Name another podcast like this. We're gonna bring it to the table. Boss talk, who your girlfriend favorite? Boss talk, we gonna do it how you want it. Boss talk, yeah, everybody on it. Boss talk, it's. Check it, check it, check it. This is a unique house, it's your boy, E-CEO, and I'm here with the lovely official, Mr. Mako, what's going on? None of my dad walk on it. Man, man, say man, hey man. Amen, God, it's good, man. Very good. He didn't drop the jewel in here on us, man. You know what I'm saying, man? The guy showed us love, man. We pulled up in Atlanta, we didn't have a clue, man. Brother just showed us man love in the city, man. And hey, man, that's how you know he's special, man. Check it, man, K-Mages in the building, man. What's up, man? We in here. Say, man, loving it, man. It's summer day in Atlanta. Hey, man, I'm loving it down here, man. So where do a dude go, man, like me, when he come to town, man? Anywhere. Strip club, capital on. No, no, no, no, no, no, no, no, no, that's the dope movie, man, y'all got him down here. Best food in the strip clubs. Yeah, man, so when I think about Atlanta, I just think about Party Central. You know what I'm talking about? It is. I'm being real. That's what, when I used to come for my birthday, I'd be like, man, I'm going down there to walk out. That's where people go. Yeah, they like, I'm coming to Atlanta. Every year. But has it always been like that? Or is it just like that? I feel like my whole like, yeah, it's been like. You've lived here all your life? Well, I'm from Cardisville, Georgia. Oh, yeah? Which is 45 minutes north. Yeah, still. I've been here. Yeah, you here, man. Yeah, so it's always been like this. Like that's the go-to. Yeah. So who is K-Major, man? K-Major, singer, songwriter, producer, engineer. Wow. You know what I'm saying? CEO. CEO started off how old? When I was 12 years old. Man, it's dope. And when you say singer, you really mean like singer? Like I said, yeah, I said. I had to check because nowadays you have a lot of, the younger generations say I'm a singer, but they will never sing without auto tune. Oh yeah. Well. Yeah. Because that's like the end thing now. Yeah. Me personally, I'm old school, so I love the R&B, like old school. I came up like stage performance. But I'm new school, and I'm old school, but I love like both. Like both. Yeah. I'm strictly old school. She really old school. Like, yeah. I like to blend it. I like to blend it. But it is a lot of the new schools. The new schools, yeah. Man, this dude is dope, man. He got music with Augusta Sino. He got music with Jacquees. This dude, this dude dope right here. Appreciate that. Yeah, yeah, yeah. How did you get those hookups with them? So I've been working with Jacquees since he was like 16 years old. You know what I'm saying? We met through a mutual artist, Issa, which is his cousin. Yeah. I did a lot of early work with Issa when I was coming into the game. Okay. He was like 16 then, and he had a record deal. I was making beats with one of my mutual friends and bumped into Jacquees for the energy. Wow. You need to work with me. Yeah, yeah, yeah. Hyper, hyper, hyper. It has to be kindred spirits though for you to be able to work together because if you meet somebody that their spirit is just not, even if you want to work with them, it's gonna be hard to build that chemistry and produce something good. Yeah, it was easier for me because I had started my record label in high school. So I was already used to like seeing star potential and potential in other artists other than myself. Where'd you get that from? Who taught you all of that? These are in high school. Yeah, I'm in a military family so like we traveled a lot, different cultures, different ethnicities. So it was like always a leadership role when it came to like my relationship with friends. Anybody else in the music industry in your family? My dad does professional booking so he does all my booking and then my mom, she played piano, she did like piano lessons growing up. They didn't do anything professionally as far as artistry, but they loved music. But they had a knowledge of it so they got embedded in you from an early stage and that's good because most people who just have the talent they come up and they just want to do the art. Exactly. But don't realize that there's so much more to be an artist today compared to back then. Back then it was just, I'm just an artist. No, yeah. Now you have to be an all-around artist including knowing the business as much as you might have a team that is a control of everything. You still need to know how to do what they do. Exactly.  Exactly. It's important. It's important. It's a lack of that in the game right now. No, but to me it's gotten a lot better than what it used to be. It's a lot better for sure. Yeah, people are more aware. Internet, yeah. Internet and then also these, because we say this a lot. So people on these platforms are saying these things now and people are watching it and like, oh, and peeping game. And learning. So even, because sometimes it's hard to search on Google because you have to put the right words in to get really what you need and not what you already know. Exactly. Exactly. And so are you, you feel like, how do you like what music is at right now? I love what music is at right now. Honestly, I mean, it's a lot of, it's just a lot of creativity that's being exposed. I feel like everybody does. Art is supposed to be something you do as a voice for yourself, you know what I'm saying? Outlet. I try not to judge people's art too much to be too judgy on it. But I like that the industry is so open. Okay, okay. And like the collaboration in genres is more than ever. So it's like a lot of, it's a lot of things surfacing from the bottom to the top, like rap music being one of the number one genre. You know what I'm saying? It's big. It's real big. I mean, and it actually, it transcends culture. It transcends countries. This is dope. You starting to hear them in movies. Yeah. And you riding that whole way, you tell them which way to go. You know what I'm saying? Exactly. And we ain't trying to hear it. Is it a trend, just like everything that cycles around and come back just like in clothing. Certain bell bottoms used to be in style and all of a sudden it goes out of style and it comes right back around. Yeah, it's definitely like that. Is it the same thing with the industry? Definitely like that. Like rap is in style now then ARMY will come back later on. It's like that with a lot of things. I told my friend that earlier I was like when I first came into the game, my space was popular. Now Instagram, and I remember linking with my friends in the basement, like learning how to write songs and do music. We would dance, do little dance videos, the Soulja Boy era. Yeah, yeah. And how you see it coming back with TikTok. Yeah, yeah. It's like the same thing. They just gave it a platform. That's right. So you can just, so it's crazy to see it just coming a little bit. Yeah, yeah, yeah. I like it, man. I really do, man. So when you see the youngster coming up, what do you say to him? The one that's striving to be, do the things you done done. Cause what you've done is something to be proud of. A lot of dudes will never do what you've done. Yeah. A lot of kids, I'm dealing with promoters here who I'm looking at to come up and I'm like in my mind, I told her, yeah, let her come over here. Why? I say because she's never created a, it's been years. I went back to 2014. Where is the talent? Where is the person that's supposed to pop? And that's the questions I would be asking her.  You know what I'm saying? Yeah, it's a digital, it's more of a digital game now. It is such, I totally agree with what you're saying because on social media, like if somebody even applying for a job, first thing they look is look on social media to see what you're doing, Instagram, Facebook, whatever. So in anything you do, you need to represent your brand properly and do your research. Where's the talent at? You know what I'm saying? When I look at you, I see the work. Exactly. So I'm like, I want to talk to that guy. When I seen her, I was like, where is the, you've been doing this for a long time. Where is that talent that came from you? Because this city was booming. 2014, I was coming down here. Exactly. Yeah, yeah, yeah, strokeers and all that. I was in there. Okay, okay. I come through, man. You know what I'm saying? Goosebumps, that's what y'all talking about. I know. I know. I know what you're talking about. You know what I'm saying? Like I came through here. Yeah, yeah, I was over at that thing. What's that little, the little small when they got over there, but it's big in name. What's the name of the one? You talking about magic? No, not magic. I've been there too. But no, what's that? I know what you're talking about. The other one. Blue flame. Yeah, that thing jumping, but it ain't big as I thought. When I came, I was like, man, that thing gon' be huge. You know what I'm saying? Blue flame, but then it was V Live too. V Live was big. That was who? It's King of Diamonds now. Is it? It's King of Diamonds now.  Yeah, we switched the name, you know. Yeah, yeah, but the game still same, you know what I'm saying? It's the same game. So what do, what, so are you signed or are you right now independent? I'm unsigned. I'm unsigned. So it's always been a misinterpretation or a misunderstanding of my career as a producer and writer I'm signed. Okay, got it. I have a publishing situation with Warner Chapter. Got it. But as an artist I'm independent. That's dope. So I own my own company. But then when it comes to production, you know you got it organized correctly. Yeah, I signed producers to my company. That's it. Work them through my, you know what I'm saying? I got like a system. Yeah, yeah, yeah, yeah, bro. That's dope.  