Good morning and good afternoon to all of our viewers and thank you for joining us. My name is Elizabeth Murray and I am a senior program officer in the Africa Center at the United States Institute of Peace. Alongside the National Endowment for Democracy, our co-sponsor of this event, we at USIP are delighted to host today's conversation to highlight civil society's perspectives on peace and democracy in the Central African Republic. I first want to share an important logistical note. You will notice that there are two webcasts on the page that you are viewing. The top one is in English and the bottom one is in French. You may choose the one that you wish to view. I'd also like to share just a few words about USIP. We are a national, nonpartisan, independent institute founded by the United States Congress in 1984. We are dedicated to reducing and mitigating violent conflicts through our work with local partners and governments to build capacity to manage conflicts peacefully. USIP has worked in sub-Saharan Africa since the late 1980s. In recognition of the peace-building opportunities in the region and the importance of Africa to US national security, USIP created the Africa Center in late 2020. The Central African Republic has been a priority for USIP since we began work in the country in 2014. We have had the privilege of working with many exceptional partners in civil society, at the community level, in government, and with multilateral organizations. We hope that today's event will draw attention to the continuing conflicts in CAR and generate ideas and proposals for how to support Central Africans who are working for peace. While some of the indicators in CAR are favorable, including improved security in the West and many major towns in the East, insecurity remains a fact of life for many Central Africans. Armed groups and the Central African Armed Forces and their allies have all been accused of human rights violations. Around 25% of the population remains displaced and approximately half of the population is food insecure. In many reasons of the country, citizens do not have access to basic services. CAR is also at the center of a rivalry between external partners. This rivalry has had significant consequences for international assistance to the country and the CAR government stands at the precipice of a financial crisis. Amidst these challenges however, community leaders and civil society leaders have shown creativity and persistence in working to reduce tension and violence. Local mediation and other peace building efforts have succeeded in bringing a degree of stability to many parts of the country, even as formal peace agreements have struggled to take hold. We have an excellent group of panelists today and we will introduce them shortly. They include three Central African civil society leaders and one international analyst. During the first portion of the event, our experts will respond to a series of questions about the challenges to peace and democracy in CAR. We invite you, our audience, to submit questions via the chat box at the bottom of the webcast page. You may submit your questions in French or English. We also invite you to tweet about the event using the hashtag CAR, peace and democracy. Peace and democracy in CAR are important first and foremost for the 4.9 million Central Africans, but CAR is also important to the region. With several coups in South Africa over the past two years, it is vital to examine and work to mitigate the risk to democracy in CAR. Moreover, the conflict dynamics in the Central Africa region cross borders and stand to neighboring countries. Achieving a durable peace in CAR will bring silver benefits to the country's neighbors. I'd now like to hand the floor to my colleague, my colleague, Valerie Najiba, Program Officer for Central Africa at the National Endowment for Democracy, who will moderate the conversation. Valerie, we at USIT are grateful for our partnership with the National Endowment for Democracy on Central Africa, and we are pleased to be co-hosting this event with you. Thank you, Elizabeth. Thank you, Elizabeth, and good afternoon to viewers from Bangui, D.C., and all of the cities in the world who follow us. My name is Valerie Najiba. I'm head of the Central African Program at the National Endowment for Democracy. We were created in 1983 by the US Congress as a nonprofit organization dedicated to growth and peacebuilding in the world. This foundation, this endowment, is at the forefront of democracy. We at NDI are convinced that democracy is something that is a right for one and all. And NDI offers over 2,000 subsidies to support projects in over 100 countries working for democracy since its independence from France in 1960. Central African Republic has been subject to sectarian violence in a chronic fashion, and this has slowed our democracy or democratic progress. We have a lot of great natural resources, gold, diamonds, uranium, gas, wood, and fauna. NDI has been in the CAR for over 27 years to support civil society, peace, social cohesion, education, and civic engagement with a particular focus on youth, women, and other traditionally marginalized groups in the society. We are also very happy to co-sponsor this event, as my colleague Elizabeth mentioned, is very timely given the situation in Central African Republic. And in order to begin the subject, these perspectives on peace and security in CAR, these perspectives from the civil society, we have four excellent experts and panelists. This is Casey Martine Ecomo-Swanier, who is a young activist from Central Africa. She's also the founder and director of the URU organization. We also have Mr. Rosin in Gattongue-Zalang, who is president of the Youth Organization Association Jeunesse en Marche for Development in CAR. We also have Mr. Abdel-Rouh Nour, the vice president for Islamic Youth in CAR. And from Nairobi, Kenya, we also have Mr. Hans de Marie Gour, he is a senior Central African analyst within International Crisis Group. So we will begin our discussion and we're going to start with our first question for Casey. Casey, there are reports that indicate that security in CAR has improved, including in the West and major cities in the East. Is this true that citizens are now benefiting from a better security? Thank you, Valeria. Hello everybody. It's a real pleasure to be here with you for this meeting. And to answer this question, I think we have to look at the Central African security issue. There are different approaches. The first is that we need to see security under the angle of the armed groups. And we also have to see what is the democracy dynamics in the country. How then does CAR consider security? We did a number of polls on site. And security is considered as a freedom of movement in Central African. And today, when we compare it to two years ago, it's true that things have improved. But as I mentioned, it doesn't mean that things have radically changed. Today, we noticed that, for instance, we're not talking about tensions or attacks. It's more isolated incidents in a province. So we don't have these massive killings of the populations. But that said, we still see a lot of tensions among different groups and PAKAs who have the Russian allies on their side. And so there are sporadic incidents. Well, unfortunately, we have fewer of these other incidents relative to what's going on. However, we noticed that in this progression in the different activities that are led by the security forces, we do have a number of aggressive behaviors against the Pearl community. And that is basically a growing and latent conflict with regards to the situation. Second dynamic is the democracy dynamic. We have the PAKA and the allies that the government has decided to deal with. It's difficult with the civil society as a whole, and there is an impact on security. We noticed today that the civil society is quite worried about this. Thank you, Casey. My second question is related to this. There have been a number of coups in Francophone Africa over the last two years. How strong is Central African democracy right now? Are there major risks? And we will ask our panelists, Hans and Abdel, perhaps they can give us some response. Hans, would you like to take it away? Yes, hello again or good morning, good afternoon or wherever you may be located. I have a point of view that might be slightly different from the dominant response. I think the CAR has a long way to go before it can really ensure its democracy. And I would compare this to other countries in Central Africa where the democracy or democratic system is more advanced. There are several criteria to determine the level of democracy. You can look at the institutions, the documents, as well as the check and balance of separation of powers and the existence of an opposition that has a certain power of civil society. And we could include the media who also are playing a counterpoint in democracy. So those are the larger principles. And under that light, we could say that yes, Central African Republic has a democratic process, but it's not as good as it could be, especially with the different measures that were taken by the executive power over the last two years. The opposing parties were seeing their passports detained and civil society is not really able to mobilize and to demonstrate in the streets. And with regards to this and the kind of precarity that we see in Central Africa, we could think that Central African democracy is problematic. The executive controls the parliament and the judicial and we saw this in various situations. But with regards to the tax, last year I looked at the constitutional tax of the CIMAC area. And I concluded that this is something that we will look at in terms of how these texts were developed. And the Central African Republic and its own constitution, I think, is much further advanced than many other countries in the sub-region. The CIM applies to our electoral law and we have to also consider the implementation. There's a lot to say there. When I discussed with a few opponents and say they're the head of the opposition, they acknowledged fundamentally that there's nothing much to challenge. But some of the institutions, on the other hand, the constitutional court in the old days was somewhat objective over the 18 months. Gradually they slipped into favoring the executive power, rather. I'll conclude with another point, which is the following. The CAR is a social construct from an anthropological point of view. There again, I only have a mostly positive view of this country when you see how the political parties have come together in sumac and Cameroon gavel. As you can see in most of these spaces, they are strong chieftains. That's an outgrowth of ethnic communities that wanted vertical power, even if there's verticality. There are checks and balances. There is the rune phenomenon in the Cameroon, but when you see traditional CAR constructs in the northeast, there are a few sultans. Over time, rarely achieved and benefited from this form of omnipotence that you see in other societies such as Chad and Gavel. Even this leads one to think that in CAR, there is a form, in my opinion, of horizontality, which is not rooted enough. Our country, CAR, has still a ways to go in terms of democratization, if you consider the great principles of democracy, balance of power, elections and so forth. However, it is the country which is the smallest GNP of sumac, but from an institutional point of view. In a way, we have written these things down. We are the furthest advanced. Thank you, Hans. And discussing these elections, we know that the last elections, the last local. They were organized in 1988. And since then, the organization of local is party. You suggested local elections for the first time in a while this year. This will be after the last elections. And now, can you tell us more in terms of the status of elections? Will they really take place? And what are the preparations? And what are the requirements that should be in place? Could you analyze this situation, please? We cannot hear you, Rosin. It seems that your microphone is muted. Hello. Hello, Rosin. Hello, everyone. For this moment, this exchange is very important. As you know, it is important to underscore this theme currently. The political arc. Is that a standstill? Rosin, can you speak louder? Because we really can't hear you terribly well at all. As I was saying, thank you. It's important to underscore that the tragic disappearance of certain foreign politics in the CR, that's why we're witnessing what is going on right now.  