Okay, I think that's time, so let's get started. Hello everyone, my name's Grant Murphy, I'm a security architect at IBM. My contributions to OpenStack has mainly been through the OpenStack security project and I'm also a member of the vulnerability management team. So today we're going to talk about OS Query. We're going to talk about specifically trying to understand how it actually works and why it's useful for understanding the security status of a deployed host and then look at some ways that you can extend it and make it applicable within an OpenStack environment. So for those that were around in the last session, you probably know that there's a lot of monitoring events that occur in a large-scale deployment. So monitoring an environment and knowing that you've been breached is a difficult problem to solve. And I think these kind of figures are, you know, they really set, you need to have a good story basically as a software solution, which is where I think OS Query comes in. This was a project released by Facebook in 2014. It's released under a BST license and effectively exposes the operating system as a high-performance relational database. It's got over 130 tables at the moment and its support for Linux, macOS and Windows. So it's actually being used in production right now by these companies and they're also contributors to the upstream project. And I think that's really a testament to the maturity of the project and the strengths of the concept. So to kick things off, I thought I'd jump into a demonstration of what it looks like using OS Query in interactive mode. If I can figure out how to actually... Okay. So here we just have a Linux host and I'm going to fire it up in interactive mode. First thing you'll note is that it says that you're using a virtual database. So the way that the actual query interface actually works is it uses SQLite virtual tables, which call back into a high-performance native code. So the interactive console is very... for anyone that's used SQLite before is very... will feel very familiar, so you can do things like look at the tables, look at the schema of a table, and then you can execute queries. So for example, if I was to select time stamp from time, what I'd get back is the current time in the operating system and that's all executed at the time that the query is run. So to demonstrate why this is useful from a security point of view, you can probably already imagine that the ability to pull together a bunch of different tables of information and gather them together to make some insights about the system state is actually quite useful. But I've gone ahead and written an example malware. It's not really very advanced, but it basically is a remote shell that tries to... retains its presence on the system at all times, so it tries to exist between reboots. So the types of things and the behaviors that you'll see by this malware are that it connects to a strange host. Can we read that down the back? Just thumbs up? Okay. When it executes, it immediately deletes it from the file system and then starts itself as a daemon process and just basically loops around. Nothing really clever here. The way it tries to persist between reboots is to add an entry to the front table. And basically it just tries to make sure that it's there all the time. So to save me actually typing a bunch of commands here while you watch, I've written a little script that will show some of the queries that you might execute if you wanted to detect that particular malware. So this is just wrapping... Oops, wrong one. It would be the finding malware demo. Wrapping OS query I and executing query. So here I've decided to look for any remote host... Sorry, any remote address that is uniquely connected to by a process. Given that this is a dev stack instance that was running on my local machine, the address there looks a little bit... unsavory. So I might want to pull in together information from a couple of other tables and look at specific things about that process that's connecting there. So here I've done a join on the process OpenSockets table and the processes table looking for that specific address and you can see that it is in fact a shell that's connected to that remote host. Some other things that we might look for is indications of the system stuff that I was talking about earlier. So you can see there the debash command to try and reinstall the malware on that machine. And other queries that you can come up with, for example, the fact that it removed itself from having a physical presence on the file system, you could just run a query like this and set onDisk equals to false. And then we have an example of the supervisor process ensuring that it has an active connection to that remote host. But I think you will probably have the idea from there. So... But in itself, that's not really that interesting, right?  What is interesting from... in a production environment is you want to notice any changes or differences in your environment as they happen. So the way you can do that is by configuring OS Query D and you set a number of queries. For example, for that particular malware, you're monitoring the CRON table and looking for any changes to that might indicate a trigger alert and a logging event. So what it enables you to do is actually look for... basically do state-based intrusion detection. And it allows you to reason about the behaviors of malware, for example, in an environment rather than... or a malicious actor in an environment rather than looking for a specific file, hashes, or whatever. In addition to that, it's batteries included. It has a lot of great features. So you can do file integrity monitoring, process auditing, socket auditing. It has support for existing... indications of compromise in the YARA format, which is a format by a virus total. And one of the best things I think about it is it's so easy to configure, install, extend. And a major head and actually call out at the Austin sub... some of the features that... any security automation provider stack might have. And I feel that OS Query goes a long way to meeting those requirements. Okay, so the first thing I'll walk through is the query schedule. So say, for whatever reason you've decided, you want to monitor any changes on a particular host for the sudo group. You want to add this query to the query schedule. So this is an example of what the OS Query configuration file looks like. So all you have to do is create a new named query in the name of this one is sudo group. Slide in your query in JSON format and specify interval for that to run. The first time that it has actually executed what will happen is OS Query D will actually look in the underlying persistence layer, which is RocksDB. And the persistence layer is really used to maintain the query state between each execution of the scheduler. So the first time that it's run, it'll look for... execute this query and anything that was in the result sets will be appended to that persistence layer. It'll also generate logging events for each of those. So here's a truncated version of a logging event that's been sort of reformatted so you can actually read it. And you can see that it's been added. I should also note that in addition to the fields here, you can add custom decorators that annotate each log entry with whatever sort of additional host information that you'd like to. So in between a logging schedule window, I'll make a change to the system and add a user to that group, the user some guy. The only event that's actually transmitted and correlated out into my logging event management system is this one here. So there's only...what we're getting in and what we're detecting is stateful changes within the system. But you might be sitting there thinking, and I'm guessing because this is a room for security professionals, that what would happen if, you know, in between the first time the query is run and the next time, I was to add a user to that group and then remove them, would the change be detected? So to solve that kind of problem, OSQuery has a particular event framework in which you can define and it basically operates and it publishes a subscriber sort of module. So a good example of that is file integrity monitoring. In that, you have a publisher which publishes events and basically that runs outside of the normal query schedule. So you would have something using, in the case of file integrity monitoring, it's using iNotify to watch specific changes on the file system and then that publishes events to the subscriber table. And the subscriber table basically acts as buffer for those events and every time when you want to append that information into your logs and make sure that that is alerted on, that will actually get you a query to the subscriber table as you'll see in a moment. So this is an example of how you would configure it. So for the file integrity monitoring, what you need to do is add, select all from file events. Basically we'll retrieve all of the file events that have been published and picked up by this file events subscriber table and that will make sure that those get logged out. And then you can configure the publisher to look at specific paths. So to see that in action, what we'll do is tail, oops, if I could type, that would be good, tail the results log here, move all of that buffered stuff out. And to see that in action, we're just going to make some changes to those files within that SSH directory. So we're going to create a couple of files, change some attributes, and then remove them. And this is going to execute well within 30 seconds. So we should see those events turn up in the log file eventually. If I'm lucky. Hopefully, oh, there we go. I was going to say hopefully we don't have to wait the whole 30 seconds for that to happen. So you can see like, you know, each of the changes to those files was picked up, the fact that they were created, and you've got additional, you know, things there. But basically that's an example of the eventing framework in action. Okay, so in the interest, like say if you wanted to target a specific set of queries for a specific set of hosts, having everything in a single configuration file is less than ideal. So the way that you can distribute in a modular fashion a certain set of queries that you want to inspect on the host is to use query packs. Now, the OS query community has a number of these already, specifically around incident response, IT compliance, and vulnerability management. Clearly, all of these are sort of operating system-based focused and, you know, examining for abnormal behavior on the operating system. So if you want to enable any of these or all of these, basically all you have to do is go ahead and just add this section to your configuration and point to a specific query pack file. And if you wanted to write your own, all you have to really do is translate a query such as this. So you've been reading the security guide and decided that one of the security checks at the end of the identity section was something that you wanted to monitor on. You might use a query like this and just wanted to see, you know, what the file permissions are of the configuration files for Keystone on a regular basis. If you want to turn that into a query pack, the way that you would do that is simply... Well, there's a couple of things to note here. Apart from just adding the query as you would for a normal thing, you want to add to the schedule the discovery sage. So the discovery sage is making sure that a query pack is actually executed when it makes sense to execute it.  