War is that which defines our most holy Imperium. Every minute of every hour of every day, the best and indeed worst of humanity, sell their lives upon countless battlefields, upon countless worlds, for the sake of our survival, our species, our god-emperor. War is the grimest and most ultimate of necessities we face, for were we to not resist the depredations of the Xenos, the mutant, and the heretic, we would simply be swept away, drowned in our own blood, or our own very bones trampled to dust, beneath the boots and claws and hooves of our foes. Our species has created many a weapon to aid us, in this most noble and indeed desperate of battles, and foremost amongst them are the space marines of the Adeptus Astartes, genetically engineered masterpieces of divine desire that bestride our battlefield as the emperor's own angels of death. They are our best and truest defenders, but there have been times, dark and terrible times, when the arc of our human history has bent these warriors to dark acts and deeds most foul. What should happen when the almost unthinkable occurs, when the finest of our imperial sons turns bolter and blade upon his fellow, spitting poisonous acid upon his oaths? This chronicle series will concern one such time, a conflict that would prove to be one of the most devastating of the imperium's internecine feuds, since the days of the Great Heresy. Know then, that this is a record of a war of foulest treachery and most trying retribution, of pledges shattered and faith questioned, of a time when we would come to question the very nature of those we considered to be our most inviolate shield, a record of the Badab war. To grasp the scope of the conflict's origins, one must first grasp the region of space that birthed it, specifically the stellar anomaly at its core, the Maelstrom. Second in ferocity only to the Oculus Terribles or Eye of Terror, the Maelstrom is a warp rift, an area of the void where real space and the imiterium are, effectively, one and the same. Reality and unreality are blended. Anyone caught in its tides steps in and out of what is and what is not simultaneously, as all the laws of universal physics break down to naught. The Eye, at least, is far to the Galactic North, but the Maelstrom is located in an almost perfect straight path from Holy Terror to the dense cluster regions of the Galactic Core, a canker at the very heart of our mighty Imperium these past 10,000 years. During the glory days of the Great Crusade, evidence of mankind's presence in the regions surrounding the rift were discovered by the expeditionary fleets, along with the fabulous resources of nearby worlds. What these fleets also discovered, closer to the storm, was nothing short of an infested warren of void space, a volume clogged with pirates, reavers, zenos, and mutants, all clinging precipitously to the edges of reality, or simply dwelling within unreality, utilizing the chaotic tides of the warp around the Maelstrom as protection from those that would otherwise destroy them. Pacification and purgation campaigns were mounted, and while the crusade was able to secure certain vital systems in the name of the Imperium, thousands of troops and hundreds of ships were lost by expeditionary fleets that treaded too closely to the storm rift. The Emperor himself declared the Maelstrom purgatus, refusing to waste more men and material on the hopelessness of actually bringing such a region to heal, content to simply bolster the defences of already conquered systems and send the fleets onward to much more accomplishable goals. Whether or not the Emperor ever intended to return to the Maelstrom for a final and concerted pacification effort is unknown, as the fires of the Horus Heresy put paid to any of his plans. In the aftermath of that horrific conflict, an altogether newer issue with the region became extant, the presence of Traitor Astartes from the legions that had sided with the Warmaster. While the bulk of the Traitor legions had fled to the Eye of Terror following their defeat at the Siege of Terra, many made for the nearer Maelstrom instead, including sizable amounts of Astartes from the 20th Legion Alpha Legion. Rebut Gulliman, Primarch of the 13th Legion Ultramarines and Nominal Lord Commander of the Imperium, in the wake of his father's ascension to the Golden Throne, deemed the Maelstrom an unacceptable threat to the slowly reforming Imperium and designated it an area of military fortification second only to the Eye. For, as the Imperium had suffered under the wars of Horus' foul ambitions, the region had once more fallen into rack and ruin, with the storm regions now once more occupied by orcs, Drukhari raiders, and fowler warp-born Xenos, like the Psycnoean. Strictly speaking, the Purgatus designation could have been maintained, but the resources of the volume were far too precious for