And they should take place on September 11th. But that was postponed. Otherwise, it's a major challenge for peace. Why? Because the current generation, the people who are old enough to vote, have not experienced elections on a municipal level. So it's important for this generation. It's important to say that the success of these elections will be a victory for democracy. However, the failure of these elections can trigger something worse. Further deterioration of democracy and peace in CR. Speaking of this, in terms of the preparations, there is a national authority for elections that oversees this. But you have to review the mapping and you have to update. And that's a lot of work, too, to be successful in terms of the organization. And these local elections are very healthy for peace and democracy. So in a nutshell, I'll come back to this challenge for democracy and peace. If the government and the Central Africans are successful on a local level, it will prepare the people to vote to explain why, what are the advantages. And this will motivate participation in CR. Thank you, Rosa. A very pertinent analysis. I would like to remind the audience and encourage viewers to submit their questions in the chat box at the bottom of the page. We encourage them as well to use the hashtag of the event, CR, peace and democracy. If you could do that, I think that the museum in UNED will be very proud. My next question pertains to KC. Since you work with the youth and the women in terms of education engagement, do you think that the citizens will participate in these local elections? And what are your ideas to improve this citizen involvement? Thank you very much. I will piggyback on what was said. I think that we are in a country for over 30 years. There was no local governance. Even I am of a generation. I don't know what this is all about. It's very theoretical, although we learned it in school. We are part of a youth movement.  And the gap between the people and the decision makers is so huge. It's good to have this opportunity. These local elections, as Rosine said, are historical. But beyond everything, you have to support the communities as well. And that's what we're trying to do to our organizations to explain what is local governance to understand the importance. But identify one's role to avoid the same scheme. We want to create a framework where the people could speak up and play this role and have an impact in terms of governance. At a national level, I got in touch with different young people when we talk about local governance. A lot of people are in disbelief. They feel it's just going to be rubber stamping of what exists already. But people see it as an opportunity. But the support is really fundamental. It's not only a question of funding, but it's also common sense and organization as an organization from civil society. And I think we have to re-inject trust. It was interesting what Ulce was saying in terms of local authorities in the CAAR context. That's one of the issues we experienced. We lost the value and the importance to have local leaders who support the local communities. And that's where we find a meaning in our fight as a citizen. I'm full of hope as a young person. And I see that amongst my peers, the women are committed. They understood that they can play a role. There's the law on parity that is about to be implemented. But at the local level, there's an opportunity to... And the women understood this. Things are moving. The campaigns are working well. More and more young people and young women. And it's extremely positive. Thank you, Kisi. You mentioned Hans. I'd like to go back to that. And to ask the same question to Abdel, who is the vice president of JICA. What is his analysis of the robustness of CAAR democracy? Are there major risks involved? We cannot hear you. Abdel. Thank you. Thank you. Thank you, Mr. Valerie. I think in terms of my predecessor, I will reiterate certain elements that pertain to democracy and CAAR. We are experiencing a situation that we've lived through over 10 years as was underscored in the question of the Central African authorities have piggybacked on this phenomenon, which is becoming a reality in French-speaking African countries. As Hans mentioned, CAAR has enjoyed a certain momentum in terms of feasibility of these laws to respect freedom of expression, human rights. As you can see, this happens in a country where we have a democracy and very often the opposition is seen as enemies. We feel that we are enemies. And a general African could never go onto a national radio and speak out. Democracy, as we see it in Western countries, is predicated upon the public. The national authorities are looking to the public to get messages, but that's not the situation here in the way that we are structured. In terms of powers and institutions, those are already in place. The issues with regards to communication, good governance, there are institutions and there is compliance to those principles of democracy. I think for other issues, we are really in our very first steps. As far as our democratic solidity, I think we're really in our initial steps. We mentioned the solution, which is underway in CAAR, which has to do the electoral issues. And I did want to follow up on what Casey had mentioned. There are a number of rumors on social networks, which has to do with the modification of the processes, and this seems to be growing. A number of parties, including one that is a fond institution, have to mobilize a number of young people in various villages or neighborhoods. And the idea would be to modify the constitution. I think that young people are aware, the people are also alerted by the situation as well as the authorities. I think if we wanted to really consolidate our democracy, we have to respect the constitution. The constitution is absolutely fundamental. It is the one guarantee of normal democracy. And if there is a violation of the constitution, we no longer have a democracy. So yes, Central African Republic is progressing in terms of respecting the democratic principles, but not entirely. And in certain areas, it's not applying the principles. So that is what I wanted to add to the conversation. And I think we'll follow up on a question which I will ask Rosen is hate speech a serious problem in CAR. What is the impact that it is having on the conflict in terms of democratic process and who is most at risk and how is it possible to fight against this kind of hate speech. Thank you. I would like to say that yes, hate speech is a problem in our country with given given the fact that we have a tremendous ethnic diversity, many ethnic groups, different languages. Hate speech is a problem. We have noticed an increase in hate speech amongst different groups and as a way to push people to action. And I think this has the result of fueling latent conflicts. We have looked at the situation with regards to hate speech. We've noticed that sometimes people who are controlling a certain region will be the ones using this hate speech to challenge the right or the authorities of others. Sometimes certain terms are used from certain languages which are pejorative. It is a way of creating division amongst people of creating mistrust among each other so that a control could be established on a certain region. It is in the lexicon that we have talked about. The ones who are with power in power use this hate speech and those between the government and the people these issues are growing. I think what we need to do, the interpreter apologizes but the sound is extremely choppy and difficult to hear. What we need to do is teach young people also to speak to others and to recognize diversity as a wealth, as a richness in the country. I think if we have proper speech and we know how to speak to each other, we can grow within the community. We need to teach political leaders to speak that way as well, to speak in terms of peace and democracy. Otherwise we will not move forward. Yes, diversity is a wealth and these kinds of peaceful speech are good, are very positive. Thank you for answering that.  I think absolutely, I would not even hesitate. The cultural diversity that we have in Central Africa is very precious. We have a multitude of ethnic communities as we have mentioned and I think that is a tremendous wealth. These are the necessary elements and the important elements for us to consolidate our wealth in Central African Republic. But most of the population as a whole does not have the way of measuring the impact of certain words. They are not aware of the fact that certain words have an impact on behavior or on the moral state. And as a result, they cannot really recognize the extent to which this has an impact. I think that certain actors have noticed that their terms are words that are used in discussions and those are words that will trigger conflict. They will trigger conflicts within the community or ethnic groups. So there is a kind of glossary of hate speech that is used in Central African Republic.  Well, the Arab would say that we'll say, you know, we are part of the Arab community instead of Central African community. But when we talk about Arabs, so we think about Saudi Arabia, so when we call somebody in Arab, you're basically saying you're not a Central African.  