You can also make queries platform-specific and dependent on specific versions of ByWest query. Additionally, you don't always have to... always have to do differential changes. So here I've set snapshot to true and by doing that, effectively, every time that query is run, the entire result sets will generate logging events. I said earlier that one of the best features about OS Query is how extensible it is. So it's possible to write custom extensions for how it's configured, how events are logged, and even custom tables. Most of the examples that you'll see online are actually in C++, but thankfully for the OpenStack community, there's a project called OS Query Python that makes this really, really easy. The way that extensions work effectively, they run as a separate process and interact with the OS Query D and OS Query I extension manager via a thrift interface over Unix domain sockets. So as an example, this is probably the most brain-dead example that you can give of how to write a custom table. So you can see how easy this is. I've basically had to inherit from a table plugin to find a name method that returns the name of the table that's going to show up and also the columns that are in that table. And then the generate method is actually what does all the work when a query happens. In this case, I'm returning static values, which doesn't really make a lot of sense, but there's other things that we can do that are more interesting there. So I've sort of been playing around with this a bit and I feel like this is an interesting way to look at the security state of, you know, on a host that is running an OpenStack service. So I started playing around with some of the tables that might be interesting to look at. There's a lot of opportunity to do more than that and obviously there's a lot of operating-specific sort of queries that you'll be interested in running in production. So let's take a look at some of the things that I put together. Okay, so first, one of the things I thought about, well, the first thing I should do is start, I'm going to start our query in interactive mode. So if you were using this in production and you had a lot of custom extensions, they can be automatically loaded for any time the process starts. But just for the purpose of the demo, I'm going to start these manually. So the first demo I have is just using the SD, OpenStack SDK to communicate and present that information in our query table. So here's the example table that I created for Keystone and it's pretty much the brain-dead sort of stuff that you can get from running the OpenStack command line prompt. And I mean, clearly this is not really that useful from an intrusion detection type purposes, but it is just an example of the kind of thing that you can do. So after I've started that table, we should be able to see here a bunch of Keystone tables have been added to the potential ones that we can query. And you can query them as you would expect. There you go. And I guess that is the kind of thing that you can do. The next example I had was OpenStack configurations. So one of the artifacts that come out of the OpenStack security project is security notes, and often they're based on particular configuration scenarios that might be impactful or have a security impact on a deployment. So to be able to monitor or look within your environment for specific settings is kind of useful. So if we start that one up, do the same sort of thing so that did not work. Ah, thank you. There you go. And you can see I've used a secure password to connect to my Rabbit MQ there. Pretty nice for a security presentation. But there you go. Like I say, you might be able to write specific rules to detect OSSN in your environment. And the last one is because I'm interested in vulnerability management is basically looks for the versions of Python modules that are loaded by default within the Python environment and tries to fingerprint them. It also looks at, see, you can also query OpenStack versions from the installed... that are installed on the system, so OpenStack versions.  So the idea here is that you could probably take OpenStack security advisories a step further and generate rules that would be detected by the effective version range. But that's really... As far as I got with custom tables, I think there's a lot more you can do there. So that would be the next steps. Hopefully by now you sort of got an idea about some of the sort of things that you can do with OSQuery. There's a lot I haven't talked about, like the way it can be extended, the different logging mechanisms, the way it can be centrally configured. But basically what I wanted to do in the next step sort of move is look at how we can convert some of the value that the OpenStack security project create and unlock it from, you know, the documentations and the mailing list sort of work and use that to actually make it easily consumable by operators and, you know, turn up on their log management sort of dashboard when something unusual happens. So some of the ways that I think you can do that as already mentioned like the effective versions for OSSAs and maybe even looking at sort of certain behavioral indicators of compromise. Major and Hagen, I actually talked in the last session about the crown jewels so you could actually add a lot of tables around what's connected to, you know, your RabbitMQ instance, what's talking to it, what hosts are talking to it. That kind of thing would be easy to add as an additional table. But I mean, yeah, that's kind of all I was going with for that. I think it's a great platform. I don't know if I've sold it very well, but I think it provides a solid automation platform that you could use in an open stack deployment to monitor the security posture of that system. And I think it also meets the requirement of performance and it's very easy to configure and tune the performance so it doesn't actually have any impact to the control plane or any operational workloads. Okay, I'm going to stop there. If you have any questions, feel free to ask them now. I put the code up on OpenStack Barcelona on my GitHub. And yeah, thanks, otherwise.


Craig, you've got anything more to say about how the case is progressing. We're waiting for the decision on whether a cross-appeal can take place. What's happening there? Yeah, I think that's the important thing to remember, that Julian hasn't actually had his appeal against the decision to extradite yet. The only appeal that's been held was the American appeal against the points, the health points essentially, on which it was specifically decided not to extradite. Julian's appeal against extradition is still awaited, and that will shift the courtroom focus back again onto the fundamental questions of human rights and freedom of speech on the abuses of process in the case, the fact that the American government was spying on Julian's legal conferences, that they obtained all of his legal documents from the Ecuadorian authorities after he was removed from the embassy, on the fact that the extradition treaty under which it's being extradited specifically states there should be no political extradition, are numerous other points of appeal which are yet to be heard. I should be very, very surprised that the High Court doesn't agree to hear that appeal, so we have some time to go. But the problem is, of course, that all this time Julian has held in dreadful conditions of the maximum security business, so to some extent the process is for punishment, but the process still has a long way to go. Well, this isn't supposed to be a political case, but how likely is it that the US or the UK wouldn't want some of those matters to be heard in court? I think it's going to be very difficult to prevent the court. It's very, very hard to see an argument that the High Court should not hear the appeal, because, plainly, there are points of appeal on which the legal principles are quite a high magnitude to be discussed, particularly the right to confidentiality of legal consultation. And, of course, the entire principle of the application of the extradition treaty and all its provisions under which the application takes place. The UK government's viewpoint is that there is nothing in general that prevents the UK government from jaking international law, in its domestic law, that an international treaty doesn't bind the UK in what it does internally. And even if you've said that, it's true, and it's a very bad thing, but it is true, but the British courts have always held that the UK government is not bound by external treaties, whether that can be said to apply to a treaty which is the operating instrument under which the extradition is taking place. And it post-dates as well, doesn't it? Wasn't it 2007 the treaty, but the Actors earlier? That's true. It does indeed. And before that, no political extradition was specifically included in the UK's general extradition legislation. But I know all of this is bluntly nuts. Julian has been charged for espionage by a country, and he hasn't been near that country at the time of the offence or since. He's an Australian citizen who's operating outside the United States. So how he can be said to have committed an offence within the United States? Even though, considering the extradition at all, the United Kingdom is admitting an extraordinary United States claim of universal jurisdiction. There's so many legal points which are just completely wrong in this case, that it's very hard to believe that the High Court won't hear them. And I basically believe the High Court will hear them. That doesn't necessarily mean we will win. I don't think anybody who believes that in political cases like this, the courts are genuinely independent. It's extremely naive.


The COVID-19 pandemic has caused a global shift in the way people live, work and interact. To help mitigate the spread of the virus, face masks and respirators have become essential pieces of personal protective equipment. Research into new materials and designs for these items is ongoing, with the goal of creating more effective and comfortable products. Additionally, novel technologies such as artificial intelligence and low temperature plasma are being explored to further improve the effectiveness of face masks and respirators. This article was authored by Chris O'Dowd, Kierthi M. Nair, Parnia Forzanda, and others.