For sure. Yeah, so you be right. For sure. That's the one you talk to. He knows the people. Yeah, yeah, that's who she looks like. Yeah, I love writing for other artists. It's just another outlet. If it don't make sense for me, if I'm writing a song like, oh, I can't really. Yeah, yeah, yeah, yeah. Yeah, yeah, yeah, yeah, so, so have you ever wrote songs like, dang, I don't know if I should have gave you one. No, I do it all the time. Yeah, every session, every session with every artist I work with, I write something or do something, and I'm like, dang, yeah, yeah, yeah. Like, I don't know about, that's, that's the one. I should have kept that one. I should have kept that one. No, no, that's the one. Maybe just that one. Maybe just that one. That thing about the pop, you know. Yeah, it's crazy to see records work like that, though. It has to be the right voice and the right energy. Everything gotta be right, yeah. Because even when you write a song and you say, oh, I should have kept that, the person you gave it to blew it out of water, and when you did it, it would have been, it might have been okay, but it wouldn't get that scene in the back. That's what happens. Typically I do a song, I'm like, I wrote it, but it sound like a female song. I hear a female singing. I'm like, Jesus. So what about? I should have just featured her on there. So you produce the beats as well? Produce, so, do you produce beats that go the same way? You're like, dang, I should have kept that beat, you know? Same thing, most of my placements in the game for other people is beats. More beats than songwriting. I think the main artist that I've written with a lot, collaborating with was Jacquees. We did a lot just a lot of song. What don't you do? It's boy walking, walking, walking in a tank. I summarize myself, I'm like. Thank God for it, that's what I tell him. Is there anybody in the industry that you look up to that is all-rounded, that you can say, I admire that person. That's the person I wanna be like, I wanna know as much as he knows. Yeah, see, I used to be signed to The Dream, the songwriter of The Dream. Oh yeah? So he was like a big brother mentor, him and Tricky Stewart. And so I got to see somebody who was an artist, songwriter, producer. And then Dream is into art, too. So he was going to school. I don't know if he's currently still in school or not. I graduated, but he was in school for art. I'm saying to learn how to make a clothing line and draw and stuff like that. Is there some things that you'd like to branch out and see as well? Yeah, I just seen him kinda take the jobs himself. Nobody's gonna do it better than you gonna do it. Man. Which is so true, but I've learned or I'm learning to let go and let other people handle it because you can't do everything. That I'm learning the same thing. It's hard. It's hard. When you know that if you do it, you know exactly what you want. And for me, sometimes it's hard for me to explain to you what I want. I know it. I see it. You might just get out of my way. Let me just do what I need to do. That's the hardest thing. I already know how much time it's gonna take me to stay out of my way. That's the hardest thing. You performed on 106 in part? Yeah, I did that in 2010. How was that? Yeah, I did one of the last performances on 106 in part. Me and Darrell had the same conversation. I was like, man, cause I never got to go. You know it's over, but I used to watch it. I'm like, how was it? That show was prominent in my career. He says it didn't look like I thought it was gonna. Oh no, no, no. I did it right now. It's like, yeah. It's like, yeah, it's like a room and then like, yeah, it's weird. It looks a lot bigger. Yeah, it's like cameras rolling through. And like people directing you on what to do and the crowd is kind of like, they moved the crowd from this area to this area on commercial break. It's like, yeah, it's like. To make the place look bigger. Yeah, it looks super huge, but it's so small. It is so small. And you was like. Camera tricks. Camera tricks. While I wasn't. While, how was that? It was great. I performed on there. I did a contest in Memphis, Tennessee. It was like an independent artist contest. 250 artists. It's like a little $200 sign up fee. We drove up, won the contest. It came like top three. And if you win that contest, you go to BT 106 and Park.  So they all happened in the same room. Yeah. So they have like, they used to have regions where they would do like the preliminary contests. And then the winners of those contests, they would match up with other winners from other areas on a certain Wednesday. So the last one I did was with Ray Schrumert. Okay. That was actually on there. They competed, they were going by out of state boys at the time. Wow, man. So stable. I don't know. Why did 106 and Park even stop? Well, that don't even trip. Don't even trip. I'm working on some B. Yeah, it's like, we never, a lot of shows just kind of. Do you think that 106, I know what you're doing, but do you think that 106 and Park that it's still well needed, something like that? I think what's happening is people don't watch TV like they used to. That's correct. Okay. So we doing some bone. Everything is fine. But that platform as in like what they did for, do you think that's well? Yeah, if they can figure out, yeah, they should figure out how to bring it like online. No, no. I should figure that out. You should figure it out. Yeah, yeah, yeah. Bring it into a place where we can have fun with it again and people can be organically drawn to. Exactly. That's all we have to do. I think the closest thing we got to that right now is like the verses thing that's going on. The verses and we're looking, we got big production coming. I'm gonna be tapping in with you now that I got all your, all your work. And I got the right people on my team. I can do whatever, man. When you strong, man, I thank God for it. You can make moves other people can't because you got, you know, the right people back. Exactly. What is the thing with the verses?  Exactly. You know what I mean? So that's why what we do on our platform and our segment normally go for hour because we always go back into, back in the days, who are you? What were you thinking? What did you go through in life to get you where you are today?  He got everything, it's perfect. Nothing ever happens to him. He got money. You know that facade? Yeah. Okay, but yes, he's just a human being just like anybody else. By you telling your story and telling the people, like the kids or adults, who idolized celebrities. Exactly. What I've been through. I grew up without a daddy. I had anger issues. Or I went to prison because of X, Y, Z. Exactly. It can help somebody who's. Changed, yeah, it changed my career. Just watch your interviews and World Star and just YouTube, Breakfast Club, just anything to learn like, oh, okay, I'm not tripping. Yeah. It helps. Man, how good does it feel to not have to portray that gangster role like everybody does? Oh, I love, I love. You see what I'm saying? Yeah. That's a big deal. It was confusing coming up because being from the South, the music, so you like, okay, well, maybe I need to rap and talk about this, you know what I'm saying? And then you kind of start learning yourself. Yeah. I feel like as I progressed in life, I was kind of like, nah, it ain't me. Feel good, don't it? Yeah, I'm in my own. You ain't even, you and it's dope. Like I ain't gotta do all that. I did all, I did a lot of that. So I know how it was in my early age, coming up more than your age.  You had to have a, you had to have a Mac 10 or the Oozzy. You ain't deal with the Draco. You know what I'm saying? You had to have it and you had to, yeah, it was hard. I still like that one. Well, I get it, it's like that, but you ain't gotta move like that. Then that's the dope part. But not saying you don't move to protect yourself. Protect yourself, but you don't gotta be to put in that facade out there. Cause that energy brings that same energy towards you. Yeah, I always did music as an outlet. So I never wanted to do the same things or practice what I seen around me. I was trying to get out of that. So I figured like music is that, so I don't want to get into my outlet doing the same. You know what I'm saying? Yeah, yeah, yeah, yeah.  Why are you down here? You think about it. You guys are y'all circulating around all the, everybody man, everybody that you can think of, the Zatobans, the Gucci's, all these people down here.  Yeah, some people don't fit. You know what I'm saying? You done did stuff for French Montana and Chris Brown. I've seen, you know, I'm just looking up. He worked with a lot. He done worked. So who else would you like to work with that you haven't worked with? That's dope. That's a good question. Cause they're all at your fingertips or maybe it could be somebody that's not even here. They gonna cut down to you. I just want to continue to work with dope people. I know, I like Pharrell. Sometimes I meet people I look up to or looked up to in Korea and I don't like them. I'm the same way. I'm the same way. I'm the same way. So it's hard. Sometimes I'm like, I don't want to meet them. I'm like, I can't hold it. They said something in the interview and I'm just like, what? Trump. Yeah, they go there and so it's like, I just, when it happens, I don't know. I don't have any, I just want to continue to move forward and work with dope people.  Oh yeah, I walk out. Yeah, that happened. Yeah, I'll give money back, whatever. The energy, right? I'm so peaceful. I'm a peaceful person. If it come with confrontation or it's too much. It don't fit. Yeah, if we can't talk about it and just keep moving or anything, if the song is just like, what's this? I'm gonna, yeah, it's hard. So the process and you got it, I'm gonna get him on the show at some point, but the process is you come in, somebody come in, they want to beat from you. We talked to KLC about this, who else do we talk to? Sergeant Jay, isn't it? Mad Max. Mad Max. What's the process? Like how do you know this is the beat I want to show him that he might like? You never know. You see what I'm saying? It's the latter. You shopping like here. So you might want to create a beat right then and there. Yeah, cause it's like with certain artists, you hear their songs on radio and I don't think that people think like this, but if you get in with an artist and you're used to hearing a certain sound, you think that's what they want to get. They don't want to hear it. And in their career, they might be trying to get to the next point. So sometimes you could play the next point type beat and they're like, bro, what's this? It's too weird. Yeah, yeah. And sometimes you could play what you think they like and they're like, nah, I want something different. But do you interview them? Because a lot of them say that they're going to the student and like question them.  Because you have to know what their mood is, how they're feeling, what they've been through to know how to create something to, you know. If I was giving advice to somebody, I would just say, pay attention. To them more than they pay attention to themselves. That's the advantage that I think I've had as a songwriter and producer, I pay attention to an artist. And I'm like, this is what you need versus. And you do your research. Yeah, definitely. I pay attention to the media. I pay attention to what's going on. And I try to get into the mental of that artist. So a lot of times in my sessions, it's artists like, how did you know that?  But that's good because it makes them want to always come back to you. Yeah, exactly. Because not everybody can get them. Exactly. But it's definitely just psychological. It's just like, I saw you on Instagram talking about a breakup, you know what I'm saying? I saw you, I saw your angle. I saw what you was reposting. I just seen what you was doing during that moment, going out or you just at the house. So I'm just peeping. And I'm like, OK, if I was in that moment, what kind of song would I write? Yeah, big dilemma in Dallas is like some of the artists we've interviewed. Some I'm not even from Dallas. Maybe Louisiana, wherever. It's like, how do you, how is the monetarily issues? How real is what you see? Or is the numbers, the visuals, the, you know what I mean? You too. How real is this stuff? And you should know this because you're so handsome. That's right, like, I know for sure. How real is what we see? And you see where I'm coming from? With the artistry portion of it, earlier in artist career, earlier a lot is fabricated because the artist is still learning like they're doing, they just got money for the first time and put it like, I got a bag now. I'm going to do what Future did. You see what I'm saying?  So it's always that first. And then once you kind of see the reality. You start to, you start to click it. Smart artist has probably lost some money before and got it back. Nah, you see him like Drake, maybe a T-shirt and expensive chain, but nothing too. Nothing too crazy. Yeah, it's just pieces.  