And there are a number of bandits. We also use words like shia, people who wear face covering. We call them dogs of Chadira. And that's very shocking. There are words that have a tremendous impact. And that I think is the fundamental issue that characterizes this hateful speech in Central African. And you mentioned one thing and you said, does it have an impact? Of course it has an impact. If we are here today, I think it's because certain elements wanted to see this shake up in CR. There's defamation, discredit, accusations that are preferred. And these words are important. We say, oh, the northerner is here, or you have to stay there. And these are discriminatory distinctions. It's what really promotes hate against one and all. So I would say that yes, we still have hate speech in CR and it has an impact. And sometimes in the neighborhood, we'll say, oh, go see the Yakama lady. That is a Central African ethnic group. Go to Yakama woman to buy spice. And so we're basically teaching the kids that there are different members of society. And these children will grow up with this idea and this way of seeing, way of living. And as a result, it anchors something in their mind and it changes their outlook. So with regards to hate speech, I think we have a huge amount of work to do. First of all, we have to increase various activities to fight against hate speech within the community. And we have to have programs to fight against this because it's very difficult on a financial level to have any kind of mobility otherwise. I don't know if you have something to add to that, but I would say that yes, hate speech is a very serious problem in Central African Republic. Thank you very much for that contribution. Now, we're going to talk now about the political agreement for peace and reconciliation in the CR. Which was signed in February 2019 with 14 armed groups. This agreement was limited. That was put in peace and other efforts were started for the Great Lakes regions to launch these processes. So what is the situation with the peace process in the CR and what is the best way to go forward to reach an agreement that will be respected. Thank you. This is a hugely important subject. Why? Because when this agreement was signed in the previous weeks, if you remember, the agreement was presented as a last recourse, the last chance agreement. And when we talked to the various diplomats of Western and African Union countries, that was a perception that they still have to this day. That there is a kind of weirdness on the part of these parties. There's so much has been mobilized in time and energy and resources to find a political solution that would allow the Central African government and armed groups to cohabitate. But even within the text itself of the agreement, there are some issues. For instance, talking about transitional justice or the implementation of certain aspects and certain elements were left very undefined, which became just a very generalized advocacy. But I think unless things are very specified in details, you know, this is not tenable and we cannot move forward from the cartoon agreements. But I think the most important part was the implementation of this agreement because it was not done in good faith, not on the part of the government, not on the part of the armed groups. And I would say that on the part of the government, there's also a responsibility, the fact that certain units such as the MSQ were not put in place. And there were a number of processes that were pointing out certain armed groups, whether they had taken over power or just had decisional power. I think the examples are legion. There is a procedure now in front of the criminal courts because the 3R was responsible for massacres in the Muna area. It's a number of violations of the armed groups. So the agreement is at a standstill to be perfectly honest. I think it has very little chance to be revived at this point, if we can use that word for a number of reasons. Two actors brought about positions that are irreconcilable. Now you have the Wagner paramilitary people who are in a position of strength. They were able to expel people from the above mentioned locations and they're relegated to the periphery and the periphery of the periphery. So the government does not intend to negotiate a new agreement or even grant these armed groups what they seek. It was discussed in cartoon with the former head of state, Boussisee. Among other requests, they want to be able to control the territory that they control here too far. They have to go to Bombay. They have to go back to Boussangoa and so forth. For the government, it's out of the question for the armed groups. If we weren't able to take power, we should at least be able to get back our former situation, which was already fraught. And it's because of the situations that they launch the operation and you also mentioned the following. There's discouragement. There's a lack of goodwill from the government that made some robust statements, but in practice, as I said, there's no longer an interest to negotiate with the armed groups. And they promise those who would surrender would not fall between the net of justice, but the armed groups, they do not want to abandon fighting. They're hoping that the international situation will play in their favor and that here and there, certain actors, non-central Africans will help them out in their operations. And this is very risky as well because these actors, when you observe them, they seem disinclined to such maneuvers. So we might end up with a status quo and the group arms will still have thousands of men in different local areas along the border.  And you find them in the main cities, making sure that most of the economy, the most important mining sites in the main corridors, leading to Bongi will be under their control. Thank you, Hans. Can you see those? There's not much of a likelihood to have a peace accord. So do you see a roadmap to reach a long-lasting peace agreement? That will be respected. Thank you, Valerie. I think that I will explain rather how civil society perceives the situation very candidly. Nobody speaks of PPR. People don't believe in it anymore. We don't believe in it. We're not aware of the evolution, despite the secretariat at the president's level in terms of the initiative with the Great Lakes. The situation today is not what it should be. It's not a lack of interest, but I think we need the civil society to refocus things, have evolved to discuss security issues. The civil society realized that security had somewhat improved, but at the central level, at the government level, in terms of the state, there are dynamics that are destroying, actually, the trust and the stability of the people. There are excesses. There are attempts to change the constitution. There are false information circulating. Some actors are going on social networks. These are very harsh rhetoric for civil society. We know that regardless the accords are what they are and what they're doing there, it's a way of protecting these accords to hold people to the accords that they have taken. It poses some problems. The agreements are being followed, but people are discouraged. The partners continue to quote them, but without really believing. I think that at the end of the day, everybody is concerned by how the state is evolving, the choices that are being made on different issues that lead us to think that for a lot of people we might end up in another crisis in the years to come because nothing is stable anymore. Let's remain with civil society. Abdel, what are the main challenges to which civil society is confronted? In a nutshell, thank you, Valerie. I think that there are huge challenges that civil society must meet in terms of peace, namely, and democracy. And from a peace perspective, as Cassie had underscored earlier, there's a slight improvement in terms of security, but not much. Insecurity remains, that's a challenge to promote peace. Civil society is not only promoting peace, but it encourages other people to be resilient. If there's no free movement in terms of activities on the ground, things are not easy. As a result, this issue of insecurity remains a phenomenon that we must fight to promote peace in Central Africa as a second element, which represents a challenge linked to peace. It's this issue linked to the hate speech on the social networks, things go viral. People, if somebody see a conflict with such a person, there are messages that concern not only the person who the address see, but other people linked to the regime or a certain ethnic group or a certain religion. So as a result, this hate speech, these hateful words represent a huge challenge to promote peace. Third element, civil society is active on the ground. They are more focused and actually bangy, and inside the country, these are international organizations that are inside the country, supported by certain national organizations, but few. But civil society can't truly enlarge its scope. It's a question of financial mobility. So that's a hurdle. There's goodwill. There are skills. You have strategies, methods to reach out are there. But sometimes there's this lack of ability that civil society experiences in terms of democracy and CAR, we'd have to try to underscore this democracy. I think CAR is moving ahead in terms of stability. To get to know democracy better linked to this, the people psychologically lives in fear to express entirely what they feel linked either to the government or a phenomenon. People are afraid in a nutshell, too. There's this issue related to impunity and intolerance. And yes, civil society is fighting, but sometimes the voice is not heard. There was this issue related to the Ministry of Herding in the Constitution, Article 28, preventing people to gain access to a government position. But actually, there's no state per se. In the government, people came in via the window rather than the main door. So this is also related to democracy and inclusion, freedom of expression. The people feel that it must feel that he's in his country that he can express himself as he pleases. This should be underscored that people live in fear they can express their feelings publicly or privately. So society is undermined. You feel that your neighbor is your friend and you become suspicious. So fear is in the heart of many Central Africans. They feel they don't have this freedom. They cannot express their feelings, their joy. That are some of the challenges since Kessie is there and Rosinilla, if there are certain elements linked to peace and democracy as experts, they can bring about more Moving ahead in this direction, there are a few questions from the audience. The first question is linked to this hate rhetoric. You're being asked, is there a difference in these hateful rhetorics? Is there a difference between what happens in Bangui, the capital, and the country? Yes, there is a difference. CER enjoys ethnic diversity and there are a whole array of local languages as well. They are not compatible with the national language. Let me take an example in Central Africa. People come from the forest. That very word creates attention. Some who come from the inside will not be accepted as somebody from the bush or the forest. This is a typical example. Moreover, there's also certain elements inside. Let me take the case of ethnic groups, the Apoa people. There is the Kaba ethnic group and there are two Apoa ethnic groups that don't get along. There were a number of activities that were in groups that were living together and they had to come together, these two different ethnic groups. But that is just an example. If you are a member of one ethnic group, you might not necessarily agree or get along with the different ethnic groups. We did not see necessarily confrontation, but we have terms, for instance, that translate traditionally to people who like to eat. How could I say this? How could I describe it? So it's the French translation that is problematic. It's this idea. We're following what you're saying, but there's another issue related to this. Because people in general, when they look at their role as civil society, and especially with the upcoming elections, they wonder how they can participate, how they can be a part of it. Well, that is the heart of the work that we're trying to do with the civil society. Because what