varios.        ,   ,  ,   ,       ,  ,   , , , , , , , , And improvisation, as we understand it, is a way to react effectively in an unexpected situation. And the way to react effectively in an unexpected situation is to remain calm and stay present in the situation, not get carried out or not get nervous and things like that. Or angry. And the way to learn that is to train. So as the same goes, practice makes perfect. So we are going to train a little bit here. We have only like half an hour, so it won't be very big course, but maybe we'll get some rest from the other presentations and we'll move a little and we'll see what we will do. So we will try several improvisation exercises here to, in those exercises you will be in situations that are unexpected, or maybe a bit unpleasant, but only a little bit, but also we'll play some games to train our preparation for the unexpected situation in the world.  So if you could each of you and us to just say your name and then add one interesting thing that happened to you on this conference so far. So my name is Petr, and interesting thing. Yeah, when I was yesterday, when I came here, first I discovered that there is a T over there, then I discovered that there are some little pieces of bread, and in the end I discovered there is also a Sue, so it was like gradually better for me the conference because there are lots of food. So I'm Hanka, and today when I was looking for Petr, I kind of received a message saying you know where to find me, so I went to the food point and there he was. So your name and something that happened to you. My name is Cheta, I'm living here in Brno for about a year now. I attended this conference last year and met my friend Mike who we had seen in Finland two years ago, and just having a short chat with him, my wife finds a job in Red Hat, so it was a very nice thing to see him again today, and it's with him. Yeah, I'm Mike, I'm from Germany, I work for Red Hat, and this is my fourth time to attend a conference in Brno, and when I went to the city the first day this time, I saw this new post which was signaled 30 years after, and I liked it a lot because I had heard the tourist guide last year talking about plans to react this, and I was very surprised that it's actually there, and I think it's so nice. Hey, so my name is Liid, and the best thing at this conference for me was that I gave a talk yesterday, and in the middle of the talk I started to talk about some topic, and died from the outbreak, and I was like, hey, there was exactly my question, and it was a very good question, I was like, yeah! You definitely nailed it! And maybe the most interesting part for me was yesterday's question of finding my goal, because it was like, oh, this is number five, oh, we have just started like this, and it was completely in a different place, and it took 15 minutes to find, and it was like this. So, hi, I'm Mayaku. Yesterday I also had a meeting with a friend, I met a friend that I didn't expect him to be here, that he worked in the same company, and it's a good thing, the good thing is that yesterday Vaikai was working just fine for me, and today it just sucks. All right, thanks. Now I'd like to get our brains working and get to know the names a little better, so if you could please all stand up, and we will be in the room, please introduce to each other, and in a specific way we will be exchanging our names. So, in the beginning I have my own name, I'm better, this is Hanka, and I'm going to introduce myself. Hi, I'm better. Thank you. Now I'm Hanka, and she is better. Okay? Let me come to you as I'm alive, and I say, hi, I'm Hanka, and I get another name, and we will be exchanging names like that, and when you meet the two names that are the same, it means we made a mistake, so you just say, oh, we screwed up, and we'll start over, okay? So now everyone starts with their own name. I'm better. Okay. Are you sorry? Hi, I'm better. Hi, I'm better. Oh, he too, I've been... Oh, I haven't said anything about who I am. I'm bigger. Okay, so I'm Hanka. Hi, I'm better. I'm majoring in 2019.  Who is who now? Let's try to do the check. I think I need V. No, no. I think I need V too. One more time just to get a break for a little more. So I'm better again and let's go back one more round. I need V. Nice to meet you. I'm Meku. Nice to meet you too. I've never met you before. I'm Chita. Hi, I'm Meku. Hi, Mike. Hi, I'm Mike. Hi, I'm Chita. Hi, I'm Chita. Hi, I'm Meku. Hi, I'm Chita. Hi, I'm Meku. I remember it. Hi, I'm Chita. Hi, I'm Meku. Oh, you just split new couples. So Meku will join you and my main couple, please. Don't be scared. So now, in the couples, we'll practice associations, which will be the same words that just come to our mind, just to get our walls down a little bit, just be spontaneous and say what comes to your mind. And in the couple, imagine we go back a long time into the old ages when people were still killing each other with just pieces of wood.  Just enjoy it, okay? Now, I'm beating Hanka and with every strike, I am saying one word. Just what comes to my mind, just I don't know, car, wheel, driver, bus driver and anything. I just go. And when I stop, when I can't say anything more, that's Hanka's time to take revenge. And she started for me. Get animal dog. I don't know, sir. Yes, a computer. And we go like this, okay? So when you are beating, you just wait for the opportunity and then go for the other one, okay? So let's try new couples. Just the same starts and then go for it. Door likes four. Door likes four. Okay, I'll smile. And don't let your share be eaten, just run. Run from the bus and then we'll be beating you. Like the lunch. The food. And you're very funny. With a smile. A sun. A hamburger. A bee. A dog. A tree. A slaker. A cow. A cow. A dog.  Sarge. Seasons. Those who are taking pain protection, you know, just run. I certainly am. My name is C. My child is not orange. Where am I? He was born in the 18th century. So, hotel room, bed, shower, bathroom, bed. I wanna see. It's such a peaceful way of communication, right? Everything else? Somebody's hesitating whether he should come inside, so he's trying to frighten him in. Would you like to join us for an improvisation workshop? We're just starting, we're doing some improvisation games to get in the mood and be prepared in unprepared situations, nice but in situations. So you can just tell us your name, so we know. Yeah, I'm Tim. Tim, great. Tim Maokhan! So this next game is is called Speaking caves. Speaking caves please make different pairs. Okay, cool. So the thing is, when we did this association game, we will do something similar in the whole sentences. We agree with you, right? Speaking of agreeing, you know? I think you got the idea. So the task is to interupt each other as many times as possible. Okay? So... We start for... Just speak, talk. Thank you, friends. Talking about this, that isn't very nice either. And it's true that we are all friends. We're always nice, we're friends. But you can go... You can go... Yeah, well, I hope that it was... My friend... Speaking about friends... Yeah, I met my little friends here. And she's the other friend of mine. And I met her the rest of the room. So we're all friends. Speaking of company... Yeah, well... Any... Yeah, I think you got the idea. Yeah, I think you got the idea. Don't worry, we'll interupt you whenever you feel better. So the company will work with three companies. We'll see if they do us. We'll see if they do us. Speaking about new projects... It's the potential of big data. And big data as well. We are making so far so... Speaking of big data... So... Here you always started... I didn't get to talk about other new things. Yeah, a lot of new things. And the thing... You have to always learn new things to improve your skills and to... Actually, all things...  You must be in a good party this... And... We will interupt things. Yeah, it's new wonderful things. Everybody is like... New girls are everybody. Everybody is like... Everybody is like... Everybody is like... Everybody is like... Everybody is like... Everybody is great. Everybody is wonderful. We will interupt things. Actually, it's one of the most... Of the presentations from... Speaking of Microsoft... We had the opportunity to organize in that sense. The last time we had a Microsoft guy from a teacher... Speaking of the... Clouds... And new... Overload movement... And new things to be... There are no outside... Outside any wonderful letter... Yes, we came over there. We are back to it. Speaking of stopping... Well... Well, it's... I don't call it... Okay, sir... It's easier for you... How do you call it? So not to listen to somebody. It's interesting so you don't want to interupt. Just there was no point in this discussion. Because we never finish living. Every time... Surrounded only from... Yeah, from... Like... Maybe there are clouds, do better clouds. And then from... Then to weather, I kind of... We started with weather and... In the middle of our... Association together. So... Why don't we change course one more time and try it once again? Just see how it is with this... It's on person. Try different combination if possible. Same... Okay...  It's very rude to help me. So this is the one time you can do it. My father always asked me this. Father, don't speak about me. It's not real. And it's such a... If you can say about it then... You should prove that I mean.... It's a... I know... I know so many things, you can't imagine what I am... I know... I know... I speak about technology for you. And you can use what I'm saying. Yes, your father may be... Your father may be... Yeah, I know what you're saying... I know what you're saying, We will move on to another activity. We really don't have a name for it. But it is a form of public speaking. But there are various types of public speakers. For example, I will give each of you two a piece of paper. And there will be different roles. And you will be speaking in that role. You will start and finish it whenever you want. But you won't tell us what your role is. For example, there is a CEO of a big company giving a resignation speech to his or her employees. But before you do that, you will try to order us in the right position. It's really hard to sit here. Maybe you can use it also in all these chairs, but they are not movable. It's not really possible to do everything. But at least try to arrange others in that arrangement you need for this role. And when you do, start your role and then end it whenever you think it's possible. And just whatever happens. So for example, if I'm going to be a CEO, I will say, okay, so maybe can you use it? And you will sit. And I will start something. Okay? Well, you know, I think I did a great thing for this company. And I feel that my wife will be great CEO as well. It's a dead giveaway. Right?  People know for sure you are a CEO. Yeah, you can choose whether you are going to say it or not. It's up to you. But it's usually obvious. I understand. Try to guess what is your role coming to what you do. So please, choose two. Two? Sir, you can take turns. Is there any problem to you? Yeah. Okay. Who knows it? So please, arrange us. Please, go into the audience and stand in ovation. Okay? If that's what you want. Yeah, like, you don't have to go somewhere too far. And the ovation is a surprise that I was aware of. But fortunately, I've prepared my small speech. So I want to thank my parents. I want to thank my wife. I want to thank my children's. I want to thank my teachers in the grammar school, my school, university. And I want to thank my fans. And so it's really great pleasure to be here. And I'm really delighted to receive this award. So thank you, thank you. So what was it? Try to guess. We must have got an award for writing or acting. A noble prize. Yeah, for acting. It's thanking after winning piano score. Who wants to go next? Okay. So you can make a seat. Yeah, so please sit. So, today is Saturday. Okay, imagine it's Sunday. And we shoot in the wrong way, but okay. Our God is the best thing in the world who gives us life, who gives us feelings, love, everything we have. So I ask you today, this Sunday morning, to be grateful for what you have. If I can secure chair to give out. For the life we have, to be grateful for that and think again about human being. It's supposed to be longer, but I think it's quite enough to give out. So any guesses? Amen. Just choose of the two which one you like more. You will perform more. Well, we will get to both. So, what shall we do? We should be arranged. Yeah, you can stay like that. So I can tell you, we spent some time together.   