Like, I remember and being in Texas, you hire a chameleon and say, you know, once you sign your deal, you know, that first portion of those deals, they were signing during that time. You fighting to try to figure everything out because there's still in money from you. It's a credit card. You see what I'm saying? A record deal is a credit card. They just give you a balance and you spend it. You gotta be mad. However you think you should spend it. Yeah. And sometimes if you're doing right, they'll give you a little more, but if not, they disappear. Should a person sign? Yeah. Should a person sign these days? All, it varies. You know, with me and my career, I've been independent so long because I don't. I've always looked at the deals and known what I was looking at. Yeah. Would you ever sign them? Yeah, for sure. For sure. If the money, right. But I would have to be in a place in my career where I just felt like, I got like three years left. What would it take for you to sign? That's good. That's good. Like, what should an artist look for to say, okay, I'm gonna sign? I know you can't really talk for any other artist to put yourself, but what would you look for? I want the money. Of course, except for the money part. That's the first part because if you're smart and you look at the money, it's like, let me go ahead and get all this money and invest in other things outside of music.  You don't want somebody telling you when you can put your music out. But even with the money part, is there a certain thing in contracts that people need to look for? Because sometimes when they say, oh yeah, you getting this amount of money, but you say, oh, okay, I'm gonna sign it. And when you say, but this is not what I signed, but it's how they word it. That biggest problem is creative control in the contract. That's the biggest thing that people fight about because the percentages is right in your face. So your lawyer gonna be like, this is what you're giving up. And you accept those terms right off rip, but what you don't realize is in August your fans begging you for an album that you promised them. Then you can't even. And the record label keep pushing it back to October and January. And they blame you, they're not blaming the record label. They're like, you're not ready yet. You're not doing the right things as an artist. And so you get into this fight with the record label and you go back to the contract and it's like, well, they have creative control. Wow. And then how hard is it to own your own masters because then even with going and signing these things, you can request it, but are these record labels or are these labels actually giving this out? Like, no, I'm not gonna give you that or are they agreeing to it? No, it's like, I gave you some money for that. I paid for it. Yeah, like I paid for that. I gave you $200,000 for 80% of your master's. Exactly. So you can play it back, but you didn't make the money back yet. I didn't make my 200 back. So, and plus the interest on top of that, I didn't make it back yet. Even though your album came out and you're famous, I didn't make my money back. But going into it, can you? Going into it just don't sign because you're gonna give up.  It's like, you don't own it all.  But can you say to them, I want 100% of my master's when it's done?  Majority of them gonna say no. Yeah, the majority of them gonna say no because that's the money. You know what I'm saying? You wanna eat off the records for a lifetime, not just two years when you assigned them, and you're trying to eat off this hit record 60 years from now. So record labels are into that business. They not really into the... Let me ask you this and let's get back to the music. Kool-Aid, man. Kool-Aid. How did you come up with that? What was that? How did you figure this out? How did you bring Erika Banks into it? Give me the spiel. Don't hold back. So Erika been my friend for probably like three years. I had known her before. Any of the newest stuff going on. We had a friendship. We met through a mutual friend, Roscoe Dash. So I was recording music and we relinked here in Atlanta about like November. You know what I'm saying? And when she was with me, I'm just, she's like, where your music at? Like, what you doing? So I'm playing my song. She's like, yo, that's hard. But I got like 30 songs at the time. Yeah. But as I'm riding with her, my other friends, every time I'm playing these 30 songs, it's like, Kool-Aid, Kool-Aid, Kool-Aid, you need to put this out. You need to put this out. So I'm just like, all right, well, whatever. Yeah. Still just kind of sleep on it.  Wow. Matter of fact, I'm gonna be hitting the video. That's dope. Like she just kind of took it like that. Wow. That show that she had so much confidence in that song. Yeah. We always had a musical friend. We met on some music, on a musical thing. So I was always like, nah, I don't like that. That's hard. And she was always just, her personality is like that. Like turn that off. That's whack. And you treasure her opinion. Yeah. You don't get that opinion from people now in the world. It's always like, oh, you great. That's hard. Yeah. They don't tell you the truth. Yeah. So it was just like- Those are the, yes, man. That's just- Exactly. Exactly. That's kind of the stance that we initially took as far as that. Like I said, thinking of Kool-Aid, I was just like money mixed up. Like... Kool-Aid. Kool-Aid. That's dope. You know what I'm saying? It was kind of that thing.  Oh, here we go. Yeah. Can you sing for me? Right now? Right now. She hard on people, bro. Any people. What you want to hear? Everybody come on that spot. She going to make them, give them a little bit. Don't give them more. Especially if you R&B. Okay, so I got to sing an R&B song. Mm-hmm. I'm R&B. Hold on. Just give me a second. Let me go through my repertoire. Do you need to give you a beat? No, no, no. I got you. As soon as you walk in the room, I said, there goes my baby.   But I understand we playin' it cool. Deja vu. Yeah, you win. I like that. Yeah, y'all better stop playin', man. That's K Major, y'all. Get it together, man. We in Atlanta, I'm approved. Say it, man. You dope, bro. Love it, man. I already know. You ain't think I don't do it, it was like. It's something that R&B does for me cause anytime I hear good voice, I just can't help but smiling. Sometimes if you're really good, I'll get the goosebumps and the chills. Yeah, I didn't church you out. Yeah, I didn't do it. That was dope. I didn't get that far. But I smile, yeah. Like I told you before, that's so much needed, bro. We need you, bro. I already know that. You know what I'm sayin'? I told you like 4.30 this morning, I'm like, yeah, I like this guy. I just love the music, man. And I go searchin', you know. And I just start lookin', and I'm like, man, and he been workin' a long time, man. And I thank God, you know, that he gave you the strength to keep goin'. You know what I'm sayin'? It's hard, it's hard, yeah. A lot of people would give up, turn back.  Thank you. And you blessin' us, man. And I thank God for you. Thank you. So let me ask you, going back in your life, younger, just started music, till now, what is something that you've been through that was a stumbling block in your career that really baffled you, that you could tell somebody and say, you know what, this is how you can fix that problem. You know what I mean? Yeah, I signed a record, management contract slash record deal, and I was 15 to a management team in Atlanta. I was from Cardisville, workin' at McDonald's. They came through the drive-through. I was like, yo, who is that? Because they had a, it was an artist that they had that was famous at the time. And I signed to the management, I was 15. I got that energy, I wanna get it going. What we doin'? I recorded for maybe a year and a half, comin' to sessions, figurein' out how to get to Atlanta, then learnin' how to drive, and drivein' to Atlanta stand, just breakin' all the rules into household, like comin' home three in the morning. And it got to a point we never did anything. So it was only two months until the deal ran out, but I had, I just had one of those awakening moments where I knew I had to do what I needed to do then. Like, I needed to move now. My parents didn't understand, they were like, we'll just wait these two, three months, and boom, I was like, no, I gotta get away from these people now. When I went to the people to get out the deal, they wouldn't let me out the deal. And they, I had to change my name. I had to give up 370 songs. They made me type the songs out that summer. They made me find all the sessions around the country that I recorded at, and really like, give up my whole summer and half my school year to get this stuff together just to send to them, just to get out the deal. And at that point, my parents asked me, they all, it was like, why would you do that? Like, why would you give up all your music? And I remember telling them like, you always can do new music. Like, as long as you yourself, and at whatever point you get the strength to do it, just do it then. And by doing that, it's kept me going my whole career, because I never really got attached to anything as far as items. That's dope, because it makes you stronger. Exactly. That's what I was able to be. I didn't know that I was, I wasn't a songwriter coming to the game. I had no aspirations to write songs. That's a lot of 300 and something songs? Yeah, I had no practice. Exactly. So it was kind of like, okay, I can make money off giving away songs? Yeah. You said it became a good thing later on in my career and became one of the biggest things. But you could have waited, so if you had waited two months, you wouldn't have to have done any of that. Well, I didn't know what that two months was gonna lead to, because the deal, of course, had options. So after those two months, they had the option to renew the deal or whatever. So it was just me and my lawyer team, my lawyer team, yeah, we noticed something in the contract at that time. And it was like, now. It's a conflict of interest we need to go now. If we wait, then we showing that we... So at 15, when that opportunity came up for you to sign, and of course you had to go back to your parents and get them to approve it? Yeah. So how was they feeling with all of that? They just seen in my heart, in my eyes that I was serious. They knew how serious I was as a kid. When I told them that I didn't care about those songs, they was like, okay.  Are you an only child? No, I'm the youngest of three. So you're the baby boy. Oh, that's something that's you, the baby boy. You a mama's boy. Yeah, I am. Tell what you got in your head. Yeah, for sure. So is it UTO? UTO. What is that? Oh, uh-oh. I'm like, uh-oh. Yeah, I did it like that, because it was just easy to do. It's like, I'm trying to figure it out. Like, what is it? He sent it to me. Yeah, I don't know how to spell it. So when I was coming up with the title, I was like, UT, oh.  