the Imperium to possibly ignore, especially in its weakened state. And thus, over the millennia, the long arm of humanity has ponderously and bitterly sought to extend its rightful dominance over the systems there. Officially named the Maelstrom-adjacent Autonomous Imperial Resource Extraction Zone Grid 004-357 by the Adeptus Administratum, it is known colloquially as the Maelstrom Zone, and is a volume to the Galactic West, Southwest, of the main body of the rift. It eclipses many Imperial sectors in sheer size, with well over a thousand star systems. But due to its proximity to the Maelstrom itself, it has never been considered a truly coherent sub-realm of the Imperium, merely a cartographical and administrative region. While major colony worlds were established, heavily defended, and indeed prospered, the Adeptus Terra never sought to extend full control over the volume, owing to the sheer threat the enemies within the rift posed, not to mention the stellar phenomena of the region, like nomadic singularities and ionic reefs, common in areas experiencing severe void turbulence. Content to grow fat off the resources the colonies could provide, but unwilling to endure the full cost of expanding its control, the Imperium settled into a comfortable status of nominal only rulership. The worlds of the Zone are many, but few are habitable. Cartigraphica imperialis adepts mostly postulate that, as the Maelstrom appears to predate human evolution itself, compared to the relatively young Oculus Tereblis, and owing perhaps to its relative stability as a galactic anomaly, that the majority of the systems are formed of collections of orphan planets expelled or gone rogue from the hyper-dense galactic core that is relatively nearby. I mean both natural and unnatural. These planets tumbled through space until finally being caught in the exonormal eddies of the Zone, co-alating and merging, forming mongrel systems of their own. These accounts for the almost ludicrous amount of wealth the Zone can render, as within a single system can be found rare minerals and elements usually only found millions of light-years distant. This above all else is what draws humanity to the region, be under no mistake, and why the Imperium has ever sought to sup upon whatever they can whenever they can. But only a scant few of these worlds may be considered properly habitable, even less should one wish to consider overall proximity to the rift itself. And it was these Imperial elements, and it was to these that Imperial elements naturally gravitated towards and eventually secured. It was not until the 38th and 39th millennia that these outposts began to rise to true prominence, forming a tenuous chain of safe harbours for mercantile shipping out of the Zone and to more established sectors. Three systems were prime amongst them, Sagan, Cygnax, and finally the Dab. While they endured, the Zone became ever more open to the Imperium, and interests far and wide began to suddenly see the sheer amount of credits to be made. However, this state of affairs was not to last, as in the darkening days of the 40th and early 41st millennium, the Zone was to suffer a market uptick in the predations of malignant forces present in the volume. The maelstrom is not static, and, as with all warp anomalies, is prone to waxing and waning, with no degree of predictability. And as the tides of the storm swelled, so too did demonic incursions, cult activities, and yet more destructive military endeavours. An orc war demolished the border worlds of the Hybraxis Nebula in the 700s of M40, while a mutant invasion toppled the mining colonies on Cairo and Larsa. These losses were dire, but ultimately sustainable for the status quo, until the advent of the doom of Cygnax. Cygnax, the hive world that had rapidly become the foundation of all Imperial control within the Zone, was not only the most densely populated world in the local volume, but also the most heavily militarized. A bastion of Imperial might in the depths of what was, effectively, wild space. It is lightly none suspected that its fall would be as swift, or indeed as disastrous as it was. In 557 M41, as the maelstrom waxed strong in the skies above the hive cities, a marked and sudden uptick in degenerate cult activity placed a heavy strain upon the forces of the world's adeptus arbites, swiftly overwhelming their policing resources and necessitating the drafting of the local planetary defence force to simply maintain basic civil order. It was later discovered that a band of heretic astartes, identified as the reborn, were responsible in part for this, as well as carrying out stunningly brutal raids in the planet's nearest space. In response to this, nihilistic death cults sprang up in their thousands, vast segments of the population expressing their worship of the emperor in the form of divine death alone. The