comments before but I don't yeah can I just make ask one question for clarification so so we talked about um having the building subcommittee the next one at this noon on the 31st now I've put a hold on my calendar for that I totally agree with what you said about the need for denisco to meet first with the staff is it helpful if we if we think we're going to potentially keep that meeting until it's confirmed is it helpful if I send an invite to the folks on the subcommittee so they know that it's out there because right now there's no mark or anyone anyone's calendar for that I think so Margaret there's both a site committee at nine in the morning on the list and a building committee at 12 sub the subcommittees so um so there there is but no no invite has been set out right because the invites don't even get sent out till angeles at post them so but what you're asking is putting a hold on people you want me to find a hold so I would know that I would put a hold on people's calendars and then I'll have an agenda setting just to make sure we need both of those meetings yeah and then I'll have Angela post them and do you know the full because well if we post them yeah it's Wednesday so if we post them by Friday afternoon you know officially post that play you know I got alerted by okay want to stoop public person that there was still a site design because I for this morning because I'd forgotten to undo it so I just want to make so okay that's great so that's the logistics so does any um we're open for public comments right now um if anyone has any please raise your hand I am not seeing oh there's a hand hi that's Tony Cunningham um I just wanted to ask about the canopy that's over the kindergarten classrooms is that a requirement or is that there for aesthetic reasons because um or is it because there's doors uh because I I wonder if I you I think you said for daylight but I would wonder then why you wouldn't also need it on the second and third floor if it was for those reasons um I like the larger canopy over the doorway and I agree with the comments about no skylight and having it be not white and something that won't look grubby as dirt and debris falls on it and something that's easy to get the snow off if it's not melting um so yeah that's all I had thank you you know so I think we'll put what we're collecting these comments um and you know at least one thing Tim had said it's about it's also in replacing the sunshades that are among the top floor things so we can come back and revisit those thank you Tony okay so so I think that's it so right now we're scheduled to meet again at as a building subcommittee at 12 on Wednesday and what's listed on that is corridors and project areas so that that's just you know the to be determined is that the right list or not and as soon as this is a little bit more firmed up I am going to send something out to the full committee so if you need the first week in June Deniscoe you know as as you start to sort through just you know start to think about what's the first or first and or second week of June so that you can do this review um um so I I want to thank everybody and I think we unless I see a hand up I think we can say we are adjourned at uh just before thanks everyone thank you