That's the title of the song. That's the dope. I love that music, man. I knew it was not out yet. For sure. So that's the next project. What's going on? Tell us a little bit about what's coming. That's my next single. That's my newest single. It's my campaign. It's supposed to kick off August 2nd. It's gonna be the first single that I pushed at this level. You know what I'm saying? I've been putting a lot of singles out over the years in projects, mixtapes, albums, but I've also been a songwriter and producer. So it would happen like, I would drop a song in January and from February to August, I would be with Jacquees. Wow. So my fans that I was growing through releasing music was like, well, I guess we'll just support them as a producer and songwriter. It's a lot, no consistency, you know what I'm saying, as an artist. You have to be consistent. But the good thing is you send demand. I've always had my hands in so much that I felt like that was my consistency. That's right. I was like, I'm doing this, I'm doing that. And then I was like, wait, I got to take this and drive, see the production and songwriting came with the money. So it was easier to focus on that when you get a phone call in 20,000 a beat or 15,000. You're like, oh yeah, I can record anytime. So now I'm in a space where I'm like, it ain't about the money no more. It ain't about the accolades or none of that. I didn't did that. I'm just like me. I want to produce a test because in my mind it's a test. Okay. What is out of all the songs that you've ever done? Which one would you say is your favorite? The one I just sung for you. Tell Nobody. It's called Test. When was that done? It was in 2016, 17. I like that. So you passed the test. It's the only song that I have and I didn't write. Wow. Yeah, I didn't write that song. And that's the one that you love. I love it. Wow. He wrote it. It's a Canadian writer. I don't even know the writer. The producer name was Arthur MacArthur. He sent me to be. He had a writer on it already. Wow. He was like, it's for you. That's dope. I said, because of the test, because everybody else that comes in and when we always ask what's the favorite song that you've ever done, everything you've done, it's always the newest one. Yeah, yeah. Because they don't ever like. Yeah, we get that a lot. You're always writing, oh, I love that. I love that. The newest song is always the hardest one. So for the main fact that you said, right, for the main fact that you said one from 2016, you baffled me, I'm like. Okay. 2016. It was just a well-written song. Top three artists of all times, man. Top three. Top three artists. That's what we do on here. Michael Jackson. Number one. He's Michael Jackson. Michael Jackson. Number two. Number two. Any genre. Any genre. Female, female. For sure. Lionel Richie is number two. I don't mean to have my boy right there. This is the first Lionel Richie. Number three would probably be Tina Turner. Tina Turner. That's dope, man. I like Tina Turner. I just like the song writing in the rock. Yeah, yeah, yeah. R&B crossover feel, I like that. That energy. In the performance. When I see Beyonce, I always see Tina Turner. So it's like Tina Turner. That's dope, man. But Tina Turner to me had so much more energy. Exactly. You know, because she. Don't you never go there. Don't you know Beyonce? I mean, that was just. Beyonce does a good job. Stop playing, man. Stop playing. She is an amazing performer. It's pull up time, man. She's amazing performer. I don't want to be high after me, so. But let me tell you. Yeah, yeah, yeah. But let me tell you. Tina Turner can put on a whole show without, I mean, with all that energy without, anybody in the background without anything.  Yeah, yeah, yeah. All them dance moves and she be moving fast. Like she's a 20 year old woman. Yeah. See, I never got to see Tina Turner live, so. No, I didn't either. But I can tell you right now. You know what I'm saying? Yeah, Beyonce live is crazy. Beautiful. Oh my God. Yeah. It ain't nothing like her when she come out and she got the Texas jacket on. Texas. He's so Texas. He's so Texas. He is so Texas. Say, check it, man. I'm in ATL now, though. Listen, man. It's your big favor, man. Tell us where we can find you, man. We're looking for you, man. On all social media, at K-Major Music, K-M-A-J-O-R Music. Man, hey, man. We love you, brother. Appreciate that. When we get you, we, hey, man. You and us up. Anytime. When you in Dallas, say, look, man, I'm gonna pull up. I'm pulling up. Yeah, and if I'm out here, because my brother's out here. Yeah, I'm gonna hold you to it. Yeah, yeah. But I don't know nobody in Dallas like that, but Erica. Man, man, I'm gonna say, you come up there and why now would have, man. We gonna get down, bro. I was sure. You gonna be like, dang, man. No, I was, man, it's dope, man. This is a studio. I didn't go to Dallas. Wait, I ate at this brunch spot downtown. What is it called? I don't know. It's like New Orleans style. It's so, you know, they was just down there.  Like, it's like. That, like, sounds like where y'all was at downtown. That's kind of all of downtown. It's right there downtown.  I love Atlanta. I love Dallas. I be always comparing to downtowns when I go to Chicago. Wherever I'm at, New York. We all got a lot. You know what I mean? It's too much going on. Yeah, it's too much going on. Too much down in Chesapeake. Uptown, Midtown, it's too much going on, man. But I definitely, man, love coming down here, seeing my people. And if you wanna do a press run in Dallas, just let us know. Yeah, definitely, yeah.  Yeah, we gotta everybody. Definitely wanna do that ASAP.  PJF shout out to PJF. He all was looking up. He be like, man, you know, when he come, I'm trying to link you with different things, man, going on in the city so that people can know you in our area. Please do, yeah, let's just move around. I got you now. Network here. You know what I'm saying? Yeah, yeah, yeah. And the people that's gonna put you on different platform to make it to where it's a press run. That's what you do. But you know what I look at? It's a blessing and it's only God, whenever you can, cause we always prayed that on this platform, God would bring people who have like spirit. Yeah, I'm sure. You know, no batsmen, no intention, any of that. And that's all we've been getting cause we've only started this in January. Oh wow. Yeah. And we build up over 4,000 subscribers on YouTube. We work in there. We just get started. The people that's been on our show, we have people who've been in the business for two, three, four years and said we've not been able to get those people on our show. Yeah, yeah, yeah. I love it for sure. You know what I mean? So I would always give God the glory to say that he has been blessing us in so many different ways. That is great. He blessed us when my boy came major. I'm glad to be here. I'm glad to be here. He's some of the best mics they've ever seen. And the headphones good. And the cameras, everything is perfect. Yeah, man. Thank you for coming on the show, brother. Like I said, we love you, man. And it's been another great segment of Boss Talk 101. Boss Talk 1.


So we have Swaroop and Chirag. Swaroop is a software engineer at Red Hat, who currently works on developing scalable programs for Red Hat OpenShift Container Platform. Chirag is a software engineer at Red Hat, working with OpenShift Customer Focus Engineering team on various things related to the OpenShift Container Platform. Welcome to you guys. Over to you. Hello, everyone. Good afternoon. Thanks for joining here today for this talk. I hope you guys have a great lunch. I have. I like the food. So my name is Chirag Kyaal. And join me with my friend and colleagues, Swaroop Ghosh. We both are working at Red Hat at Software Engineers. We basically work in OpenShift Engineering team. So today, we are going to discuss about encrypting secrets in Kubernetes cluster using KMS, OK? Before I go too deep into the discussion, let me ask you a couple of questions. So how many of you guys are using Kubernetes secret? I hope most of you, right? OK. How many of you are using in a production cluster? A couple of you. Are you managing your secrets securely in the production cluster? Or ever come across questions like, how can I securely manage my secrets? Whether my secrets are secure or not? If you ever come across these questions, I hope this talk can help you understand bits and pieces of that. So without further ado, let's get started. So first, I will start with some basics of Kubernetes secret. So anything that is sensitive, be it credential, your username, password, token, API keys. So if you wanted to use and store such kind of sensitive data inside your Kubernetes cluster, then Kubernetes has this awesome mechanism of Kubernetes secrets where you do not have to include any of your sensitive data directly inside your container images. Rather, you can reference these secrets during runtime inside your container, be it as an environment variable or you can use any file system mount and you can mount your Kubernetes secrets directly to your containers at runtime. So this is the advantage of using Kubernetes secret. So whenever you try to create any secret, what happens is that your API server gets a request. It reads that request and store your secret as a key value pair inside its database, that is HCD. So inside HCD, all your secrets are getting stored as a key value pair. So with this setup, I hope everyone is happy here. Like your API server is happy, it has stored your secrets inside HCD, your container is happy because it is getting all the secrets from there, you are also happy. Do you feel like there is some problem with this setup? I feel there it is. There is some security problem with this default setup because by default, Kubernetes store all the secrets as unencrypted format inside the HCD database. So if you try to visualize what is there inside your HCD database using some HCD-CTL tool, you will get to know that all the secrets inside it are getting stored as a plain test format. They are not encrypted. That is the default implementation that Kubernetes has. So if any attacker, by any chance, get the access of your HCD database, they can basically gain all the sensitive data that is present inside it. And they can happily create a backup of your HCD database and walk away with all the sensitive data that is present inside that. So all your sensitive data, all your username, password, be it anything, get compromised or can get leaked with the default implementation. So that is the problem of the default implementation of Kubernetes, that secrets are not encrypted by default. So what is the solution for this problem? I hope you might have guessed it right, looking at the picture at the right hand side that you need to encrypt your secrets at rest inside the HCD database, OK? Now, if you search Kubernetes documentation that how can I encrypt my secrets, you will land this page. And you will see Kubernetes is giving different types of encryption providers, like AES, CVC, AES, GCM, KMS, V1, V2. There are quite a few. These encryption providers are basically classified into two types. One is called as local encryption provider, and another one is called as remote or external encryption provider. I will go a bit deep into these topics. First, let's discuss about local encryption provider. So in order to use any encryption provider, you have to use something called as encryption config, OK? So this is a configuration YAML that basically sits inside the API server. And it instructs the API server how to encrypt any secret. How it does is that you need to add this encryption configuration YAML inside the HCD database. And you have to write all the configurations, like which provider you wanted to use. So for local encryption, you can choose between AES, GCM, AES, CVC, secret box. Doesn't matter which one you are picking. So along with that provider name, you have to give keys. So these keys are basically used by the API server to encrypt all the secrets. So now what happens when