And we will let them take our freedom or our land. It's supposed to be general before that. Now. Arrange us. I think that you can stay soon. We are here to discuss the big proposal which can have a very big impact on our country and how society will evolve. And you know, to reduce some crime, get a better education for people and to really make lives in this country better. I know that we will need still some comments and amendments, but I think that we are on a good way to be really, really the greatest country in the world. We'll just put it on, talking about the long build. Nice. Why don't you wear on the... ʕʕʕʕʕʕʕ ʕʕʕʕʕʕʕ ʕʕʕʕʕʕʕ ʕʕʕʕʕʕʕ You can come all around. What you see here is a dead body. Please give him immense respect, because if he was from a wealthy family, he would be dropping in a coffin somewhere, but he has donated his body for medical research, and all of you are able to see his body and see his innards and discover more about what the human body looks like. So this dead body... We are standing on this model of the city, and we can see that this model is supposed to be a symbol of foresight, because this part of here is a church, and you can see that the roof of the church is taken off because the roof is there, and it might burn. You can see to the bone, and so the general opinion of the city was very careful in doing the best work to do the end of the switch, and the medical was successful. We have about 5 minutes, I think, before the start of the lecture. So please make a couple of months more for the last time. Just try to go with someone you haven't been if it's possible still. We'll do exercises, I warned you, and before it's a little mind-fuck, so be prepared. And it goes like this, it's called Have You Heard Off? And one of you is in the role of the person who wants to tell the other person about something that happened, and I start like this, and Hanka will again interact with me and say something. Hanka, Have You Heard Off? Yeah, about the time we had terrible hangover. No, no, no, that's not what I mean. I reject it and start over. I mean the other thing, I mean... Yeah, the time we went to the zoo and saw the big monkey. No, that's not what I mean. I mean the last thing, I mean the...  And the way we are going to do it, one person is saying like, Have You Heard Off? and three times, the other person gives him something else, and the first person then has to connect all the three different things to a story. So in this example, I will be the one to connect in the stories. Hanka would tell me one more and I will then say all the three. You'll just change your roles after you try it. Yeah, so one more to connect all the stories. We'll show it once more, okay? I'm saying have you heard that I'm connecting with stories, right? Yeah, I am connecting with stories. I messed it up. Yes, you did. So, first time. Hey, Hanka, have you heard of... Yeah, the time we went to the zoo and saw the monkey. No, no, no, that's not what I mean. I mean the other thing. Yeah, when we went to see your mom and just... No, no, no, I mean...  Yeah, I know what you mean. The time we asked... Yes, yes, yes, the time we saw my best friend, my mother on the way to the zoo. Yeah. I'm writing that. Sorry. All three together. Yeah, all three together and make the one story. So... If we do the unraised things and make the one story. Okay. Let's go. One person can connect and then switch the... Yeah, very well. Okay. How can we... Okay. ...do the unraised things and then make the one story. Yeah, it was like... I still didn't want to be and it was very... I don't know... I hope that... Yeah, it was about... about... Who missed this presentation? No, no, no. It was exactly that. It was on the other person. The one story. I don't know the time. I don't know the time.                                                                                . , the shlaring very good me It was more difficult to think about three different things or connect them together. I think think of three different things. I was just thinking that the way that you can connect them out of it in the end. Maybe it wasn't the wrong way. It was more difficult to think about unrelated things completely.  I don't want to talk about it. Well, we'll have to end in a few minutes. Thank you that you came. Usually when we do such workshops, it's for several hours. University is a course for the half years. It was just a little bit just to show you as free. It was also just students improvisation workshop. So, thanks for coming. And we have this. We can be here also when we end and talk about it more. But there is a next session starting soon, so we probably have to move.  Just imagine you have like between your hands, you have like a giant rubber band, you know. And all of us, we will push it together up. And our goal is to clap all at the same time. And no one is the leader, so don't forget me. Just to watch each other very carefully and clap at the same time. Thank you guys. I hope we at least woke you up after so many lectures. And since then, it's been a bit of a bit of a week in general. I don't think it's going to be. The improvisation techniques are in improvisation theater. And this is more of a way to be relaxed. And when we are about this speaker, to be relaxed and giving a presentation. And to be more assured of yourself. Twenty different reactions. Not everyone in the conversation begins to get many reactions. So we should be doing it right. Like in front of each other. Just to let you know. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. It's very difficult right. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. So, in a large group, 14 people, 15 people didn't react when they heard it. When you showed us my direction, according to my teammates, ḣᵇᵍᶀ ḣᵃ ᶴᵎ ᵇᵃ ᶜᵍᵃ ᶔᵍᵃ ᶜᵄᶦᵗ ᶤᵃᵉm ᶠᵍ ᶠᶦᵃ ᶮᶦᵃ ᶜᵇ ᶠᶦᶦ ᶜᵃ ᶗᵃ ᶠᵃ ᶜᵃ ᵘᶦᵃ ᶜᶦᵃ ᶜᶦᵃ ᶜᶦᵃ ᵘᶦᵃ ᶜᶦᵃ ᶜᵃᵃ ᶜᶦᵃ ᶠᶦᶦ ᶜᶦ ᶜ ὒ ὁ ὂ ὃ ὦᾆ ᴟ lengthy por tu.  I think it was a really long technical presentation for 40 minutes. I think that you wanted to cover so many topics. I knew I wasn't going to finish it, so that's why I had all the notes. But I talked too quickly, I know that I get too enthusiastic. That's why I reduced my talk for the other or less. But I'm trying to, I've been playing around with how much I talked the last few times to try and adjust myself to what works for me and trying to not work so much. So nice. Good morning afternoon. It's about time, probably people will start coming in. Doesn't matter. Today we are going to, I'm going to show you how some of the deployment patterns that you can use in a container application platform. That means OpenShift. This is the OpenShift track. We are talking the whole day in this room about OpenShift. And the first thing, I'm Jorge Morales from Spain. I work as a developer advocate in the OpenShift team. I usually, I do some other things in the team. And now my team is coming in. They asked to watch me because they think this is going to be interesting for them, which is not. First thing, because this is an OpenShift talk. Most important thing is to set the expectations for the talk. That means that if you know about OpenShift already, then it's fine. If you don't know anything about OpenShift, probably I will be talking about concepts. OpenShift concepts that will be boring to you because I'm not going to do an introduction into OpenShift. So this is the time for you, if you want to live, if you stay, just stick to the end. Okay. Some of the concepts. In OpenShift, what we do is deploy applications. Usually they are deployed in something called pods, which creates a unit of your application and provides with IP and resources and storage. And everything that containers provide. That means that a pod is one container or a set of containers shipped as a single unit. And that's a Kubernetes concept. Everything that's in blue in this slide is what Kubernetes provides to OpenShift product. And everything else is what we build on top of Kubernetes. When you deploy your pods, you need to access those pods. Why? Because at the end you want to deploy one or multiple instances of your application to be able to access all those instances of your application. There is one thing called a service that is a single point of access to your application and will abstract you from where the application is running. When you want to access those applications from the external, you will use a route. That means that you provide with a DNS name for accessing your application and through the services it will get into the pod every request as a client. We're using an internal SDM for extracting the networking for the pods so that pods can come and go in different hosts and it will be transparent for you. And then there is the replication controllers. There is a different set of controllers, but I'm going to talk about replication controllers.  This is the container or set of containers that will be running or that will be part of your application. On top of that, OpenShift provides the concept of a deployment configuration that wraps a replication controller providing you with the number of instances of your application that you want to run. Probably you want to make it reliable or scale it. And also provides with additional information like triggers, what will make your application change from one version to another. So if something is triggered to that deployment configuration, a new version of your application will get deployed. This is really important because we are going to be talking about the deployment pattern. So the most important thing that we are going to talk about is things that can be done with deployment configurations. There is also bound to the deployment configuration, one concept that is the strategy that will use for moving your application from one version to the next one. And then the rest you can just skip it. The deployment patterns. The first thing you probably need to know is how do I deploy my state-led application? What is a state-led application? A state-led application is something that doesn't need to have some state. That means that I don't require to persist anything to this because if it fails, I can just spin up a new instance of my application and it will run the same way as it had before. So a good example is a web application. I have my web application that I can just deploy into OpenShift. So for that, this is a diagram that I would use for the whole talk which tries to model an environment, an OpenShift environment, a hosting environment where you have multiple nodes where your application will be running and I will be showing how it will behave when a node fails, what will happen with your application, how would you move from one version to the application to the next one and what things you have to do or you have to change in order for that to happen. Then we have different parts in this diagram that are in green. I'm sorry because there is a lot of light and probably you cannot see the diagram very well. But you'll see that these green parts they will have some meaning but it's mostly related to what I just explained. The service layer. That means how we access my applications if I need to create a