ensuing civil war was catastrophic, as the cultists of both sides rampaged through the cities, destroying whole districts in wanton devastation. Unable to stem the tide, the Imperial forces petitioned the mantis warriors chapter of the adeptus astartes for assistance. But even in spite of this, the death cultists overwhelmed the defenders of the planet's main missile batteries, and unleashed a suicidal reign of atomic warheads globally. The sheer power of the resulting apocalypse skewed the world off its regular orbital angle, and the sheer amount of fallout, dust and tectonic damage plunged Cygnax into a nuclear winter it is unlikely to ever recover from. The loss of such a world was nothing short of a complete disaster for the imperium in the maelstrom zone. With its most vital link in the shipping chain severed, colonies in their dozens simply vanished, going dark, as the defences that Cygnax had so readily provided were suddenly stripped from them. In less than a year, a volume of space that would typically have taken a month and a half to traverse in the warp was simply lost. The death of Cygnax was a pivotal moment in imperial history in the maelstrom zone, for the sheer material and economic loss it presented, drawing, even, the attention of the adeptus terror and forcing the hands of the high lords. An edict imperialis was issued in 587 M41, ordering for the relocation of whole chapters of the adeptus astartes to the maelstrom zone in order to reestablish and henceforth defend the imperium's interests in the volume. Though such a redeployment of astartes was not without precedent, it marked a tangible shift in imperial policy for the zone specifically, in a manner not seen since the days of the great crusade. In recognition of their impressive victory tally, and in light of their speciality with dealing with forces of the arch enemy, the astral claws were appointed in overall theater command. And in mid 35th millennium as a fleet based strike chapter, the astral claws had spent most of their proud history in the galaxy's eastern fringes. Though their direct lineage is unknown to modern scholarship, a lack of pedigree did not prevent these scions of the 10th founding from amassing an honor roll enviable to any chapter, and their aforementioned experience in prosecuting renegade imperial elements deemed them well suited for reassignment to the zone. They were to be joined by the similarly fleet based chapters, the Carnal Guard and the Lamenters, and supplemented by the Mantis Guard, who had based their fortress monasy in the nearby endemian cluster. Collectively, these chapters were to be known as the Maelstrom Warders. The astral claws, upon arrival in the zone in the early 600s of M41, appropriated an orbital station in the Badab system as their new fortress monastery, and supplemented their already impressive fleet with a permanent squadron on loan from the Imperial Navy. The arrival of such an incredible military force within the zone had an immediate stabilization effect upon the region, as with the Navy now running protection for merchant convoys and the Astartes carrying out supremely efficient purgation operations, Imperial control over the lost systems of the zone was rapidly reestablished, with a dozen planets recaptured in the first few years alone. Boyd by their initial success, and with the enemies of the Imperium reeling, the Maelstrom Warders did not rest, mounting what was known as the Scourge Campaign, from 640 M41 to 651 M41. Utilizing an array of intelligence gathered during the reconquest, the years preceding the fall of Cygnax, and even archaic records and star charts from the archives of the Mantis warriors, the Maelstrom Warders went on the offense into the depths of the Maelstrom itself, the first Imperial warriors to do so in millennia. Unwilling to let the foes simply scurry back to their pits, combined Astartes forces annihilated dozens of enemy fortresses and strongholds, pinpointing their location and annihilating them with maximum prejudice. The Mantis warriors were even able to revenge themselves upon the reborn for the loss of Cygnax many decades before, satisfying what they had now long held as a stain upon their honor. Yet despite the successes of the Scourge Campaign, progress was abruptly halted when the Adeptus Terra severed the Carnal Guard's status as Warders, and ordered them to make full wake to the Veiled Region for reassignment in the Thanatos Crusade. On stroke, the High Lords had cut the strength of the Maelstrom Warders by 25%, putting an immediate end to the Scourge Campaign and forcing the remaining Astral Claws, Lamentors and Mantis warriors to withdraw from rift space and fall back to more defensible volumes near Imperial planets. The Claws immediately petitioned the Adeptus Terra for a replacement to reaffirm the strength of the Warders, pointing