you do kubectl create secret? Your API server reads these encrypts and configs in YAML. It uses that encryption key that is basically present inside that configuration YAML and stores your secret as encrypted format inside the HCD database, OK? Now during decryption or when you do kubectl get secret, the reverse process happened. Your API server get the encrypted secret from the HCD database, uses the same encryption key that is present in the configuration YAML and decrypts the secret and give it back to you, OK? So this is the mechanism of local encryption provider. Still now with me? Any question with local encryption provider? All right. So local encryption provider, it mitigates one major concern. That is the HCD compromise problem because all the secrets inside your HCD is now encrypted. So if any attacker, even if they try to get access to your HCD database, they won't get much out of it because all the secrets are encrypted now inside that. But it doesn't mitigate one major problem. That is your host compromise problem. Think about this way. Suppose your attacker tries to gain the access of the host itself, or they get the access of your disk of the node where your API server is running. What will happen is that they will get the encryption key. You see over here the encryption key that is present inside your configuration YAML. So they can easily grab that encryption key, take a backup of your HCD database, and happily decrypt all the secrets. So now your secrets are again compromised. So local encryption provider, it mitigates one major problem. That is HCD compromise problem, but it doesn't mitigate the host compromise problem. So to mitigate both the problems, we have something called as KMS envelope encryption, or using the external encryption provider. First, let's discuss about what is KMS. So KMS stands for key management system or service. So it is an automated system provided by all the major cloud providers to automatically manage your cryptographic keys and its metadata. So all the major cloud providers like GCP has their Cloud KMS, Azure has their Key Vault, then AWS has their AWS KMS. So all the major cloud providers have their own flavor of KMS. This KMS uses something called as envelope encryption. How many of you guys know about envelope encryption? No? OK. So in case of envelope encryption, there are two types of keys. One is called as de-case, that is data encryption key, and another one is called as KEK, that is key encryption key. So in case of envelope encryption, your data are basically getting encrypted using the data encryption key. After encrypting your data, your de-key goes to the remote KMS server. Get that de-key encrypted using the key encryption key, that is KEK. Get a ciphertext back and store that encrypted de-key along with the encrypted data inside your disk. So this is how the flow works during the encryption for your envelope encryption provider. During decryption, the exact reverse process happened. So your encrypted de-key goes to the remote KMS server, get it decrypted from there, and using that decrypted de-key, it basically decrypts all the data. So you see with envelope encryption, the advantage is that your key encryption key never gets stored along with your data. It always present inside some external remote server. So your attacker cannot get the access of KEK because that is backed by all the cloud providers. So that acts as a root of trust. Now let's see how you can use KMS in case of Kubernetes. So in order to use KMS, you need to have something called as KMS plugin. So this basically acts as a bridge between your API server and the external KMS. It's an GRPC server that basically talks to your API server and the KMS. Now what happens when you do kubectl create secret? Your API server sends a signal to the KMS plugin. KMS plugin then generates a de-key. So that de-key basically used to encrypt the data. Once the data is encrypted, KMS plugin talks to the cloud KMS, decrypt the de-key using the KEK that is present inside the KMS service, get a ciphertext back, and writes the encrypted de-key along with the encrypted secret inside the HCD. So you see your encryption key, that is your KEK never writes, never get written inside the HCD database. It always present outside to your cluster. So using your external secrets provider or KMS, we can mitigate both the security problems that I have been talking about. It mitigates the HCD compromise problem, and it also mitigates the host compromise problem. Now Sorup will discuss about the architecture of KMS. Well, Chirag, excellent to you about the different encryption providers that you get with Kubernetes these days. So basically we are at a point where we have an understanding that unencrypted secrets are anyways not a good idea. And if you move one step forward when you move to something like a local encryption provider, you have the risk of getting your host compromised and still you get attacked onto your secrets. So we are here with KMS encryption provider where the keys are stored remotely in some remote location managed by the cloud provider. Or you can also use your, what would I say, like a custom key management solution running on a bare metal kind of a setup within your environment where you can manage the keys securely and keep it as isolated from your actual control plane and your actual cluster. So let's dive deep into what happens when we use Kubernetes KMS. And I'll also walk you through a demo with it, how it looks like. So as we see that there is a lot of encryption and decryption going on. And at a very high level, there's API server, HCD. And in between them, there's a new agent. It's called KMS plugin. The KMS plugin's job is to talk to the KMS provider and ensure that keys are encrypted and decrypted when the API server wants to. That's all the plugin does. So communication essentially happens over a GRPC connection. So typically you would run the plugin as a static pod or as a, like on the host itself, any way you want. Basically, what QAPI server needs from the control plane is a unique socket where it can communicate with the plugin and make those encryption decryption calls. And if you see this representation where the secret is getting stored in HCD, it is getting stored in a format where it's encrypted and it's safe for anyone to whoever has access to the disk or those kind of things. They still cannot get the actual secret itself. So moving on, we have two implementations of KMS in Kubernetes as of today. One is the V1 implementation, which has existed for quite some time. And there is V2 as well, which we will discuss later on. So V1 has been there for quite some time. I think, yeah, V1.10 or V1.30, I don't remember. Yeah. And the new V2 is there from V1.27 onwards. It's available as a beta. Well, I walk you through what happens when you create a secret using V1. So there's a client that tries to talk to API server to give it the contents of the secret. Usually, it's base64 encoded. Even if you use the new string data field, if it's not base64 encoded, the API server receives it if required, decodes it from the normal base64 to the normal string. And what it does is it randomly generates a number, which we call the dek, or the data encryption key. This dek will be used to encrypt the secret. So this dek will be ciphered upon the actual secret itself. And you will get an encrypted secret, which will be stored on the disk. So on the disk, two things are stored. One is the encrypted secret itself. And this dek is also sent to that KMS plugin, which sends encrypted dek back. And once the encrypted dek is available, the encrypted dek, along with the encrypted secret, is stored on your HCD. Another good part is that your secret and its actual contents doesn't leave the node. So it doesn't go to KMS. This is why envelope encryption is helpful. Apart from that, there is also another interesting bit, which is, if you see over here, this is the cache size. This cache size, you can configure from your end when you are configuring the encryption provider. What it will basically do is, whenever making these encryptions happen, they will also cache the dek's encrypted, like the plain text dek, as well as the encrypted dek. Keep them mapping. It's essentially an LRU cache. What it helps to do is avoid, or I would say decrease the number of KMS calls later on when we use it for decryption. It's up to you if you want a very secure setup where you do not want anything to be running on the memory itself. You can use something like cache 0. But that would add a lot of network overhead between KMS plug-in and your API server. And we could just make a note that for this particular KMS v1, there's a 1 dek for each secret. So when we decrypt it, that CD data is red. And basically, you get the encrypted dek and the encrypted secret. So when you get the encrypted dek, you send it back to the KMS plug-in to get the plain text dek. Use it to decrypt the encrypted data and give it to the client.  Depends upon what is the cache size and how the cache works. So this is how it works at a high level. I'll also walk you through v2. So things change in v2 a bit. It's basically tries to reduce the number of calls to KMS that's happening, and also the total number of deks that get generated. So before in KMS, v1, what used to happen was we used to have that many number of deks as the number of secrets. But now, usually, when the API server starts up, it creates one dek and caches it. So it doesn't create one dek per secret anymore. But it only does this when it is required. By when it is required, I mean that this happens on API server startup, and if the KMS key is rotated. So if the KMS key is rotated, this is how it will go on. If not, then if it doesn't get rotated, then the dek will remain the same. Internally, the cache is a time-limited cache. So after a point of time, it does talk to KMS again. But shouldn't be a problem since it's just one key or maybe two, three keys. So essentially, you see now the flow is simpler. When you create a secret, you need not make a KMS plug-in call. You have the dek available in the cache itself, that one particular dek. Use it to encrypt the secret and store it at CDDB. That's it. Another difference is if you check out the representation on the CD data itself, previously it used to append the dek and encrypted secret. Now it uses a protocol buffer. So you can also store other information like annotations and any things that the KMS plug-in provider provides with you. But you shouldn't be concerned about these from a cluster administrator perspective until and unless you are developing a KMS plug-in yourself. There's this field, the key ID. This is changed only when the KMS master key is rotated. So Kube API server gets a signal that the master key for the KMS has changed. And now it is time for me to re-encrypt everything, basically. Same thing when we have the secret being read from the KMS V2. What happens is it takes the data from the cache. It already has the dek as plain text version in the cache. So it doesn't need to make a plug-in call. It will just directly use it and decrypt it from at CD and give it back to the user. If there's a key ID change, it will perform re-encryption. OK, so we'll move to the more interesting part to the demo. I hope you can see my screen. So what I did is I created a cluster, not a cluster, a single node Kubernetes VM, a VM where single node Kubernetes is learning using QBadium. Nothing special. If