we need is to set in place independent observers that could supervise the elections and beyond this, we would need some kind of supervisory or monitoring instances so that we can prevent any kind of fraud. Like I said, we're really in a context today that has cooling things down. It's hard for people to understand what the fraud is and how they are being manipulated. Today we see, for instance, petitions going around to change constitutions. That is something that really alerted us as civil society. So we know how important it is to give the proper information to the population because we already see that there's quite a bit of disinformation around the workings of the government. It's important for the civil society to gain good information and to follow the candidates as well as the various leaders that they will ostensibly support. And to work with young people because they're highly dynamic electoral campaigns in our country are often hard and parcel of disinformation, of gifts to different groups. There's got to be a lot of work, not only for national elections, but also for local elections. That's the way we need to proceed. Yes. And Casey, I'd like to follow up with another question from the audience who's asking, what does civil society expect from Minuska to bring peace back to Central African Republic? Well, Minuska has a new leadership. This is recent and this is a new director. And so we are waiting to see what's going to happen in different approaches and different discussions and how we can move forward with them. I think over the last few months or maybe the last years, the discussions were not as productive with the Minuska as they had been in prior times. So maybe this new leadership will give us a chance to look at certain realities and include civil society. The population perhaps Minuska can play that role to give proper information, correct information and serve as a bridge between us and our authorities. And this is a role that they do play. We recognize that. But in the last few years, we noticed that we had lost to some degree a strategic partner with them. So we're waiting to see and we are hopeful. The door is open. Yes, I think I've done you talk about the challenges of civil society in Central African Republic. And I did want to ask a very quick question to was enhanced. What are your recommendations with regards to the way in which the international community can contribute to peace and democracy in Central African Republic. And perhaps you can give us a one minute response. Thank you. Thank you. My recommendations to increase improve the situation. Yay. Can you please speak up because your sound is very low. Yes, as I was saying. We need to improve the public's confidence. Civil society needs to feel more confident. I see a certain amount of competency on the part of the 30s. I think there needs to be a number of peace and democracy initiatives on the part of civil society as well. Thank you. What do the CI are people expect from the international community to support peace and democracy. We cannot really reflect all of the opinions that are currently in Central African Republic to answer such a question, but I would throw it back to a number of our partners. I would bring up for a long time. It was not very popular, but in order to develop African countries, we had to go around the actual governments. But I'd like to bring attention to this because in Central African Republic and elsewhere, sometimes it's the government that is responsible for the failure of the country. So we need to see what civil society needs to have and what the government needs function in our international partners need to ask themselves this question. What is the priority? And what should be the priorities for that in politically? Sometimes they're very involved and they can give a lot of means to bring back peace and democracy. We need to decide where in Central African Republic space the notice help will come and this is a carrot stick approach. You can't truly push a society to go towards certain models with certain optics that is just predicated on the stick approach. If the government has what you deem as being negative and you bring out the stick, well, you also need when there is progress, especially with stability and democracy, then we need to see a substantial aid that would recognize what has been done and what has been contributed to. Because we know that sometimes these donors are the American taxpayers or Japanese taxpayers, but I think we need enormous means and our international partners need to be aware of that. So we can't just have a drip by drip kind of help and especially in Central Africa. And I'm also interested in hearing what Casey has to say. What are the expectations on the part of the people with regards to the international community for peace and democracy building? There is an expectation, yes. I think CAR is at an ideological pivot point. Something is happening throughout the country and we can see it through different positions that are taken by different actors. There is a political change happening, whether positive or negative, it is happening. And what we're expecting as a part of the international community is to take stock, stop and take stock. I think we're going too fast and there are positions and decisions that are being taken that over the long term could be harmful. So we really need to understand to see things as they're coming to the fore. And I highlight this and every time I will have a platform, I will underline this. I think there is currently an ideological position and if we don't look at that, if we don't analyze it, if we don't really focus on it and we underestimate it, then we are going to become a country that no one will recognize. And one day we'll wake up and that will be the case. So before offering any kind of solutions, we have to be aware of that and we have to react to that. Thank you so much, Casey. I think we've come to the end of our debate. Let's congratulate all our panelists, all of our experts for these relevant analyses on the theme of the day. I'd like to give Elizabeth the floor for a few closing remarks. Thank you to one and all. Thank you Valerie and thank you to all of our speakers for this very, very rich conversation and for so generously sharing your expertise. It was so useful to hear your analysis from the ground in Central African Republic into hear your specific insights on the challenges to peace and democracy. It seems that in recent months other armed conflicts in the region and other challenges to democracy have drawn a lot of the international attention away from car. I think you have really convinced us of the need to refocus on car and the need to make sure that any international policies international assistance are well informed by perspectives from the ground. At the same time I leave the conversation feeling hopeful. You also reminded us of the many opportunities of partnership with youth partnerships with women's groups partnerships with civil society with community organizations and the large opportunity that is the local elections. If we all work together to ensure that citizens are well poised to participate. So thank you. Thank you for your work for sharing your expertise. Thank you to everyone who has joined us today virtually. There was a tremendous amount of attention and many of you are viewing. I apologize that we could not get to all of the questions. But I know that I speak on behalf of Valerie as well when I say that the National Endowment for Democracy and the US Institute of Peace would love to host a follow on conversation. So thank you very much everyone. Thank you.


Get started. I'd like to thank everyone who is joining us today. Welcome to today's CNCF webinar, What's New in Kubernetes 1.18. I'm Karen Chu, community program manager at Microsoft and CNCF ambassador. And I will be moderating today's webinar. We'd like to welcome our presenters today. We have Jeremy Rickard, enhancements lead, George Alicorn, release lead, and myself, the comms lead from 1.18. And just before we start, a few housekeeping items. During the webinar, you are not able to talk as an attendee. There is a Q&A box at the bottom of your screen. Please feel free to drop in your questions there and we'll get through as many as we can at the end. This is an official webinar of the CNCF and as such is subject to the CNCF code of conduct. Please do not add anything to the chat or questions that would be in violation of that code of conduct. Basically, please just be respectful of all your fellow participants and presenters. Please also note that the recordings and slides will be posted later today to the CNCF webinar page at CNCF.io slash webinars. And with that, I will hand it over to Jeremy and George to kick off today's presentation. So much, Karen. So we'll start off today just by giving a little brief overview about the logo for the 1.18 release. Every release has its own personality and its own kind of representation. If you remember the 1.16 release, there was a great logo based around breadsticks, Lockie, who was the release lead. That was a big fan of breadsticks in the Olive Garden. So that kind of featured into the release. So let's start off this webinar by having a little bit of background on how this came to be. Yeah, absolutely. So at least one of the secrets about the release team is whenever you get into the release lead position, you have the privilege of designing the logo for the given release as lead for 1.18. I took the opportunity and ran with it. And the logo for 1.18 is inspired by the LHC, the Large Hadron Collider, which is an physics experiment meant to explore the really fundamental questions of physics, at least part of the motivation is because before I actually started working as a software engineer, I was a physicist and I keep the physics around still, even to this point every now and then. And I wanted to take the opportunity to talk a little bit about physics. And the other one is that the LHC is like the Kubernetes community is a really large collaboration. They have thousands of people from all around the globe, constantly working towards trying to gain a better understanding of the underlying laws of physics. And like the Kubernetes community, they are very inclusive and they are doing a lot of really meaningful and super interesting work. And I wanted to take the opportunity to just give a shout out and not only to them, but to a lot of communities of scientists and engineers who are not only working on the LHC, but another experiments for physics, biology and like, because ultimately it is my belief that if you want to go far and if you want to build really cool and interesting and useful things, having a community, having a really large and diverse community is gonna be the best opportunity that you have to advance things. Awesome, thank you so much for that background. I think that it's a super cool logo. And I've been trying to 3D print it to have like a physical memento of it. I think it's turning out pretty cool. Also working on the swag. So at some point there'll be shirts and if people are interested, please feel free to pin. Nice, thanks. So today the agenda for this webinar is gonna allow us to give you a little bit of an overview of 118. We'll give you a couple of quick highlights of things that we think are super important to bring forward. We'll also give you a really quick update on the 119 release with things that are going on and then dive into a little bit of an overview of each one of the enhancements that came into the release. We'll also have a period of Q&A at the end. So first up, let's talk about the 119 release because that's kicking off right now. So we're here to talk about 118, but 119 is pretty relevant I think as well. As consumers of Kubernetes, you might be interested to know when the 119 release will happen. Originally that was supposed to be June 30th, but because of everything that's happening in the world, it's been extended a little bit. So the new target date is August 4th. And there's a lot of changes that are going into this with regard to the timelines and the dates within the release, but we wanted to make you aware of just when the target of the 119 release would be. So you can kind of do some better planning about when you might adopt that release. If you're interested in reading more, the slides will be available at the end, but I've included a link here to discussion forum in the Kubernetes Dev mailing list where a lot of these things have been spelled out. So you can see some very specific things like what's going to happen with 120 afterwards? What are some of the changes we're trying to implement within the release this time? Okay, so with that out of the way. Sorry, one quick thing to add. Also with the changes in the 119 release and this will possibly also be very similar for the 120 release. So the 130, usually we have four releases per year. This year we're only gonna have 118, 119 and 120. 