to their great success in recent years, but were, repeatedly, denied. Quite why the Carnal Guard were withdrawn is unknown. To the outside observer, it would appear to be a maneuver of severe detriment to the region and the pacification of it, and of Imperial interests in general. One would need to research the demands of the Thanatos Crusade in depth before having to make such a call, however, and one must also presume that the High Lords would not have made such a seemingly devastating strategic call without extreme pressures of external military exigencies. Whatever the reason, the loss of the Carnal Guards was a setback to the goals of the Warders, yes, but not in and of itself a crippling blow. The Astartes and Navy presence in the zone was still more than sufficient to defend Imperial interests there from external threats, but fate, as it often does, has a way of intervening. Twenty years after the cessation of the Scourge campaign, decades marked by remarkably little in the way of enemy activity, the Warp disgorged a pure terror into the zone. The Space Hulk-designate unhallowed heart, a planetoid-sized conglomeration of shipwrecks, orbitals, rogue asteroids, and other fowler things. This particular Hulk had become a cancerous Warp-infected thing in its long millennia spent traversing the Immaterium, projecting a demonic psychic aura from its hateful surface that drove all who came within its reach mad in suicidal desolation. Multiple Imperial Navy battlegroup and Astral Claw strike cruisers were lost in initial attempts to halt its path, crews both mortal and Astartes proving unable to resist the horrific madness the Hulk projected and turning their own weapons upon themselves. The unhallowed heart cut an apocalyptic swath through Imperial-controlled space. Plunging in and out of the Warp seemingly at random, the Space Hulk proved impossible to pin down, its demonic hate bringing ruin to several outposts before its reappearance above Esuna, a populous colony world. Only a quarter of the planet's population were lost that first night. As the Astartes of the Lamentors, apparently for whatever reason better able to resist its suicidal siren song, attempted to destroy the thing. Their resistance was not total, and more and more of them succumbed as boarding teams laced the twisted corridors with demolisher charges, and frigates and cruisers pounded its surface with close-range bombardment. Ultimately, the effort of the Lamentors paid off, as whatever demonic presence lurked within the heart of this unnatural conglomerate quit real space and fled to the Warp. The beast cracked open as the Lamentors fleet punished its fracturing carcass. Losses to the Lamentors were severe. Four strike cruisers and over 300 battlebrothers, nearly a third of the chapter, were destroyed and dead. Many of the latter in conditions that prevented their recovery of their precious gene seed. A subsequent deputation from the Ordomaleus of the Inquisition ired the already incensed chapter further, by critiquing them for not destroying the unhallowed heart at the expense of Esuna, by simply crashing the Hulk into the world's surface. Such an act would have doomed the entire world and its entire population, something the Lamentors would not countenance, and they expelled the Inquisitors from the zone under threat of death, communicating this to their fellow Warders, who expressed similar sentiments. With the severe losses to the Lamentors and the Astral Claws, the forces arrayed against them began to press advantages as they saw fit, launching rapid raids into Imperial space in frequencies not seen in decades. The Warders once again petitioned terror for reinforcement, but were once again denied, in order to hold ground and push back where possible. Between this, their already incurred losses, the cessation of the successful scourge campaign, and the insulting behavior of the Inquisition. Relations between the Maelstrom Warders and the wider Imperium had reached a never-before-seen nadir. Pride, trust, and honour had all been wounded, and the remaining Astartes felt ever more besieged, and indeed abandoned, to their fates beyond the fringes of Imperial space. This was, as must seem inevitable in hindsight, to come to a head, when a series of heavy green-skinned raids forced the hand of the chapter master of the Astral Claws. In 901, 715, M41, Rovic Blake bucked chapter doctrine, and indeed Imperial decree, by pursuing one such Xenos raid into the Maelstrom itself, leading at the van upon the battle barge Seraph of Judgment, at the head of a substantial Astartes strike force. Pursuing the fleeing green-skins all the way to their lair, the Astral Claws engaged in a brutal assault upon the asteroid bases of the foe. Though thousands of the hated aliens were slain, the cost was high beyond imagining, with Rovic Blake himself