service for my application then the routing layer if I want to provide or expose my application to external consumption and then there is the persistence layer. So if I need to have a persistence service or a stateful service which we'll be looking at in a moment I think you have to press for one. If the persistence layer where we will be storing our data in case we have the stateful services and also registry because our containers will be doctor containers every time we create an application it will be storing the registry and hopefully it will get that image from the registry and deploy it into your environment. So the first thing you need to do for a stateful application is create a new deployment configuration same amount of replicas or instances of your application that you want to have in this example I'm using three and I'm deploying just a web application. So it will deploy three instances my replication controller this is a controller that lives in the master server it will just make sure that you have three instances of your application up and running. Then we create the service to abstract where those instances are located why because these nodes for you are unknown where they are living they can move from one node to another in case of failure. So we create an abstraction layer so in case we want to access our application you don't do it directly to the instance to a concrete instance but you go to an abstraction layer and then you have also a routing layer so in case you create a web application you want consumers to go to your web application so you provide with a DNS name like web.example.com through the normal web client to consume your application. What happens? That's a status application we'll see if it over after once. Stateful applications is an application that requires persistence somewhere why because if my application goes down and then I start a new instance of my application I need the data that was in there to still be there accessible to my application. How do we model this in OpenShift? I am using an example where we have a web application but this application is using a database for storing this data. So at the end what I will have is two different types of set of applications I will have my web application and I will have my database the first thing to do is if I need to persist my data in an external persistence storage I need to create a persistence volume to provide with the configuration for the amount of data where it will be lived where it is external an NFS server Cinder, Glaster, whatever type of storage you have available in your installation Once you have your persistence volume you create your database you create a deployment configuration the amount of instances that you want you want a highly available database so you have now two instances of a highly available MySQL up and running and using a shared storage that means that you can fail over from one instance to the other seamlessly so if one node goes down you will still have your database up and running to access that database you will always require a service how do I access my database why? because as I said database or pods can come and go if something fails it will just spin up a new pod somewhere and then because I am going to access my database not from a client but from a web application what I do is create my web application and link it to the service so I will link my web application to my database this is done through environment variables so my web application will have some configuration username, password, whatever configuration I mean my web application in my toncat I will set some configuration to access that database so I will set these credentials and I will point it to the service so my web applications will go to the service through this service abstraction layer that means that my web application will be able to connect as long as I have one of the instances of my application up and running to expose this again for external consumption because we are talking about applications that we want to make accessible you need that service and you need that route when we are talking about stateful applications and we are talking about an immutable infrastructure one of the biggest problems that we face is how do I create my database how do I load the initial set of data that I want in my database we want to have a set of reusable images my SQL, whatever that will be the same at the end is the runtime but it will be different for each and every user that uses that runtime every application will require their own schema so one thing that you need to do is to once you have your application create that schema on top of the application how can we do it if I can create an image that it will be only suitable for my application if I have a different type of application because that database has a certain schema I will have to create a different database with a different schema when I am talking about a different database I am talking about a different Docker image or you can have that schema creation offloaded into an external persistence volume that means that I have to guarantee that some way I will create the schema the data files in the persistence volume and the database just will connect to that data files in that volume you can also use something that is called post deployment hook that means that every time you have to ship with your database container one script once the database image which is generic it is deployed it will run a script that will do something in this case create the schema at the end it has one drawback which is that this image this database image will have to have the script also in the image itself so at the end even if the image is very useful or you can have multiple scripts the script has to be embedded into the image there is a different pattern there is a different controller that we are shipping right now in open ship that is called a job a job it's something that you can run once to the end one instance up to the end so I can just create one job that it will have the responsibility of creating or creating that schema for you so I have my deployment running without a schema I can run a separate process of the job that it will run create the schema and die the good thing is that you are not binding in any way the schema to the database so that this makes a more reusable process of configuring your databases or loading your databases or you can have it of course application loaded that means that there is different types of application frameworks like hibernate or different type of languages like pearl that when you start your application because the schema is in some way related to the application it will just create the schema for you in the database now that we know what different types of applications we can ship so there is a stateful application or a stateless application of course with these patterns we can go the full microservices type of application the stateful both of them suit very well for microservices they also fit very well for legacy type of applications the only constraint with legacy type of applications right now with OpenShift is that you will have to stick these applications to certain nodes that means that we currently don't have the ability to stateful or legacy applications to orchestrate them so they can move the applications legacy applications even if they are not cloud ready they can write in OpenShift what we are working is into making also your applications which are legacy and which are not cloud ready to be able to move and be cloud ready by the platform this is something that will come during the year through something one of the talks that was mentioned it's called Petsets deployment strategies how do I deploy or update one application from one version to a different version once I have my application usually this is there is different types or ways of updating your application whether you are working in development or you are working in production usually you will not update the same way in different environments because you want to keep in production or in testing you want to preserve database data in development maybe you don't want to preserve the database data because you are developing you can just wipe out the database and create a new database from scratch so with deployment strategies with the deployment configuration there is you instruct whenever you deploy something into OpenShift you instruct how it will move transition from one version to the next deployment configuration about your applications is because your application will be running in a container which is immutable once you have created a container it will be like that and it's the one that you will be moving from environment to environment the only thing that requires for you to go from one version to the next one or rollback is just spin up the oldest version of your container you already have it in your registry so it's just a matter of moving back and forth so deployment configuration at the end it's the different versions it will cycle your application if I do a deployment and something happens I can rollback to the previous deployment and in fact the platform will rollback for you if something fails so we have different types of strategy out of the box we have the Recreator strategy which is really easy I just throw out whatever I have and deploy it again that's as easy as wiping out the previous version and then wiping in, sorry by the colors because there is not much time I have three new instances of the new version of the application this is Recreat, this is usually used more in development why because, yeah so the containers will be stopped deleted and then new containers will be created so because when you create a new version of your application you'll have a new version of an image so let's say you create an image version 1 and an image version 2 moving from one version to the next one is just kill the old containers and spin up a new version of the containers going back it's as easy as killing those containers the version 2 and bringing up version 1 containers why because you still have them there you have all the configuration that was required and of course in this type of pattern you are not carrying about database you have to, the only thing that you need to take care in OpenShift is when you are moving applications with the data for the application itself it's really easy, when you are moving database from version to the next version then it's more complex because you have to think that if I go forth then if I roll over how will I roll over that database, once I have that database so you have to take care a lot when you are following these patterns for databases, stateful services or this type of deployments we are working a lot into providing capabilities for allowing database to be also easily transition from one version to another and they will eventually come with the platform but of course that's something that it takes a lot of time, you have to look at all the different patterns rolling deployment canary releases, we do deployment, we move from one application 1 to application 2 in a rolling fashion, that means that set amount we put a new amount of the new version 2 we take out a certain amount of version 1 that means that we will not lose our service at any point our application will be up and running and it will be accessible at all the time of course your application needs to be compatible that means that during the time that your application moves from transitions from one version to the other if the application if the database schema is different you will have to look into that how to move that, so this is the example is really used or I'm showing it's for a stateless type of application transitioning good thing is that we are doing canaries what is a canary release a canary release is when you want to move one application