120, that's a grand plan. And one additional change that's going to happen is that the release team is going to start publishing a lot more release candidates. So all the things that we're going to be talking about right here, one good place to test them out was with the Kubernetes release candidate, which was released before the official 118.0 release. And 118 is gonna have a lot more of those. So all the new enhancements are being worked on. You can actually try them out and kick the tires with them. Yeah, that's a great point to bring in. Okay, so let's dive into the 118 enhancements now. So I was the enhancements lead for 118, so I'll give you a quick overview. In 118, we had 38 total things that we tracked. 15 of those things were stable. That means that they've graduated to being fully released and supported. You can expect them to live forever with some level of confidence within Kubernetes and not change too much. 11 of those things graduated to beta, which means that the people working on those features think that the API is reaching the point of stability. Changes could happen going forward, but you can expect them to probably live and have a certain set of stability and testing going into them. Those things are usually enabled by default as well. And then 12 things were introduced as alpha features. Those are brand new things that are being added to Kubernetes. They're gonna be behind feature gates. So to use them, you'll have to enable them to take advantage of those features. But you can see it's a pretty good spread. Almost equally divided between the categories, giving us a good mix of brand new things and some promotions of things that have been around for a little while. So I'll turn it over to Jorge to do a little bit of highlights. Thank you, Jeremy. Yeah, so as Jeremy already mentioned, one of the themes that we chose for this release was fit and finish because we have a lot more things that are being worked on, really cool features that people are testing out and seeing how they work in the world. But we also have an equal proportional features that are going to be stable. And we believe that they are completely ready for production use. And with that, let's go on to the next slide to see some of the changes that we want to highlight out of the bag. One of them is actually with Cliingo. One of the, a lot of people use Kubernetes to host their applications. But one, another very important use is to actually build operators or build programs on top of Kubernetes. And this is where Cliingo comes in with 118. There was a really large change that went into the codebase where now every single method that every single method in Cliingo is now going to take a context as a first argument. And this more or less aligns Cliingo with to be more co-idiomatic, to align more with other API libraries that you might have seen in the while. So now whenever you start your application, if you create a context for your application to keep track of what is actually happening, you can pass that context for every single Kubernetes API call. Couple other things that also changes that most, a lot of function signatures also change. And now for the most part, most functions besides taking a context and some information about the Kubernetes object that you want to handle, for example, a config map or a pod, they're also going to take some options, kind of a options kind of argument, which where you can specify some additional metadata for your operation. And one project that is being developed within the Kubernetes organization, you can actually find it in GitHub.com, Kubernetes 6 Cliingo fix. This one is going to help you actually adapt your programs to this new way of writing Cliingo applications. And Jeremy has actually given it a try. Is there any highlights that you'd like to share with the audience at this moment? Yeah, I mean, I think the tool is really useful, manually upgrading to Cliingo 118. Obviously introduces these changes. The context one is pretty big, but the other ones too, like when you have a delete operation, previously it accepted things by reference and now it's my value. So there's just a lot of changes that you have to go through. I had changes across like 54 files in this project that I was updating yesterday and Cliingo fix is pretty nice. It's still in beta, so make sure you have a backup of things because it does in place changes, but it can help you out a lot when you're dealing with this change. So on to stability. A couple of the enhancements that one in for 118 are to improve the stability of the project in really cool ways are a pain-based evictions. CubeCuttleDev, API Server Drive Run, CSI Block Storage Support, and Windows Improvements. Overall you can see that people have been working in almost all areas of Kubernetes equally. You have some tools to improve how developers and operators work and apply changes to their clusters. And this is where CubeCuttleDev and API Server Drive Run actually come into play. These two enhancements are going to enable you to have a better feel for what is actually happening and what is actually going to happen after you do some operation. A pain-based eviction shows a better user experience for people who actually make use of things or they're doing some system administration on the clusters, a Block Storage Support that's been a major one. And we are going to talk more about it later on on this webinar and Windows Improvements. This is by far one of the most, one of the most exciting areas in Kubernetes during the past couple of releases. We have seen how Kubernetes started to support using Windows OS as actual worker nodes. In previous releases, the adoption grew more and we started to actually run a lot more, a lot more complex. And to end test on Kubernetes using Windows worker nodes and finally in this release, we're gonna see a lot of changes on Windows that make it feel a lot more like the usual Linux-based worker nodes along with some other enhancements enable people to manage Kubernetes clusters that use Windows for example, for example, that you see in tools such as Cube Admin. Yeah, I think it's a really interesting thing to come into the project and it's awesome to see it progress. And as far as new things go, we have also seen some enhancements that try to tackle some complex issues that people have come across. A lot of organizations are using Kubernetes and for the most part you have your standard clusters with some things or hundreds of nodes with a lot of people are really pushing the boundaries with the kind of things that you can do with Kubernetes. And we have seen a lot of issues when you are running thousands of bots, thousands of nodes and one of the really cool enhancements that came into one 18 is priority and fairness for API server requests. This more or less enables us to have a more reliable installation of Kubernetes where we can actually separate the requests that are landing into the API server and we can throttle some of them to allow for the most important request to go in and allow people to have a more consistent user experience when interacting with a really loaded cluster. Another cool one is KubeKart on the bug end. Like all the other enhancements that I'm mentioning, we're going to talk more about this one later on but if you have heard about it, just know that this is on the works and it's close and each day is closer and closer to be in GA with KubeKart on the bug. It's definitely going to be a game changer, configurable HPA scale velocity. HPA at this point in time is something so ubiquitous. So having more ways to tune it, it's gonna be amazing. And immutable secrets and config maps also help developers interact with their Kubernetes clusters in a more secure manner to prevent any accidental mistakes or applies. Great, thanks for giving us those quick overviews. So next we're gonna go through updates for each one of the six. So when things are worked on in Kubernetes, they generally fall underneath of the purview of a SIG. So that could be something like authentication or API machinery or storage. So each one of the updates that comes into the release is kind of shepherded by the SIGs and they have responsibility for getting it across the line. So we've organized things by SIG so we can give you a better understanding of how things have changed in the release. We'll start out with API machinery. So like we previously mentioned, priority and fairness for API server requests is one that came in. And for each one of these items, when you get the slides later on, you can actually click through to the tracking issue and the enhancement proposal or CAP to see what's been proposed, what's been implemented so far and what the plans are for each one of these things going forward. In the notes, we've also included blogs. So some of these features had dedicated blogs written for them. Some of them didn't, this one did. So in speaker notes for this, you'll be able to find a nice overview of this feature. So but at a high level, this is a brand new one coming into the release into Kubernetes. And we mentioned previously that things kind of broke down between the lines of alpha, beta and stable. This was one that's brand new, so it is an alpha issue. And really, in addition to what we've mentioned for this one already, this really helps us prevent, clobbering the API server under heavy load, keeping things going, keeping people from stepping on each other when they're making API server requests. Next one is API server network proxy kept proxy to beta. Some of the titles here are not, is everybody seeing it, okay? Okay, so these are the titles from the issues in the repository. So they need probably a little bit of massaging, but here we're moving the API server network proxy to beta. So this is something that's existed. Almost landed in 117, didn't quite make