falling to the Orc Warboss, forcing the Astartes to retreat, with the flight itself incurring heavy damage to the Seraph, and now become to a rather pivotal moment. The succession process following that disastrous raid saw the ascension to chapter master of the captain of the third company, Lukft Huron. The youngest Astartes to have ever held the rank, Huron was a charismatic battle leader, a rising star in the chapter for his ability to lead warriors upon the field, yes, but also for his keen battle acumen and grasp of macro strategies. His rise to prominence had been a rapid one, for the Maelstrom was exactly the kind of region that would allow such a man to do so. Huron was undeniably talented in all aspects of war-making, but he was also ruthless, ambitious. All three characteristics, combining with the sheer attrition rates amongst the Maelstrom chapter's battle brothers, provide a perfect environment for his meteoric ascent to supreme command. Once in such a position, he wasted little time in making his mark upon chapter organization, rapidly and decisively restructuring the Astral Claw's fleet through a policy of rapid expansion. Ostensibly, this was to make up for the losses incurred under the previous chapter master, but in reality, the aggressive intake of new ships allowed Huron to completely reform and redeploy the chapter's strategic assets to better project material strength over what he deemed key-dependent areas. The new fleet included many ships that had formally belonged to Corsair or even arch enemy forces defeated by the Astral Claws, hastily retrofitted to accommodate their new masters. Many of these were ships whose keels had been laid down for service in the Imperial Navy, and as such were STC templates forbidden by ancient Imperial decree for use by a chapter of the Adeptus Astartes. Huron brushed aside loudly raised concerns of both tech heresy and violation of the Imperial Law, deeming the utilization of these ships essential for the execution of the chapter's remit in trying times. The dynamic chapter master's reforms and aggressive redeployments earned a lot of early successes, which he was quick to capitalize upon, enacting a scorched earth policy against recalcitrant rebel holdouts infringed systems. Whether or not these raiders or pirates posed legitimate threats to Imperial interests within the zone, especially Astartes ones, is debatable. But for Huron, they presented quick and easy victories that allowed him to expand the reach of his newfound power, justifying his policies through the danger they ostensibly represented and expanding the chapter supply of world-killing exterminatus-grade weapons in order to enact these purges. Had any within the Imperium been able to or cared to read the signs, it would have seen several growing trends within the leadership of the Astral Claws and their position as males from Warders. Authoritarianism, ruthlessness, disregard for the Lex Imperialis, and rapid expansion of centralized military power. You may scoff at these things, for are they all not hallmarks of the Imperium itself? Be that as it may, our history is replete with examples of this very thing occurring, and it rarely ends with anything but blood. Alas, but there were none to see this. Those within the zone were, at the time of Huron's ascension, relieved to have such an apparently successful and charismatic Astartes seizing the reins of power at the time of deep unrest. And upon face value, the resurgence of the chapter under such leadership was undeniably a boon to Imperial interests within the zone. Such success, however, comes with dangers of its own. These would soon begin to manifest in ways both completely unforeseen and at the same time, sadly predictable. Until the next account of this dark chapter in Imperial history. Ave Imperator, Gloria in Excelsis Terra. This video and this channel is made possible through the incredibly kind support of my Patreon subscribers. If you'd like to help support the channel, head on over to patreon.com forward slash Oculus imperia. If you want to kick me a buck or two to help keep the lights running and the scripts flowing. You can keep up to date with channel news if you follow me on twitter at buttstuffkaiju. Nope, not changing that name anytime soon. And new this month, if you'd like to support the channel with some merchandise my very first t-shirts are up for sale on tspring.com forward slash Oculus imperia. Join the channel on discord as well. A link to all of this will be in the description below.