you check, so I'll just show you what you need to actually change to enable this KMS thing which I told you. So Kubernetes would store its static pod manifests in this URL, in this directory, etc-cubanities-manifests. You can check the QBAPI server pod YAML from here, if you want. Yes, pretty much this one. So this doesn't have a flag encryption provider config yet. I will give one of that to this. And I'll also add another static pod which will run that KMS plugin. So I already have these things stored. Yeah, so this is my updated QBAPI server static pod. What it has add on is this last line over here, this encryption provider config. I'll also show you what's in this config. Yeah, this is what is basically there in the config, the path to the Unix socket and the cache size. This is KMS v1. So this is where it should be running. And for this to run, I will spin up another static pod. So I'll quickly copy these. And if I restart Qubelet, my Kubernetes should now start using KMS. Yeah, not an issue. Now what I will try to do is, yeah, we have them running. OK. Yeah, this is using the older, just give me a minute. This is the older Qube config running at my end, which will not work. I think it should work now. Yeah, so this is, so what I will show is create a secret. Yeah, I'm trying to create this secret generic secret DB user pass just some dummy values, admin and password whatever. So this went through KMS internally. I'll show you that. So if you see, this is not the plain text secret. This is some encrypted. And if I do a hex dump over it, it will give a better representation of it, basically. But yeah, this is what is contained inside the secret. I'll also show you another secret that was there from before, which is not encrypted and how it looks like. This is this bootstrap. I think I messed up with the, OK. Oh yeah, this should be Qube system. Yeah, you see this secret is there as plain text from whatever was there in the API server. So this is the difference, essentially, from KMS and without KMS. So this is how it works if you do manage your cluster from your end and you have access to the control plane. What happens is there can be scenarios where your control plane is managed by someone else for something like managed services. You can use GKE AKS that has off the fly KMS encryption. That is one alternative. Apart from that, if you have some tooling on top of it which manages the control plane for you, you would typically need to change the Qube API server manifest through code, whatever tooling you use, and add a container for that KMS plugin and change that encryption provider config from inside. And it should work. It should look something similar to this basis of GCP or AWS wherever you are running. So this is the basic change that you need to do to your Qube API server if you want to do it in a managed kind of an environment where there's a control plane manager and those kind of things. So right now, this feature is not there within OpenShift, but we are actively investigating how we bring this in. But you can definitely use it on a regular Kubernetes cluster on AKS, on EKS, on GKE. And if you are running something on a bare metal kind of a deployment, what you could do is you could directly use another KMS provider. That's called TruSO, that's not a KMS provider, my bad. That's a KMS plugin that connects to Vault. So if you're running Vault internally in your bare metal or in your network, you can essentially use TruSO KMS plugin that will connect to Vault very well and would run very well for your bare metal clusters. We discussed a lot about securing and encrypting Kubernetes secrets using KMS. But what if you are trying to do something differently and you still want to use security, or just to discuss on the other approaches that you get. So HashiCore Vault has a Vault sidecar injector that injects the secrets into the containers, into the pods directly through a sidecar container. There's no involvement of Kubernetes as such, the Kubernetes API server as such. But it's secure because it directly talks to Vault and bypasses QAPI server. External secrets operator, this one is more like a synchronization point between an external system or an external API where your secrets are stored and then it injects into Kubernetes secrets. Sealed secrets is another thing. It's similar to KMS, but it works a bit differently. That is, it actually changes the original secret itself. And there's a controller running that decrypts it at runtime. So even if you run on a GitOps environment or something, if you are using a public Git repo, if you are using sealed secrets, you can keep your secrets even on GitHub. It seals and keeps your encryptions running that way. That's it. So yeah, thanks pretty much. That's what I had. We had. And if you want to contact us, we have our handles on the screen. And I would give you the opportunity to question back whatever you want or relating to whatever we discussed today. Any questions? Peter presentation. So there is one question that I have. We have a similar scenario. And what we did is we actually used the external secrets operator to resolve that issue. So I don't understand where or what kind of use cases this KMS-based stuff will be useful. And because the external secrets also, it connects to the cloud provider secret itself and then get it synchronized and store it in a secure way. So external secret providers do not encrypt your secret. So it just creates a synchronization between your storage, your remote storage, and reads your secret from there and creates a Kubernetes secret itself inside your cluster. So it's creating a secret only. And it's creating a synchronization. But it is not encrypting any of the secret. So even if you are using the external secrets provider, your secrets are not encrypted. They are just synchronizing between the external remote server and your Kubernetes cluster. So if you do the hextam of your HCE database, you will see the secrets are still plain text. They are not encrypted. OK. Thanks. HTTPS mode only, so it will be automatically secure. So you are saying, while doing the synchronization, it won't be a kind of a plain text. But in HTTPS mode, if I'm getting from the external world, it will automatically secure. But at rest, inside the HCE database, it is not. During transition, it can be encrypted. I'm talking about at rest what is happening inside the cluster. If external secrets operator will create a secret itself, and that secret will be stored inside the HCE database only. The problem is, inside the HCE database, it is plain text. Inside HCE, it is not encrypted. So external secrets provider won't solve the encryption and decryption problem. This entire presentation is for rest inside HCE. The data that is present inside the HCE that is not encrypted. Entire presentation is talking about at rest problem. Also another thing, if that is not the solution you're looking for, you can also consider encrypting your nodes that does some point of the exercise that we are doing. But yeah, it doesn't touch anything at cube level. This is another thing. You can encrypt your nodes disk. Basically, it offers similar kind of encryption. But it doesn't always work. If you have multi-tenant workloads or some kind of a thing, then it doesn't work. For a multi-tenant workload, each tenant can have their own KMS plugins and those kind of things. So if you are using open-sift cluster, we are sorry. It's not launched yet. Internally, we are working heavily to get it G8 and beta version. So just bear some time to get it released in open-sift. This is the first kind of encryption. So it is a kind of pseudo-random number generator which you have. And on top of the KMS is there. So what if the cache is invalidated? So how do we describe the actual secret out of the KMS? So from KMS, so that the key is there, which is in the node order cluster. So that is used as a kind of encryption on the secret. And then the secret is shared to the KMS. No, secrets are not shared to the KMS. The DK is shared to the KMS. The DK goes to the KMS, get it encrypted, and stored with the encrypted secret inside the SA database. Your secret never goes to the remote KMS server. Only the DK goes to the remote KMS server, get it encrypted, and stores along with your encrypted secret. If the cache is invalidated, so how the DK, the encrypted the DK is decrypted? So if your cache is, so you can configure your cache size. So if your cache is zero, so your API server will then talk to the KMS plug-in. So KMS plug-in won't find any cache. It will talk to your remote KMS and pick the decrypted DK from there. So your cache is null, right? Your cache is nothing. So the KMS plug-in have to go to the KMS service again and again. There will be latency issue that we talked about for KMS v1. And the KMS v2 solves that problem. Because basically the cache will stay in the memory. It will not leave the node again. Yeah. So that is the main point. Your cache is the lifetime of the API server process. Not your disk. If we have more questions, maybe we could take it offline. Thanks, everyone. Thank you, guys. In the interest of time, we'll take the Q&A offstage. So I request money to give away the token of appreciation to Chetak and Swarov. Please go ahead.


Who's interviewing your first joining teams? Do you ever expect him to have this type of impact on the team? Yeah, just from a far. I knew what type of player he was, and he was a special talent over there in Texas. And he's the guy that puts the ball in play, great defensively behind the plate. Just getting this opportunity over here with the type of team we have, and he's been special. Mention defense, what did you think about playing the fourth to get more from Ayate at the inning? Wow, it's a little things like that. I was talking to Susan earlier. It's little things like that that really make this team special and make it who it is. When Trevi's able to make a play like that, JD's able to get in front of him and get that out. Any time you can limit a team like the Rays, their runs, allows us to win the game and be in a better position.  What do you think? Oh, without a doubt. What he's doing this year is special. I think he's going to continue to do that for quite a few years. And I think he so far deserved the right to be in LA this year, representing the Yankees and representing the American League. I'll be a set nod to be the starting catcher. I know there's a lot of great catchers out there in the league, especially we got down-faced in Alejandro Kurt. Blue Jays is another great one in this league. But I think he definitely deserves a man's work, but offer this opportunity. And he's taken full advantage of it. Aaron, a couple of times this year.  I don't get it. I don't get it. I think the biggest thing is just keeping the body fresh. And when I'm able to swing and pitch it in the zone, I feel like I can do some damage on them. So I got no answers on you for the two after an off day. And you look forward to the challenge of case in Houston this weekend, too, coming up this day. Yeah, another great club. They're doing well. They're leading their division as well. They got the great pitching staff as well. Great offense with what Alvarez has been doing over there. It's fun to watch from afar. So we're looking forward to it. It's going to be a big four game stretch with them. This has been a long stretch we're going to have here, but this team is ready for it. We're looking forward to it.