it. So it's made it into 118. It allows you to separate user initiated network traffic from API server initiated traffic. Doing that kind of segregation to, again, help people control how requests are going. Yeah. Adding to this enhancement, one really quick notice that if the usefulness of this, at least one of the things that you can really tackle with this one is that if you can differentiate whether if your traffic is coming from users or from action applications, you can be more restrict when it comes to security and compliance to only allow certain entities to do certain types of operations. So this enhancement is something that's been mentioned a lot by cloud providers who want to enable users to have a more secure experience when working with managed Kubernetes offerings, but same in this enhancement can really be used by anyone in that kind of manner. So if anyone has uses where you will actually want to know whether our user is doing something or managed application is doing something else, keep an eye on this one. Yeah. So one other point to mention as we go through these slides, we're going to mention the status so alpha, beta or stable. One thing to keep in mind with these is that alpha features and beta features both have feature gates or feature flags associated with them. When something's in alpha, by default, it's not going to be turned on. You'll have to go and enable that in the feature flag. When things go to beta, they're on by default. So you can turn them off if you don't want to use them, but by default they will be on. And then when things move to stable, the feature flag is dropped so that feature just becomes part of all installations of Kubernetes. So here we have a stable. So we've gone from alpha to a beta to a stable. This has existed in Kubernetes for quite a while. It's been beta since 113. So it's had quite a few releases where this thing has been around. But in 118, we see it finally land as a stable feature. And this one is particularly useful for people who are working on developing some application on top of Kubernetes. And if you're doing some complex change on the cluster, at least one of the things that didn't happen before is that if you just want to run a pod, for example, in that pod you're running the devian, you can do a keep code of apply, try running. It's going to tell you whether something happened or not. But at least with the API server drive run, actually sending the request all the way to the API server, passing through any admission web hooks or anything else that you have configured along the way that might change the way that your manifest is going to be handled and created on the cluster. This is going to give you all that information that you need. And if you use a keep code of apply, drive run, it's going to do the client by default. So if you just do drive run, that's what's going to happen. If you actually want the API server to do it, you have to specify a drive run equal server. Yeah, that's a great point to add. Thank you so much. Okay, so back to our client go issue we talked about before. We're giving you a little bit of an example here, but again, this is a change to client go. You can see that the structure of calls change. So when we want to get pods using client go, it looks a little something like this. You ask for the core v1 API group and then you would ask for pods in a certain namespace and then you do the operation of get. Before you used client go from 118, you wouldn't have to specify that context parameter as the first parameter. Now you have to. There is, if you go through the tracking issue, you can actually use some generated clients that will be around until 121, don't have that. So you still have to change imports and whatnot, but you can keep the signatures around for a little bit longer. That will be removed in 121. So you'll eventually have to make this transition anyway. In the speaker notes here again, we've linked to the client go fix tool. Thanks to Jordan Liggett for that. It's really useful. All right, now on to SIG architecture. So one of the first enhancements from SIG architecture that we are going to talk about is enabled running conformance test without beta rest APIs or features. So at least some context that is really useful when talking about conformance is these tests are supposed, these are end-to-end tests that are managed and maintained by Kubernetes contributors and they sleep with the rest of the core Kubernetes code. Conformance tests are supposed to give you some sense of reliability. They're meant to tell you whether your Kubernetes installation is actually working the way that it is intended to. And to that end, a conformance test tend to only test a production ready features because anything that is in alpha, it might partially work, it might have some changes with a we don't really know and hence it's been kept in alpha. Things that are in beta are a little bit more stable but we don't really have any sense that they are, they might still change. So having the set of conformance tests only test out GA APIs and features, it's really helpful for people who manage their own Kubernetes clusters to ensure that your installation process is working as expected and equally useful for anyone who manages Kubernetes cluster for other organizations or other users. Well, let's move on to the next one, which is SIG-OFF. First one we'll talk about is a brand new alpha feature. So again, to use this, you'd have to enable the feature gate for this but this is providing the ability for OIDC discovery endpoints in the API server to be used outside of the API server. And this is cool because it enables you to do things like use authentication tokens from Kubernetes to be used as a general authentication mechanism. So you could use it for services outside the cluster as well and federate things to other clusters. It's kind of neat. Next is some changes to the certificate signing request API. So if you want to use Kubernetes to generate a CA and a certificate from a CA, you can do something called a certificate signing request. And this API had some changes from 1.18, it's planned to go stable and graduate to stable in 1.19. Okay, on to SIG autoscaling. And one of the enhancements that I already mentioned from SIG autoscaling is the ability to configure the scale velocity of horizontal HPA which stands for horizontal point autoscalers. So in this case, whenever you have a deployment staples or something of the sort, and normally you have the capacity, normally you have the capacity to specify what threshold of CPU or memory utilization these resources should be using and how to scale up, whether you have a minimum number of replicas or a maximum number of replicas and then HPA handle how many replicas to create based on the utilization and the target utilization. One new way that SIG autoscaling is enabling us to find in this process is by allowing us to tell HPA resources how fast to scale. And for example, in the slides, you can see how that's going to look. So whenever you're defining your HPA manifest in YAML, you can have something like behavior, scale up your policies and now you can actually say, I want to scale up by this percentage and that way just accommodate the behavior of the cluster to your particular application. All right, let's move on to SIG CLI now. And the first one that we'll talk about is that debug command that we mentioned earlier. This one actually builds on top of the ephemeral containers alpha feature that was introduced a little while ago. And what this allows you to do is to add pods. So the ephemeral containers enhancement allows you to add new pods or containers to a pod.  You want to lower the attack vectors, right? But that also makes it a little bit tricky to debug sometimes. So ephemeral containers allow you to spin up a new container inside of that pod that might be able to share volume or do some other things to help you take advantage of or do some debugging. To do that though, there wasn't really anything exposed in kubectl to help you do that. So that is what this debug command is doing. This is allowing you to take a pod that's already running and add an ephemeral debug container to it. You can find some more information in the enhancement proposal to see what they plan on adding in addition to just this, running the ephemeral container alongside things. And again, it is an alpha feature. So to actually use this in kubectl, like a feature gate, you have to use kubectl and believe it's alpha debug to trigger this. But I think it's cool and it shows some progression and some more kind of developer user focused changes that are coming into the platform or into the ecosystem. And to give one quick example on that one. For example, let's think of a typical application. Let's say that you're writing a web server and go. The best thing that you could do is to compile that web server so that you end up only with a binary. Then that binary copy it into a container using a distro-less container image. That distro-less container image is only going to have enough resources for your binary to be executed and run. But it's not going to have any batch, it's not going to have any other utilities. There is no way for you to install anything.  So something that you could do in production, for example, is to have your web server open running and then you run your additional container in that when you install something like curl and then you curl from localhost. Yeah, I think it's a perfect use case to show how to use that. So the next one is kubectl diff. So this allows you to compare an object on your file system so if you have a YAML file that defines maybe a deployment or some other resource and you want to compare that against what's actually running in the cluster so you can kind of compare that state that you think it might be with what it actually is, then this command is pretty useful for that. Again, this is a stable one, it's been around for a little while and it's ready to use in production. This one's not really a super user-facing one but it's interesting to track, especially if you're building anything that depends on the code. The kubectl package itself has moved to a new repo. So you can find some more information about this in the enhancement proposal as well. All right, let's move on to cloud provider or hey, take it away. Absolutely. So with cloud provider, another one of the enhancements that came in during 118 is supporting the vSphere, a cloud provider. One of the areas where we have been trying to improve in the past is to move the cloud provider from inside of Kubernetes to it's own place so that they can be developed and maintain separately from the core of Kubernetes, similar to the previous enhancement that we just mentioned where people wanted to move all the code for kubectl outside. And in this case, vSphere is going, it's one of the first cloud providers that has actually been reworked on this matter. Cool, let's move on to cluster lifecycle. So the first one here is support for Windows and kubedm. So you've actually been able to use kubedm a little bit with Windows, but this gives you the ability to add nodes to a kubedm Windows cluster, which is pretty cool. Before you couldn't easily do that. kubedm is a way of provisioning clusters. There's tons of ways that you can get a cluster so kubedm is a really useful way. It allows you to do a lot of things, rotate