to a new version of the application but doing gradually and in that time that you do the rollover of the new version you want to look at what's happening so if something doesn't go well roll back but not the whole application maybe you want to do one by one check that everything works fine you can do something and it takes time so that's why rolling strategy has more configuration than the previous one redeployment redeployment just drop the old really rolling over how will I do the rolling so I can structure what will be the update period of my application to move so in this example I'm moving choose one to the next one any traditions in the slots and it's happening every day that means that the new version or a new containers of the new version will come I will have one day to check if everything goes fine and if everything goes fine and I don't stop or cancel the deployment it will continue to move and then of course if it fails on the redeployment it will roll back automatically but this is when you are doing canary if you put a long update period of seconds what you want to do is have your ops looking into the behavior of the application and then there is the max search and max unavailability that instructs which will be the chance of application that I can exceed of the new version and that I can live without the old version that means that the amount of ports that it will bring over before carrying down the old version you can specify in percentage or you can specify in amount so that means that you can say okay do it one by one do it if I have hundred of applications just move 25% of the applications create a new version it's really it's better to see with an example this is one by one so what I do is create a new instance of my new version and then once I check it will delete the old one new one delete the old one a new one and delete the old one I'm moving in this example I'm only transitioning the stateless part of my application I'm assuming that the web application it will work the same with the database when if you want to talk about I'm not showing in this talk because it's a very short talk or probably and I'm not showing about transitioning databases but if you want to talk about in that pattern or if you have want to know how we can propose it just come on ask me after the talk blue green deployment does anybody know what is a blue green deployment what is for I have swag what it's you have two instances of your application one is live and the other one is testing environment and we go to switch that blue because the blue is running or the green is running and then when you switch to the other one you switch it goes live and then you have the other one testing it's not only meant for testing of course it can be used for testing and there is one pattern that is not used usually for testing which we will see later it's also to be able to provide some guarantees or some predictability that the new version of the software it's good that means that I will have at a certain point both of the applications the blue and the green that means version one and version two of the applications live and I will be able to switch really fast between both applications so I will deploy the new application once the application is deployed switch to the new version of the application if something goes wrong it's just a matter of changing the routing or how I will access my application and it will be a matter of seconds going back to the previous version while if you do if you have to do deployments it will take the time to deploy your application your new version of the application to transition from one to the other of course it doesn't work in certain scenarios for every scenario so if you want to access the same database it has to be compatible you need to know that both of the applications will be accessing the database so there is certain considerations that you need to look at when you are doing AD how do we implement AD? we have a deployment configuration of three instances of my application which is version one, it is the blue and I have a service I have the access to this blue application and a route because I have consumers of my application accessing the clients of my application accessing them what I do is just create a new instance version two which will consist again of deployment configuration and a service and once I have both instances of my application with the service abstraction layer being able to access my application what I do is just change my routing so my routing before was pointing to the service my application blue and now it is pointing to my application green that's a matter of one single command that it will change your routing and it will be instantly if whenever you do blue grade deployment if something goes fine you will maintain the green but if something goes wrong you will maintain the blue and you will be able just to remove the green deployment and just create a new version and she will be whenever you are ready for it next pattern A.V. testing so during the routing it is still on the all kind of switch during the roll over okay since it is rolling it takes time right yes so you have a one application you have a just going to be in another so on the usable level if you do it by default with one service what it will happen is that your application will be accessing your new version no sorry your old version usually and when you want to do long rolling deployment of your application you mix this pattern with A.V. or with A.V. testing that I was going to show so you create a new service to access your new version of the application so you can test it if it is a long roll over if it is a short roll over what it will happen is that it will create a new instance it will just move the deployment of your instance and the service it will be accessing both of them at the same time so that depending on the time and on the differences on the application you will have to follow different pattern usually A.V. testing and blue-green needs to be mixed with the configuration for the rolling deployment A.V. testing who knows who is A.V. testing by the way you ask a question feel free to ask questions somebody ask a question before you otherwise I will have to take them home okay who knows what is A.V. testing what is the purpose of A.V. testing go ahead so we have two versions of applications of an application and we serve one version to one sub to the users and we think about the second sub to the users and we test which one is better for users but really the main purpose is not to test which one is better for users but what you usually do is the V version what you want to do is to get some information about a new version that you are developing so you will get some sample data about the behavior and usually A.V. testing follows back going back to A once you are finished so you get to be or you deploy a new version in your application you direct a certain amount of users to the V version they start using the new version of the application and you check what is the behavior or you ask them because you know who will be using the new version of the application once you know and you get all the information that you want you can go back and if that or if the application goes fine then do a rolling deployment deployment to the V version and just deploy it for everybody so A.V. testing is a way of testing features in a control way so you usually want to you want to direct this testing of the features to a certain amount of users so we have right now we have the ability of doing A.V. testing out of the box in OpenShift but we are working on providing with more advanced use cases for A.V. testing so we start with application A three instances service A A.V. and the route so the main difference with this is that I have my application I have a level that is called A.V. member you can call it whatever but I have a level for this type of services and my service will route to all the pods that are using that level the services related to pods through a level selector that means that it will go to all the pods that has that level what do I do is I deploy a new version of my application one instance that means that right now I will have three pods of the old version one pods of the new version if I do the normal testing on the routing layer I will get 25% of sampling data out of this then you can scale of course depending on the amount of sampling data that you want if you want 50% you just scale up the new version of the application to provide you with the percentage of the sampling data that you want you do all the testing all the testing that you require once you've done all the testing you go back to the previous release and you decide whether you want to go live with the new version or not so things that we are working right now because the AV testing that we provide is somehow based on the amount of pods that you can spin out we are working on trying to provide more advanced use cases whether it's in the platform or through patterns that can be created on the application like being able to provide weight being able to do the routing to this new version based on headers or cookies or whatever so the routing layer will direct to the new version only the amount of users that have to go so you can have just one instance of the new version and whatever amount of instances of the old version and based on the criteria just directly in the users up to that version all the users so it will be unpredictable in some way of course if you want to make it predictable what you usually do is create a new version of your application expose it into a different route and just have the new set of users going into your application through a different route but that's more or less like having two versions of the app two complete sets of the applications from top to bottom or don't feel shy otherwise we are going to finish in five minutes yes, please but you have a wife let's say you have a new version of the JavaScript and the new API that user who gets that version of JavaScript all those APIs so right now that's one of the that's one of the things that when you roll new deployment if your browser is caching things and you probably you get requests to different versions you will probably have unpredictable behavior on the client the routing layer usually do sticky sessions on the source IP that means that once you start a session on the routing layer you will always go to that application so that means that if it could happen or one session that's already been going on, it will always go to version A if there is a new user it will go to session B or to the version B once you finish with the AV testing you will spin down or scale down that container there will be no longer version B the routing layer will direct you to the version A and that's the time where it could fail when you as an admin scale down version B to the A otherwise the routing layer usually is doing the sticky session so it's guaranteed that once you start a session it will go to the same to the same backend the only thing the only consideration is that if there is a firewall that abstracts the real source IP you will have unpredictable behavior but you need to know your network topology in order to apply this pattern so if you don't know how you're going to do it probably the best way is just to create a new version of your application give a new client or give a new URL a new route to the user if you want to test B once that's done they will start using again the version B through the routing to the version A to the routing to the version A Ryan obviously it's not a question it's a question it's okay you should know everything this is a lot of stuff that I haven't seen yet and in the old version of OpenShift there was something where we would auto scale the application and if there were persistent connections or open sockets we would