Good morning. My name is Jaimua Chachay. You can find me on Joa underscore chachay. This is help on Monday Kindly if you want to talk to us if you want to ask any questions if you have any opinions on what we're going to be Discussing you can do so on our social media platforms The hashtag has to be why in the morning and hashtag help on Monday. Yes, it's a thing now and kari booni Sonnet to the show. Please remember that our channels can be found on y25 for Channel on Facebook on in Twitter. You can find us on Y25 for our channel as well on Instagram You can find us on Y25 for underscore channel and please subscribe to our YouTube channel We'd love for you guys to watch this interview again to get a bit more insight and also to watch many of the other things that we Forced it on our channel on YouTube. So today. We are actually talking to one person that we call dr. Marion mooly Dr. Marion mooly is a Multifaceted lady if I could introduce her She's actually an officer for PCA that stands for Presbyterian Church in East Africa and as well as an officer for How can I say the Kikuyu Hospital? Excuse me, and she's actually a volunteer with St. John ambulance and today's topic actually touches on emergency rooms and Everything of that nature what happens in emergency rooms and why are we youth are ending up there? So so much in the past in actually recent times and we want to find out why they're coming in So we're going to be talking to dr. Moody about that curry busana dr. Moody Thank you very much. Good morning. Good morning. How are you? I'm fine. Thank you for having me on studio I'm glad to be here, and I think I'm happy about the topic. We're going to talk about okay, because it's a topic that really affects the Yes, so let's um We've seen it. We've seen it in the hospital We've seen it as volunteers. Yes as EMT is in ambulances. It's something that is really affecting the youth accidents Emergencies medical emergencies drugs. We have so much that we present with at the A&D At the A&D at the accident and emergency room accident and emergency room just in case somebody didn't know that That's that's that's an interesting job to do But when it comes to when working in the emergency room, you particularly said that you're volunteering there And if you're not volunteering there, where do you spend most of your work hours? Okay, most of my work hours are spent at PCA Kikuyu Hospital Right, I'm a medical officer in turn, but I have also been a volunteer with St. John for 14 years and Of those 14 I have trained first aid and emergency services for 10 So I have been with the emergency in fact for a longer longer time than I have been a doctor, but generally I've seen Most of both worlds, right? Yeah, so if I was to fall over and collapse right now, I'll be in good hands You're sorted all the way Well now speaking of me falling over and you know collapsing God forbid, you know Our youth are going through something and when we're talking outside. I'd like that 30 Excuse me 33 percent of road accidents Affect the youth and that Kenya is actually a red zone in Africa on the continent of Africa when it comes to emergencies and accidents and you corrected me and you said not just in Africa on in the whole world Kenya is a red zone to mean that the the the the frequency of emergency room occurrences are quite high when it comes to Kenyans and that 33 percent of road accidents is is Actually for just the youth when we're seeing the youth recovering the age until people until the age of 35 and below Yes Can I ask that 33 percent when they do tend to come in through the emergency rooms? What and how are they ending up there? Okay, so um actually and this is what will be surprising the 33 percent is Just road traffic accidents and that speaks a lot towards you know What is really affecting the youth in terms of that's that's the highest The number one killer of youth between 15 and 19 if you include 10 to 25 Then it's the number two killer of youth Which means that it is a big deal that we are getting a lot of road traffic accidents But there are also other emergencies that we get we see poisoning both accidental and intentional we see Obstetric emergencies for women. That's quite common in the accident and emergency room Oh emergencies to do with pregnancy like ectopic pregnancies spontaneous abortions, yeah, then we also see Basically work work related accidents because most of the hands-on work your construction Factories is done by youth. So we see a lot of people coming with baby amputations due to machines, you know And all this rotates around safety around being aware of yourself even for pregnancy being aware that you're pregnant Doing early hospital visits early tests. So it's an all-round that what are we doing? Yeah, yes. So how are we keeping ourselves safe? Are we taking care of ourselves? Yeah, so those are some of the causes of accidents of Trauma or of accident and emergency visits for the youth Outside of the 33 percent outside All right. Now if we could go to the 33 percent the road accidents, I could imagine road accidents Sometimes you get hit by another car or sometimes because of speed you can hit another car Or if you're intoxicated and you combine it with speed then that could also cause an accident I don't know if there's a some of the reasons why these road accidents are happening. Yes, and as you mentioned Intoxication, it's a big deal. Yeah, it's a big deal. A lot of our youth are getting intoxicated.  