Now it is minus 2. Is this differentiable at x equal to minus 1? Check the difference. What you may redefine the function? This will be in the graph. Yes, what is the conclusion? Absolutely correct, at 2 it is not differentiable but at minus 1 it is. You know why at minus 1, mod of it and it became continuous at here at minus 1. But it is not differentiable. This is just why I keep finding such functions. Whenever I am dealing with mod function, GIF function or any kind of a special function, always redefine it first. Redefining means getting rid of the mod and rid of those special symbols. Make it simple looking. Any operation should be done by making it simple looking. Now, this particular function. Science means very little, not sure. It is very simple. You just first write down the zeros of these factors on the left. So when x plus 1 becomes 0, at negative 1, second step is put 3 here and it will stay positive. That means any value you choose beyond 2, where it is 3, 4, 500, 500, 6, 7, 5, 100, whatever. The expression will always be positive. At this point. This is something which may be correct. If 2 is associated with a factor which has got an apple switch.  Are you getting this one? Now, so this will become negative. Now I am crossing this number minus 1. factor for which minus 1 is coming, x plus 1, this is called the baby curve science thing. When you try to know the sign of polynomial functions, in fact it can work for rational functions as well in some intervals of x. Now why am I doing this? Minus x minus 2 would remain x square minus x minus 2 if your x minus 2 was becoming negative, is it not? What will mod be to it? It will try to make it positive. How do you make the greatest sign in front of it? So you will get minus x minus 2 if your x square to belong to the interval minus 1 will do. Now most of you would ask, say you include it to here also, it does not matter because at 2 it is either plus 0 or minus 0 which is ultimately 0, 0 does not have a sign. Minus 1 also are included both the places, by the way this is not that there, this is minus 1. That is why at minus 1 I can include it at both the places because it will actually be 0. Now if I know this times this, so if I have x plus 1 here, can I say x plus 1 will mod it? Is it? Now what points will it test the differentiability and continuity? Which points will I test the differentiability? Now there is something called critical points, just like we had critical points in case of continuity. We do not sit and check for all the points in the world because there is something, we only check at those points where the function is changing its definition provided we know that the function is a safe function. For example this is a polynomial function and in the first property itself I stated that polynomial functions are continuous interval functions. But where it is changing the definition from one function to another function, there may be a break and hence there may be a non-differentiability or there may be a non-differentiability, getting this point done. So I will only check at those points which we refer to as the critical points. So x plus 1 mod x square minus x minus 2 equal to minus 1, the function was behaving as x plus 1 x square minus x minus 2. When it was between minus 1 and the x square minus x minus 2 and when my function was greater than equal to 2, it was again behaving as the previous function, this one. Is that right? Now tell me what are the critical points minus 1 and 2 because at these points my function is changing its definition. So let us check at minus 1, first thing first minus 1 will I be checking its continuity at minus 1? The main reason behind including minus 1 at both the places is because I think it is continuous. Polynomial and the problem is both are continuous, so they are product and directly jump to differentiability, but will I use my first principles? Oh my God, that would be too much of a work. So now welcome to the J word, welcome to the cognitive exam word. In school only you will do your first principle test. When you are actually solving it in CET or mid-style or J main, what are the exams we are preparing for, we will do a shortcut. What is a shortcut? If I have to find the left hand derivative at minus 1, just differentiate the function which is left of minus 1 and put minus 1. Which is the function left of minus 1? Is it this or is it this? The first one, differentiate it the normal way.  So three, what do you plan to differentiate or you can use product rule?  Let's go over all this. I'm making a mistake. Half the glass, 2 x, x square minus 1, minus 2, it's becoming. Oh, I didn't get it wrong. Okay, answer. So what do you do with the point of view? Now, differentiate this guy, put x equal to minus 1 and tell me the answer. Before anything else. Zero, minus 1 because of the procedure. Please tell me, yes, let's confirm that, we know that's not different. First, let's confirm whether, yes, this guy, differentiate this at minus 9. Let it, let it, let others also confirm. Minus 9, minus 9, minus 9. I was assuming you were correct. What is the right hand derivative I do? Are they equal? No. No. And hence, we got differentiate. Is the ideal here? So, so much analysis is being done just for modding a function. Is that fine? Moving on, can I erase this? They just make sense? Yes. Differentiate, put 2. Differentiate this, put 2. You'll get left hand derivative. Differentiate this, put first principles here. It will become huge because of the powers involved. It works for smaller functions, which you normally would get in your school exam. But in complicated exams, do not use first principles at all. There's a negative. You're saying something, sir. I mean, they're essentially the same functions that the one in the middle has a negative. So, the slope of that would be negative. Yeah, of course. You're also finding it would be nice. Is that fine? Well, I'm not done with the properties yet. I think I did the third one, so far. Yeah, yeah, please, please.


Cool. Hey guys. I'm Brie. I'm going to talk a little bit about TransIdentities and how they intersect with like text spaces No, I think it just won't play through the speakers. Yeah, it's oh sure. Yeah I'm Brie. I'm going to talk a little bit about trans identities and how they intersect with Being in like text spaces and then progressive and feminist spaces So I think most of us When we think of oppression and marginalization Kind of think of it as something that like other people do In particular, we think of it as something that like Particularly like archetypically bad people do so it's easier to think of like racism as being Committed by like the Ku Klux Klan and homophobia as being committed by like the Westboro Baptist Church And I think there's it's sort of interesting that we do that. I think it is sort of based in Like being able to other other people like that sort of makes it easy easier to share an Identity of like okay. I'm against that. They are over there.  There's like this constant little little trickle There's actually There's a great little blog post that like compares misgendering to Chinese water torture of just like the like day to day a little drip of like these little slight You know, maybe individually annoyances That like over time or with like a few a few particularly awful instances can sort of just like reduce you to a wreck pretty easily so I wanted to talk a little bit about those and I Guess how you can recognize them how you can call them out So first I want to talk a little bit about My transition just so you guys I think have a feel where I'm coming from It feels really weird and vain and narcissistic still a little bit to talk about my transition as part of this talk But I think it's really important to I don't know to get an idea for where I'm coming from Maybe to Like have some kind of connection with a trans person if you don't Sort of get an idea of how that narrative is not the pop culture one necessarily and also because This week is my one-year mark for HRT. So I'm kind of doing it for myself. So, you know, no big deal Cool, so I'll try to keep this brief. I don't want to give like my entire life story here But in brief So at like 23 and in 2013 I had been feeling like these vague uneasy gender feels for like a decade or so that were sort of hard to define and sort of over the course of I don't know six months a year Very gradually came to Like the understanding of my identity as a woman And again, it was very gradual and that was very necessary for that to be gradual It was sort of like, well, I'm a guy who likes to cross-dress. I'm a genderqueer person I'm a trans girl, but I really don't feel like identifying myself as a woman publicly, etc. etc And Transitioning in that gradual process was actually fairly easy The hard part was actually coming out to people because for those that period of time It was like I don't know what to come out as Like, you know, once it's like, okay, I'm a lady like that's pretty easy to explain to people But if you're coming out as like, I'm a genderqueer person who like identifies somewhere in the middle of a spectrum And it's like most people don't don't even have that maybe baseline As to like what you are trying to tell them But so at work eventually I sent this email out. It's long. Yes I don't read it out loud, but it's just like hey, let's see you guys know. I prefer the name gree and you won't pronounce And yeah, if you look at the bottom, I made a really dumb naming stuff and cash and validation joke So that's cool Yeah, and so Part of the reason I put that there is because and I will obviously this will be posted up later but I put that there because a lot of Like when I was looking for a model for how to do that like how to send that email out. I had nothing to go on I would really like if more people had some kind of some kind of format for what to go on Yeah There were like a couple of things, but it's just it was very difficult for me to find something So it was it was actually a pretty smooth transition all things considered like I had very supportive Go-workers partners and my family was great But even like a smooth transition Is one that's pretty peppered with awful awful crap and so There's one instance that like I think kind of sticks out the most Which happened like I don't know four or five months into the transition I was at a bar here in like East Atlanta and We're standing outside and you guys come up like proven pass by One comes back and goes. Oh, hey guy. I'm sorry. Me and my friend were talking. You were wondering you're actually a guy, right? and like I was just like I Didn't even know how to respond to that.   I went around back.  