not put it to sleep or not scale it all the way down do you know if there's anything in the roadmap to count the number of connections and maybe say hold off on removing an old deployment until the connections are closed that's what is called graceful shutdown so that's usually when you want to move you can do it you can do a graceful shutdown but the graceful shutdown has to have a period that means that you provide with a certain amount of time for the users to move away then after that you cannot wait if the user is holding you from transition from one version to another you cannot hold so at the end for those ever that has a transition in that graceful shutdown period they will fail yes sorry sorry so that's the thing at the end what you want to do is to provide the users a certain amount so the routing layer in the routing layer you will not get new request to the old version but you want to transition you want to be able to remove the old version from the deployment because at the end it's consuming computing resources the pods are there and you want to eventually be able to remove them so what you want to do is to provide them with a period of time that they will be able to move otherwise you just kill them the question is can you do it in the current part or some way how to move the sessions from one instance to another or it's something like you want to implement in the application that if you have something like card like you buy something that's application specifically because at the end a card how do you do a card depends on the language depends on the word but which sessions application sessions so if you are using AP you are using probably the application session storage that uses EAP if you are using not whatever so there is no way to provide this out of the box so you have to provide it in your application so you use a container like yeah but that's application specific how do you model that how do you model that it's application specific but it's not going to come from the cloud no no never signal to the application I think there is a way to build applications on the REST API so you can interchange this this intermediate layer without that issue you just need not to break the REST call in progress and you usually need just few seconds so what you do when you do the redeployment there is two phases one phase is bring up the new instance that's not what we are discussing and the other is tear down the old instance when you tear down the old instance what you do is send the signal to the container and there is a period of time that you give that container to go down the thing is that that period of time that you give the container depends on the container the runtime that you are using let's say EAP EAP doesn't provide with grateful shutdown in certain scenarios so you'll get the signal and depends on the runtime that you are using to shut down properly but at the end you have to provide timeouts for this to happen otherwise you'll always stick to waiting and waiting and waiting forever if something doesn't transition ok, the last pattern we are running out of time I think but I see you are really interested so I will continue until you leave next last thing is how would you promote application from one environment to a different environment OpenShift provides you with different ways of modeling your environment that means that usually if you have one single OpenShift cluster what you will do is level your environment with different tags with different levels saying this certain nodes will be target for development this amount of nodes will be target for test this amount of nodes will be target for production so whenever you deploy an application to the nodes for application if it's a production application it will go to the production type of service maybe because the quality of service that you provide in those servers are better maybe because there is more computing resources whatever reason you have that's up to you so how do you move one application using one single OpenShift install cluster this is one single cluster the first thing is when you build your application it will be storing the registry under one tag that's the image string tag or that's the name of the docker image that you provide in the docker registry in this example I'm using my application there and I have different types of deployment configuration related to different tags so I have for my production environment I'm watching an image that is called my application production in my prep production I'm watching for a tag that is called my application prep production and in depth the same so the first time that I build I will just create the image in the registry with that so automatically it will get deployed into the development environment with one instance because my deployment configuration has one instance how do I promote now because my developers are fine they want the testers to test it how do I do it I tag my image in the registry with the new tag that is being used with the new and with the new deployment with the new deployment configuration so that means that once I tag my application with prep production the deployment configuration that was set for prep production it will deploy it and that's the same pattern again and again for production environments when you move tagging into the same registry different tags will be the source for different deployments what about different application different cluster so I have two different installations usually production is different installations what I don't have access so I can follow probably in prep pro it's the same environment I can follow that pattern but maybe when I want to move into production I need to move an image from one registry to a different registry how do I do that it's the same you have one installation one image in the registry but this time it's not tagged especially you don't have to tag it especially why because what you need to do you have two deployment configuration for each and every environment what you need to do is just move your image from one registry to the other registry how you pull the image you copy probably in a pen drive you go to the production environment once it's in the registry it will get deployed we are working in making that easier with some commands like oc import image export image that will provide with other capabilities other than the Docker basic it will create all the opens it requires that I think that was it if you have questions ask me after quick finish because there is more sessions coming in thank you this hard part of having stateful application and data available it's already it's feasible so do people do this yes but you don't probably have to know no application comes without it's really stateful when you move applications it is the same it's not amazing


President Mohamed Buhari has conferred Nigerian citizenship rights to 286 persons comprising Lebanese, British, American, Egyptian, Syrian, Italian, Palestinian nationals. Of the 286 foreign nationals presented with certificates of Nigerian citizenship, 208 received certificates for naturalization while 78 got certificates by registration. At the award event held at the State House, Abuja, the president enjoined the new citizens to be patriotic now that they have pledged their allegiance in Nigeria. This ceremony therefore today is a further demonstration of the federal government's commitment and determination to remove as many people as possible from statelessness. In this regard, I would like to reiterate our commitment to the strategic role Nigeria plays in the Committee of Nations in its unwavering quest for greater human integration towards ensuring peace and prosperity. I urge you to make positive and useful contributions to the advancement, progress and well-being of the different communities you reside in. I further urge that you be in accord with our national ethics and code of conduct as citizens of Nigeria. You are expected to abide by the ideals and institution of the Nigerian National Flag, anthem, pledge and respect for all constituted authorities. All those concerned with immigration matters are to offer our new citizens quick legal identification. Also their local governments should assist with their integration in the local community to enable them enjoy all the entitlements of Nigerian students. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


Welcome back dear learners. We have already discussed about meaning, definition and origin of the concept of citizenship. Now we will discuss about the types of citizenship including marriage and demerits. Dear learners, there are two categories of citizens namely natural citizens or citizen by birth and naturalization or naturalized citizen. Let us discuss in detail the natural citizen. Jannmugatangari, Baasabhavik Nagari, Hol Jinnakul Nagari or Jannmugatangari, are the names of these names. In case of citizenship by birth, there are two principles to be followed. In this category, the names of these names are Hadarante, Duta, Niti, Manishala, Thaka, Dikhi, Vale, Pua, Jai, Hair, Hol Just Sanguin, is the rule of blood relations. Tejor, Hamparganiti, and Adhar is just Shalir, rule of the place of birth, Jannmastan, Niti. In this category, the place of birth and the way to follow the� we should be able to laugh Nagari. As the same, we should be able to keep on following this rule of birth. Thereafter, the place of birth and this is how we can all laugh Nagari. And the same goes for the place of birth and this is how we can all He is the leader of the Nagarik. He can also laugh at the Nagarik in his father's name. So, he can also make the Nagarik in his father's name. And when I laugh at the Nagarik in these two directions, I can also laugh at the Nagarik in my father's name. However, it may be mentioned here that generally their principle of justice does not apply to children born to foreign diplomats serving in the country. This is what I am talking about. The naturalized citizens. The naturalized citizens are citizens by adoption. If foreigners living in a country become the citizen of the country, if he or she fulfills certain conditions prescribed by that country and at the same time gives up his or her original citizenship. For example, through marries, joining in the army, giving petitions, etc. One may take the citizenship of other countries, but before that he or she must have to give up his original citizenship. So we may say that there are two methods of acquiring citizenship and individual can attain his citizenship naturally by birth which means natural citizenship on the other hand sometimes one may acquire citizenship of another country by the method of adoption that means naturalize citizenship. Now let us proceed our discussion to the qualities of a good citizen. The functioning of a state depends on the qualities of its citizens. Good citizenship and good states are co-relative terms which may be termed as the two sides of the same coin. Similarly a sound political system makes the citizens good. According to British scholar Lord Bryce a good citizen has three qualities namely intelligence, self-control and conscience. The British scholar Lord Bryce said that a citizen must have his conscience or devotion to duty to be ready and willing to render every kind of service to his or her nation. He or she should discharge his or her duties honestly and be willing to defend his or her country at the time of crisis. So we may say that a citizen must have his conscience or devotion to duty to his or her country. These differences are indifferences, selfishness, ignorance and illiteracy, corruption and nepotism, poverty and laziness. So these are the obstacles of good citizens. To conclude we may say that with the help of proper education, constitutional safeguards and constitutional laws these obstacles can be removed. So thank you all for your patience very much.