certs, add nodes to clusters. Before this enhancement, you weren't really able to do that with Windows containers, with Windows nodes. The ability to use Windows with kubedm has been around since 114, but until 118, you weren't really able to add nodes to clusters and make it really a useful tool. All right, on to SIG network. The first enhancement from SIG network that we want to discuss is adding an app protocol to services and endpoints. This one is alpha gated. So the only way that you can actually give it a try is to enable the feature gate for this one. And this enhancement essentially allows us to specify whether a service or an endpoint is going to be using TCP, UTP, SITP, or something of the sort. This is related to a previous enhancement from the 117 release cycle, where endpoint slice went into beta. And endpoint slices actually introduce the concept of app protocol, which will allow a way for people to specify that a given port is actually dedicated for a specific type of protocol. And this enhancement is going to... It's proposing to allow the same set of functionality from introduced by the endpoint slice escape into normal services and endpoints. The next one is IPv6 support. One huge area of development in Kubernetes for the last couple of years has been on IPv6. And now with this enhancement going into beta, which again means that for the most part, a lot of people are going to be getting this by default and you can actually give it a try with your Kubernetes clusters. This enhancement means that IPv6-only clusters are expected to work. The IPv6-only functionality was actually added back in 1.9 as an alpha feature. And this allowed for a cluster to use only to replace all IPv4 networking. And the other couple of things that come to mind is that with backing Kubernetes 1.13, the default DNS server also changed code DNS to have full IPv6 support. So as we continue rolling in with this one, it's gonna be possible to have all your Kubernetes components just use IPv6. And the next enhancement, which is a new endpoint API, this one is again, innovative status and this is meant to replace the core view one endpoint to mitigate some performance and scalability issues and this one already mentioned it by another name, but to provide the full story, this is what we mean by the endpoint slice API. The long-term plan is to have this one be the core API to use when doing anything with networking. The current service API has some, as we mentioned, some performance issues that were discovered with scalability test where we ramp up the number of nodes up to 5,000 and try to see how things we have. And this enhancement is going to, essentially instead of recomputing the entire list of endpoints that a service is using and then notifying all the watchers, all the entities that are actually watching for changes to these endpoints. This enhancement is going to allow this loop to be broken down into different groups and only the group that is using a certain endpoint has to be recomputed and updated. We'll move on to the next one now, which is graduate node local DNS cache to GA. So graduating a node local DNS cache, this is a new item that runs a DNS cache bot as a demon set. And overall we just expected to improve the performance of DNS across clusters. The next one, Ingress Changes. This one is in beta state. And this will, this enhancement for 118 adds a support for wildcard host names, better path matching and the declaration of Ingress classes. This one's pretty interesting I think because it's just more work building on top of Ingress to make it a better resource to use as they work towards doing a GA release, which is hopefully soon. Duplicate slide there. All right, so we're going to just signode now. So the first one here is changes to pod overhead. So when you are running things, there's a little bit of non-negligible overhead associated with keeping track of the pod, quota management, things that go in, that are necessary to run the workloads. And this is accounting for those when it's making for the pod sandbox, not just as the specific containers. There's a sandbox that goes along with each one of your pods. And that wasn't really taken into consideration when scheduling decisions and things were happening. So this is moving that along. This has been in alpha for a little while and moving to beta in 118. So you'll be able to take advantage of this without turning the feature gate on. Next one up is the topology manager. So giving you the ability to run pieces of Kubernetes and workloads in different hardware topologies. So basically like if you have some GPU nodes or other things that you want to run low latency workloads in, this is allowing you to do that. And this was introduced as an alpha in 116 and it's going in beta in 118. So you can see that in a fairly short amount of time this has turned around. You can expect this to be around as a stable thing somewhere down the road. This one also has a dedicated blog post associated with it. So you can go read a lot of information about this on the Kubernetes blog. And again in the feature notes, or sorry, in the speaker notes here we've included a link to that blog. Next up is adding startup liveness probe holdoffs. So sometimes you have pods that are really slow to start and maybe the health checks or the liveness probe start to fail and then the pod gets killed. This allows you to set an initialization failure threshold so that you can back things off and not necessarily start handling the failures on really slow to start containers. This one's beta as well. It's been around for a little bit since 116, but now it's beta so you'll be able to use this without turning feature flags on. This one is actually a change to a feature that's been stable for a little while. Huge pages is a feature that I haven't really used, but for using clusters that have a lot of data, this one allows you to make some changes to use the feature a little bit more efficiently. Again, you can find more information in the tracking issue and the enhancement proposal. All right, six scheduling. And like other six, the people from six scheduling have been really busy and there are a lot of really cool new enhancements coming in for 118. One of them is a more even spread of products across failure domains. This one is in beta. So for a lot of people, this is going to be turned on by default. And one of the things that often comes up is that people are, if you have a cluster in a given region, and that region has multiple availability zones, if you have multiple replicas to allow for a high availability configuration, the optimal configuration that you will want is to have at least one replica of your application running in each availability zone. That way, if there is some issue with the infrastructure, there's always going to be something open available and this enhancement essentially improves on that by playing around with the... It essentially allows for that configuration to happen even when using anti-finity rules or other interpot configurations. This one's been alpha since 116. So in a pretty short amount of time, it's gone to beta and will be around for people to use. It's pretty cool. Yeah. And like that one, think based on fiction. This one was actually, was also mentioned at the beginning, we also mentioned at the beginning of this talk webinar. This one is in stable and this means automatically. Any tainted nodes, with no execute will become unready and unreachable. So no bots, nothing will get scheduled on these ones. This enhancement has been beta since 113. And... Yep. This also builds on the taint node by condition feature that went to GA in 117. So some awesome progression there from that sake. The next enhancement is, it's adding a configurable default event bot spreading rule. This, again, talking about highly available configurations. This adds a default spreading rule to both set on the fine one and allow operators to define it. So again, another tool to ensure that your applications are highly available and tolerant of an infrastructure failures. The next enhancement, running multiple scheduling profiles. This is particularly interesting. For the most part, a lot of people can get by with the default behavior. And there are a lot of people that are using hybrid, that are using and building hybrid clusters. For example, if you have a bunch of nodes to run web servers, some other nodes to run your databases, but then you actually start doing a lot of machine learning and the like, and you start bringing in really specialized CPUs or GPUs, that kind of thing. If you start treating all your worker nodes like they are the same, you might probably be missing out on a lot of optimization. And this enhancement that just went stable on one thing is actually going to enable users to specify their own scheduling profile to tell a scheduler or multiple schedulers how to run different workloads. This is also going to help for people, it is going to be useful for people who are actually running multiple schedulers because now you can kind of get by by using fewer schedulers, but just providing different providers and different profiles for the nodes. That was a lot of crazy things coming out of that SIG and a lot of them are stable. The interesting thing, I think, is that a lot of work goes into making that happen. We see the same thing in SIG storage. So the first one we'll talk about is the ability to use raw block devices as persistent volume sources. This one's been around since 1.9 as an alpha feature. Graduated to beta in 1.13 and now it's available just as a by default feature. Another stable change is skip volume ownership changes. This one has been in beta since 1.15 and has graduated now. It's pretty cool to see that evolution. And here's another one supporting raw block storage inside of the container storage interface. So this has been around since 1.12 as an alpha feature and beta since 1.14. All of these things taken together, I think, are showing that there's a lot of stability and just maturity happening with SIG storage. Another one in SIG storage that's stable is the ability to pass pod information to the CSI drivers to allow them to make a little bit better decisions. Skip attachment for non-attachable CSI volumes. Again, another stable that's been around in beta since 1.14. So just in general, when we go back to our themes for the release, fit and finish, SIG storage has really taken on the mantle of pushing things towards being stable. And then a pretty interesting one that it's brand new is the ability for specifying secrets and config maps as a mutable. So right now when you make a config map and you load it into a pod, there's actually a sync loop that happens. So if you make a change to that config map, it'll be any mounted as a file system volume in the pod. It'll actually be reflected in the pod at some period later. So you may have a deployment with a couple of replicas of maybe your web server and it's serving some information that came out of that config map or maybe you have some configuration that you reload when things change, like maybe rate limiting rules for the envoy rate limiter proxy. And you're running those things and you're loading that as a config map. Right now, you can actually edit that config map and cause your application to blow up if you make a bad edit to it. So what this allows you, like a better practice is to actually make