So I want to I'm gonna make sure you're really a guy, right? Like like three times in a row this question So, you know by that point I'm getting pretty visibly upset. Someone asked me what's going on I tell them what I tell them that people keep asking me like I'm actually a guy, right and The person I tell this to you is like well you are right So I ended that night at Waffle House Which is a pretty good way to deal with that if you're wondering So That that incident sort of started me thinking like why do people think it is okay to say these things? Why do people think that these weird little microaggressions are like Totally fine to just come out of their mouth and not really really consider and the effect that has on people And so I sort of ended up compiling like a list of like here's all these shitty things that have happened to me and other people I know so that's really fun by the way So decide some me time after that if you're gonna do that for yourself But yeah, I sort of ended up putting it into a nice big rule of three pile and so You know until recently the biggest The biggest piece of it is this sort of ignorant ignorance like so many people don't know the language don't know Pretty much anything about trans identities And so that just leads to lots of weird stuff like just implicitly misgenerating people because you don't know that trans people Can't exist in that men can look a certain way that women can look a certain way that is not a way that you're used to So, you know, there's sort of the like Excuse me. You're in the wrong bathroom sort of situation and just lots of Stuff like that the biggest example is have you had the surgery? Don't ask this to someone if you don't know that already Because what this is what what you're actually asking is hey, what's your junk look like? I really want to know Don't do that to like anyone So thankfully this is getting a lot better there's been a lot more like pop culture awareness of trans people through like liver and cox and Janet Mock and Laura Jane Grace and all these people and That's been great So it's reducing this a little bit and you know that the answer for yourself if you feel like you are doing this kind of thing is to Read up on trans issues and like I don't know read a book read redefining realness It's great And I yeah, just just read things by trans authors things like that and I don't know Sort of get an idea of where they're coming from So that pop culture thing though has a flip side, which is a lot of people tend to start looking at trans people through like cliches and The big one here right is like the tragic trainee, which is like you're so brave Don't tell people that either. That's also weird Like I might be if I hear that again It's weird to tell someone that they are brave for having the identity that they have Yeah So yeah that I think the way to get to get past or through this one or whatever Is this sort of to lift the voices of trans people? So again, like There's a lot of a lot of things there where like people will people come to be friend of a trans person because the cliche is that it is very shameful and Anxiety inducing for a trans person to be trans in the public So like they'll go up to a friend or a lot of times people give up to one partner And so I never got the has she had surgery yet question, but I did get Has she had surgery said to my partner a lot and then told afterward and it's like why is it more? Okay, if you tell them that sort of thing Yeah, so just looking the voices of trans people being like hey talk to this person or you know Recommend these sources These books and whatnot by by trans people rather than speaking for them so that you can sort of kill those cliches So the the big one that I need to talk after is sort of just the fundamental denial of You know in the case of trans women their identity is women trans men as men Non-binary people as non-binary just sort of the be like absolute failure to recognize our existence as The identity that we say we are and so Me nice table so here's sort of Here's sort of how that plays out in language there's always You know since folks get the default and trans folks get a modifier So a lot of a lot of language until recently it was like, you know, you would say What are your preferred pronouns to someone who isn't like maybe does a leak or something? But you would say preferred pronouns to anyone else. You just say what are your pronouns? You know you see people identify as something trans folks self-identify so there's a lot of stuff that's like hey You know self-identified women welcome that sort of thing that's sort of odd because it's It's not a modifier that you would use in other cases. It's like women welcome So it's odd to say self-identified to I don't know to just mean if you're a woman Come to the space that sort of thing But yeah, I so I built that big table I'm sort of trying to get this point of large numbers of tiny tiny events affecting us I guess to make it clear that like there's a lot of work It is like a staggering staggering amount of work that needs to be done to improve this situation And it is large enough that like it needs to be Undertaken by like every single person actively and not just like I'm aware that this is a problem but in like calling these things out in I Guess having me uncomfortable Conversations with your friends that like hey the thing you said was awful. Here's why and I don't know. I don't I don't really have any tips for actually doing the calling out But I would appreciate it if anyone wanted to comment with them Yeah, that's it. Thank you


وأقول في القرآن ما جاءت به آياته فهو الكاريم المنزاله وأقول قال الله جل جلاله والمصطف الهدي ولا أتأوله الحمد لله رب العالمين والصلاة والسلام على المبعوث رحمة للعالمين نبينا محمد وعلى آله وصحبه أجمعين السلام عليكم ورحمة الله وبركاته مرحباً لكم في رمضان ديلي دروبلات كما يأتي في رمضان هذا المنزل نجد نفسنا في نهاية رمضان وماذا يجب أن تعمل على نفسنا ونضع نفسنا على نفسنا ونضع نفسنا الله عز وجل يقول لنا في القرآن في صورة المزمل في نهاية نمبر 20 الله سبحانه وتعالى يقول ماذا يجب أن ترى لكم في نفسكم من جيد ستجده مع الله ستجده مع الله عز وجل لكي يكون أفضل and greater in reward and seek the forgiveness of Allah and Allah is the all forgiving and the most merciful الإمام السعدي رحمه الله تعالى يسد وفي الأمر بالاستغفار بعد الحث على أفعال الطاعة والخير فاعدة كبيرة وذلك أن العبد ما يخلو من التقصير فيما أمير به إما أن لا يفعله أصلا ويفعله على وجه ناقس وقلت أن الله يساعدنا to make إستغفار بعد تجدنا to do acts of obedience and good هذا يوجد كبيرا وذلك أن يكون لن ينقذ لن يستطيع لهم لتفعل هذا الأمر لا يوجد دفعة في ما they were commanded to do إذن لم يفعل it at all أو they did it in a way that wasn't complete and wasn't it was deficient سبحان الله look at the benefit look at the benefit why Allah عز و جل told us to do good whatever good you do you'll find it with Allah وستغفر الله ask Allah to forgive you because every good you have done it is naqs there is taqsiyah there is deficiency there is naqs there is there isn't done the way that it should have been done it's not perfect so you ask Allah عز و جل to forgive you so He said فا أميرا بيترقيع ذلك بالاستغفار He was commanded the servant was commanded to patch it up by making استغفار because the servant commit sins all throughout the day and all throughout the night فمتا لم يتغمده الله برحمته ومغفرته فإن هو هالك so if a person doesn't الله عز و جل doesn't shower them with His mercy and His forgiveness that person is haalik they've been destroyed سبحان الله you thought after you finished the month of Ramadan and Ramadan came to the close سبحان الله what did we think that we had done did we think that we had done something that was complete and perfect the way that Allah عز و جل commanded us if Allah doesn't shower us with His رحمة and His مغفرة then nothing would have been accepted from us and nothing would be accepted from us because it was naqis it we were we had taqseer we were deficient we fell short in what we commanded to do and we need the mercy of Allah and His forgiveness to make up for our shortcomings and Allah عز و جل He said يهل الذين آمنوا أستجيبوا لله و للرسولي إذا دعاكم لما يحييكم و علموا أن الله يحور بين المرء و قلبه و أنه إليه تحشارون الله عز و جل سورة الأنفال He said أو you who believe answer the call of Allah and His Messenger when they call you to that which will bring you life and know that Allah comes between a person in their heart and that to Him you will be gathered سبحان الله we have to be quick we have to race and to rush to answer the call of Allah عز و جل whatever is left from the month of Ramadhan we use it to obey Allah عز و جل because the actions are judged by the end of what you do and whatever we're not able to do we ask Allah's forgiveness and we race to do that before Allah عز و جل seals a person's heart and comes between a person and their heart and Imam al-sa'idi رحم الله و تعالى He said فإياكم أن تردوا أمر الله أول ما يأتيكم He said be so careful beware that you refuse the command of Allah when it first comes to you فيحالو بينكم و بينه and so الله عز و جل seals the path or blocks the path between you and between him إذا أردتموه بعد ذلك when you need Allah after that و تختلفوا قلوبكم and your hearts differ Subhan Allah you need Allah after the month of Ramadhan something happens the next month some difficulty some trouble and you realize how much you need Allah then quickly quickly use the time that you have make the benefit of the time that you have how many people we see Subhan Allah and it is it makes you it makes you feel so upset that you see the 27th night and you see the Masjid fall to the brim and then you see the 28th night and maybe you only see just a few people in the Suf and even the 29th night which is an odd night and still you see very very few people come to the Masjid be quick to answer the call of Allah before between you and your heart and then when you need Allah after that Allah سبحانه وتعالى you will find a barrier between you and Allah and your hearts will differ that's what الإمام الساعة he said رحم الله وتعالى and Allah عز وجل said in سورة المائدة إنما يتقبل الله من المتقين this is the one of the most scary ayat in the Quran one of the ayat that puts fear into you or it should put fear into you regarding the two sons of Adam وطل عليهم نب أبني آدم بالحق إذ قربا قربان فتقبل من أحد إهم ولم يتقبل من الأخ recite them the news of the truth the two sons of Adam in truth when they each perform the sacrifice and it was accepted from one but it wasn't accepted from the other قال لا أقت لنك he said I'm going to kill you قال إنما يتقبر اللهم المتقين and his brother said to him a statement that it should make you scared Allah only accepts from the متقين which of us can say they from the متقين which of us can say knowing that the متقين the one who is a person of Taqwa is the one who does everything الله commands them to do and abstains from everything that الله commands which of us can say that way from the متقين that we do all the things that الله commands us to do and ya Allah said إنما the only people Allah accepts from is the متقين and the Salaf الصالح they have narrations about this that they used to be scared about this I am there was a man came to Ibn عمر asking him فقال لبنه أعطيه فقال له إبنه تقبل الله منك يا أبتا يسيتو هي صان جفهم الدينار جفهم الدينار سو هي صان وين هي جيب هي ساد هي صان ساد مي الله اكسبت it from you my father هي ساد لو علمت أن الله تقبل من ني سجدة واحد أو صدقات درح من واحد لم يكن غائب حب إلي من الموت أتدري من من يتقبل الله إنما يتقبل الله من المتقين he said my son if I knew Allah accepted one sajda from me or one درح من صدق from me there is nothing more beloved to me than dying at that time I would love nothing more than to die do you know who Allah accepts from Allah only accepts from the people of تقوة سبحان الله that's how they understood it that if I could just make one sajda that Allah accepted from me then I would wish for death because Allah only accepts from the متقين and he narrated from علي رضي الله عن that he said كون لقبول العمل أشده تماما منكم بالعمل ألم تسمع لقول الله تعالا إنما يتقبل الله من المتقين he said be more keen for الله to accept your deeds than you are in the deeds that you do in the first place meaning it's not about the number of deeds that you do it's not about how many deeds you do it not only matters whether Allah إزا وجل accepts it he said don't you hear that Allah said إنما يتقبل الله من المتقين Allah only accepts from the people of at Taqwa Allah إزا وجل only accepts from the people of Taqwa so we need to use this time that we have in the month of Ramadan whatever is left of it we need to use this time to be more keen on what we do in these few hours that remain we need to be more keen about that and more concerned about that and more careful and we need to make all of our efforts in asking Allah إزا وجل to accept from us that's what Allah إزا وجل made easy for us to mention and Allah إزا وجل knows best والصلاة والسلام على نبينا محمد وعلى آله وصحبه أجمعين السلام عليكم if you're enjoying these videos and you'd like to keep up to date with all of the courses we're going to be running make sure you head over to amau at home .com