Hi, everyone. First, I'd like to thank everybody for supporting this channel. We couldn't be growing without you. Secondly, one of our first videos, what kind of karate is in Cobra Kai, had a lot of feedback. I got a lot of responses and great comments from our viewers, so much so that we're actually doing a follow-up video. So coming soon is what kind of karate is in Cobra Kai Part 2. And in this video, we're gonna go over, kind of summarize what the first video was. If you haven't seen it yet, please go ahead and check it out. I'd love to hear what you think, but in this video we're gonna summarize my original assessments, and then I'm going to take into account all the feedback I got and address each comment or at least the most common comments. If you have not seen the Cobra Kai TV show yet, I highly recommend it. If you're like me, a fan of karate kid growing up, like I live and died by it as a kid, it got me into the martial arts, then if you like those films, I think you'll love Cobra Kai. YouTube premium. The first two episodes are free, so no harm in giving it a shot. And if you like it, at the very least, sign up for a free trial. You can watch it for at least for a month. So in this next video, we're gonna summarize the assessments of the first one, and then I'm gonna take into account the most common comments, the feedback I got, the challenges, and then I'm gonna break that down, and we'll see if they hold up. So thank you all for watching. Stay tuned for what kind of karate is in Cobra Kai Part 2.


I don't know, Erica, what are your whole thoughts about the rise of the machines and AI? The fact that you've been in the insured tech space and all of this, do you think that that fear is something that could happen? We could get automation that replaces actuaries or are actuaries here to stay? Michael, yes, robots are coming for your job. No, seriously. I do believe that actuaries should be, should consider this, would be actuaries that are currently studying, should consider it. And that's why I liked Chiara's answer earlier in her chatting about the fact that she wants to be a data scientist, actually. I think that's extremely important. And then, of course, you also get to help to steer the direction of where data science in insurance is going. But also with the understanding that as you go through this and you are developing the algorithms, the models, et cetera, there will come a time where a lot of what an individual is currently doing an actuary or a data scientist will be automated. So you need to broaden your skills well beyond just being able to write an algorithm. You need to be able to interact with AI in such a way that you as a human can guide it. To be honest with you, I am very doubtful of whether we will ever get to general artificial intelligence. So most likely, at least in our lifetimes, we will need to guide the machines to do what we need them to do. So I would say as an actuary, broaden your skills and become more adept at understanding situations because you as a human will need to tell the machine where to go and what to do because it will not understand the context of the situation. Okay.


Wow, this is a wild one, folks.  I'd like to raise a point of order. Kind of a lady, a standard point of order. Point of order. Pursuant to House Rule 11, Clause 2, which Mr. Kennedy is violative of, I move that we move into an executive session because Mr. Kennedy has repeatedly made despicable anti-Semitic and anti-Asian comments as reasonably as last week. Rule 11, Clause 2 says, whenever it is asserted by a member of the committee that the evidence or testimony at a hearing may tend to defame, degrade, or incriminate any person or it is asserted by a witness that the evidence or testimony that the witness would give at a hearing may tend to defame, degrade, or incriminate the witness, and it goes on. Mr. Kennedy, among many other things, has said, I know a lot now about bio weapons. We put out hundreds of millions of dollars into ethnically targeted microbes. The Chinese have done the same thing. In fact, COVID-19, there is an argument that it is ethnically targeted. COVID-19 attacks certain races disproportionately. The races that are most immune to COVID-19 are- A lady making a motion or a speech. I've made a motion to move into an executive session because Mr. Kennedy's testimony and his previous statements- Mr. Chairman, I move to table the motion. The gentleman from Kentucky has moved to table. The question is on the motion. The question is on the motion. Can I ask for a roll call vote on the motion to table? Let me ask the question. The question is on the motion to table. The gentlelady has asked for a roll call vote. The clerk will have to step back for a second. The clerk will have to come in. We'll call the roll on the motion to table, and then we can get back to testimony. I think the witnesses can sit in the chair sitting behind me. I'll leave that up to the clerks. If the clerks are comfortable with that, why don't we do that? Maybe we can go right down here. Mr. Chairman, point of order. The gentleman from Louisiana. Is it the custom of this committee to censor viewpoints that we disagree with from witnesses? Mr. Chairman, I have a motion to have a motion on the table. There's a motion and the vote's been called. Move into the executive session. We're waiting for the clerks. Is violative of rule 11 clause 2. Waiting for the clerks. Clerk will call the roll. Mr. Jordan. Yes. Mr. Jordan votes yes. Mr. Issa. Mr. Massey. Yes. To not censor. Mr. Massey votes yes. Mr. Stuart. Yes. Mr. Stuart votes yes. Mrs. Staphonic? Yes. Mr. Staphonic votes yes. Mr. Gates? Mr. Johnson of Louisiana? Yes. Mr. Johnson of Louisiana votes yes. Mr. Armstrong? Yes. Mr. Armstrong votes yes. Mr. Subie? Mr. Bishop? Yes. Mr. Bishop votes yes. Ms. Camack. Yes. Ms. Camack votes yes. Ms. Hagemon? Yes. Ms. Hagemon votes yes. I want to follow the rules that the Republicans made at the beginning of this conference with these House rules, so no. Ms. Pascott votes no. Mr. Lynch? No. Mr. Lynch votes no. Ms. Sanchez? No, because it's violative of the rules. Ms. Sanchez votes no. Ms. Wasserman-Schultz? No, to allowing a witness to degrade and suspend others and violate the rules and not have his testimony and degradation amplified rather than given an executive session. Ms. Wasserman-Schultz votes no. Mr. Connolly? No, to the Soviet Politburo. Mr. Connolly votes no. Mr. Garamendi? No. Mr. Garamendi votes no. Mr. Allred? Ms. Garcia? No. Ms. Garcia votes no. Mr. Goldman? No, to hate speech. Mr. Goldman votes no. Jeez. Mr. Gates? Yes. Mr. Gates? Aye. Mr. Gates votes aye. Clerk will report. Mr. Chairman, there are 10 ayes and 8 noes. The motion to table is agreed to. One.