a new config map and then do like a rolling upgrade where you reference the new config map. That's what really this is enforcing. So you're able to specify that secrets and config maps are immutable and it'll prevent edits to those things from happening and it'll also disable the watch loop. So you won't actually spend time, against the API server looking at those things. And then another new alpha feature is generic data populators. You can go take a look at the enhancement proposal for some more information here. But in 112, the data source field was added to the persistent volume claim spec and this is just enhancing that a little bit more. And another stable. So we've seen a whole bunch of stables and this is the last one in SIG storage. This one is enabling the PVC, excuse me, to use the data source parameter for creating a new one, basically for cloning PVCs. All right, on to SIG windows. SIG windows is another, like every single SIG that you've seen until now, windows is definitely, the people from windows are definitely doing a lot of work. The first enhancement that we want to talk about, this one is in alphas, this one is in alphas status and they are constantly working on this one is the support for a CRI container D on Windows. The Windows Server 2019 version actually includes an updated host container service that offers more control over how containers are managed. And this can remove some limitations and improve some Kubernetes API compatibilities. However, the current Docker, a lot of people are using the Docker Enterprise tools. So for example, the Docker Enterprise 1809 release has not been actually updated to work with the Windows host container service. Only container D has been migrated. So this enhancement is actually about getting off the bar and getting a lot more tools and runtimes available for Windows working or not. These users will be able to take full advantage of the latest features and improvements that have been shipped with the Windows to the server 2009 in 1809. The next one, implementing runtime class on Windows. This one can be used to make it easier to schedule pods into appropriate nodes based on the always, the version of the always, and CPU architecture and the other information that you have around. With Hyper-V available, Windows can run containers on multiple windows or multiple windows operating system versions. And Linux containers might be able to do this in the future as well. This enhancement is going to document the process controlling these features through runtime class and will add new fields to the pod API changing the current behavior of the Kubernetes scheduler. And the next one is support of GNCA for Windows workloads. Sorry. So Windows GNCA. GNCA stands for Group Managed Service Account. This is a Windows thing for actually managing kind of like user accounts and service accounts in general. This enhancement went stable in 1809. And this will in general just provide more flexibility and the full set of features for anyone who currently makes use of GNCA. And the last enhancement from sync windows that we have is run as user name for Windows and this provides ability for people who are running a pod on a Windows worker node to actually specify the username for that application to run under. This is somewhat similar to a plain old container running on Linux where you can specify I want this process to run with some non-serial user. And this finally became stable on 118 and it's ready for production use. And with that, we actually just cover all the enhancements that went into 118. And with that, let's stick it out. We just want to take the opportunity to talk a little bit about the release team shadow program which encompasses a lot of the work that we have discussed until now. For example, the tracking of enhancements and the like. Yeah, so the release team is made up of a few different roles. You have the team lead itself and then enhancements, CI signal, bug triage, all handling different pieces of the release process. Each one of those is led by an individual. I was the enhancements lead for 118 but you also have some shadows. So part of the process to make sure that this process or that the releases continue to be healthy and that we can grow the pool of people that can help us with this is that we bring on shadows for each one of those roles. And it's generally between two, three or four shadows for each role. And then you come onto the release team and you help out and learn the responsibilities of that specific that role. Enhancements, for example, the team and I split up all of the enhancements that are tracked in the Kubernetes enhancement repo. We would ping each one to figure out what was gonna happen in that release and kind of shepherd it through the process. Generally the releases are around three months but that's changing a little bit right now. The workload varies depending on which team which part of the release you're in. So enhancements is kind of front loaded. Release notes and docs are kind of back loaded. So you can kind of gauge where your interest is and what your time commitment might look like. But we definitely recommend that you, if you're interested in this at all, apply to be a shadow for the next release, which would be 120. We've already formed the 119 team but at the end of each release, you can generally find a link to the application to be a shadow for that upcoming release. So that would be 120 for the next release. And if you're interested in learning more about the release team or the Kubernetes community in general, the release team like any other sub-project or SIG within the Kubernetes community has all the meetings completely open. So if you can, you can join in. You can ask questions and the like. And with that, I guess we now open the ground for actual questions about the webinar in 180. Yeah, so thank you both for that awesome presentation. We'll do a few questions since we're already a little bit over time. So there are a few questions in the queue right now. Let's see. A couple of people asked about concrete examples for things that could be done with cube cuddle debug. I guess, are there any concrete examples of things that could be done with cube cuddle debug? So one of the best examples, I mentioned this during the last slide is one of the best security practices that we have is if you're using a compiler language for your application or if you can just get a binary or a really small surface collection of files that you need to run your application in order to avoid actually having an entire operating system inside of your containers, please do that. For example, this is for distrubless containers coming to play. If you Google distrubless containers, you will probably come across a repository owned by Google, I believe. And the distrubless containers essentially just give you enough of an operating system. For example, they give you the basic CA certificates and enough tools to just be able to run a binary. They don't have a shell. They don't provide the opportunity, the tools for you to install any other tools or executables. For example, in Ubuntu, you cannot do something, you cannot do an app get installed, blah, blah, blah. And if you're using those distrubless images, you are more or less securing your application because now you have an additional barrier that is going to ensure that only your application is running, that no one can exit into the container and install something else that no one can inject any kind of traffic into that. And that is a good practice to follow. However, that makes it somewhat difficult to actually develop and debug your applications because now you cannot execute into your container and you don't have any tools to actually test your application or to monitor the state of the container. And the only, without kubectl the bug, if you actually wanted to debug your application while using a distrubless container, you will have to go back to your container image, a Docker file, for example, you will have to change from GCR distrubless to from Golang, Wanderthane, that will actually give you a Debian-like operating system, then you have to build your image again, you have to push it, you have to wait for things to redeploy. kubectl the bug is essentially a shortcut to all that work. And with kubectl the bug, you can just say kubectl, I have this bot, I want to run a Debian container inside of it. And as soon as I get that container in the same network, hostname, namespaces, then I can now install any tools that I want and essentially have your Kubernetes cluster serve as your local machine. And it's really cool because you can, just like when you run Docker and you specify the dash it flag to do an iterative, to get the console on the shell, you can do that with the kubectl debug command. It'll start on ephemeral container inside of your existing pod and give you a shell if you do the dash it. So you can do like kubectl debug dash it, run busybox or whatever Debian or whatever you want to use and insert it as an ephemeral container inside of my existing application to give you that extra ability to debug things that are running too, right? Like maybe you want to be able to look at this thing that's deployed without having to go through and rebuild the image and redeploy it and lose the state that exists already. The debug command allows you to use that ephemeral containers capability, get a shell into that thing and do whatever debugging you need to do. Awesome, okay, we'll do one more question. Can you shed more light on CSI support enhancements like block storage support, different cloud providers and performance benchmarks? So I would not be the right person to provide more insight to that. I think if you want to know more about those things, what I would recommend is that you join the SIG storage channel on the kubernetes slack and read through the enhancements proposals themselves. So I don't have a lot of the detailed information at hand. I would have to go read the caps themselves to try to answer any specific question for you out of those things. But again, the caps are like the source of truth. So anytime a change is going to be made to Kubernetes, it has to go through this enhancement process and that's called the Kubernetes enhancement process and all of those things live in kubernetes slash enhancements on GitHub, so github.com slash kubernetes slash enhancements. You can find all of the things that have been previously implemented, things that are proposed and are being iterated on like sidecar containers as an example. You can find all the things that have gone into previous releases there as well. When those things are merged and approved, they end up in a caps directory. So in GitHub, you can find in the enhancements repo, you can find all of the caps that have been merged previously and they'll give you more info. But if you have specific questions about direction or what the SIG is planning on doing with some more, it would be super, that's the best place to go. It's like the source of truth. Great, thank you. Jeremy and George, thanks for a great presentation. That's all the time we have questions for today. Thank you everyone for joining us. The webinar recording and slides will be online later today and we look forward to seeing everyone at a future CNCF webinar. Have a great day. Thank you so much for coming today. Thank you very much. Happy Friday all.