You can do this, you know, yeah, and you end up finding that You lose something you lose some control Sometimes when you think about it when you're texting and you actually text wrong things That tells you now what about when you're driving? Yeah When you're texting you text things you shouldn't be texting. Yes. Yeah So intoxication is one of the things both alcohol and other drugs But you also have other problems generally and it's mentioned even in the study That youth are risk takers. We like taking risks. You'll find us. What are those races drug races?  You see amacides and you want to Race there. Yeah, the same thing with bikes. Yeah, it's the same. We take risks and sometimes we forget safety You know, maybe I could ask the youth when was the last time you sat on the back seat Of a friend's car and tied a seat belt, you know on the front seat the car does And it makes you tie the belt, but the back seat when was the last time that you tied a belt One was the last time you took a bike Do the Yeah, you know and you put on a helmet You know, yeah, it's it's something that we don't think about sometimes you find even the bike guy Doesn't have undo the and that also covers in that they also are youth And they're increasing the numbers because they themselves are not safe. Then their passengers are not safe. So we have so many problems around Why road traffic accidents happen and why they affect the youth most. Yeah, we always run. We're always speedy Yeah, we are always taking risks Always taking risks and that's an interesting way to put it because I can imagine the pressure There many times I've been driving and you know, I'm just I'm just like, okay And then a Subaru pass me and then there's that kind of feeling you get you're like This guy I don't know how to explain So you feel like even you stepping your ignition because you're like You know, even me I can speed up if I want to then you have to yourself Calm down this could potentially end very very badly for me and then you see, yeah They find them racing against and they'll challenge you on the road Just out of nowhere you find, you know, somebody will zoom past you and he's not racing against anyone And you zoom past him and he zooms past you and it becomes a race and it's never it never ends up very well Sometimes and if we can go back to the other reasons why people end up in the emergency room For you you mentioned poisoning Intentional and unintentional. What do you mean poisoning? Do you mean like Maybe they've taken poison by mistake or they've they've Poisoned themselves maybe to Take away their lives or what do you mean? Thank you so much for that question And I think as we discuss it, maybe we should think about The youth and mental health. We're having a lot of cases of suicide We're having a lot of cases of homey sides. Yeah, and we need to think about Where are we coming from? Yeah, as I came in I there was a hot topic in studio pre Yeah, where people are talking about the homey sides that are happening Yeah, so we have young people young people having problems with mental health So that is something that we need to think about. There are a lot of cases of Intentional or attempted suicide. Yeah, so they get to the hospital Sometimes you get to reverse them. Sometimes you don't but it's a rather common case and the other is Accidental poisonings happen as well. Yeah, especially For the younger youth, you know, and we say youth. I don't know. What is the limit the lower limit? For children, yeah, we can get for younger than 15. Yes, we can get Poisoning that is an intentional with maybe organophosphates If it is factories, we can get chemical poisoning. Also, that is an intentional Not as common most common is intentional or attempted suicide most common is intentional poisoning or attempted suicide which could be in the form of taking poison or overdose on pills or something or attempting cutting yourself Attempting to strangulate yourself and then somebody found them and rush them to their emergency room You said sometimes able to revive them bring them back sometimes. It's too late. Yes. Yeah, so it's just It's a real concern. So what do we do? What do we do about mental health for you? That's true And I'm glad you brought up homicide because There are cases where especially among university students You know a relationship goes wrong or a relationship fails or something and a boyfriend or girlfriend takes, you know a knife or a panga and you know, they They hurt their partner in a way that they shouldn't and people start saying a tea. Hey, what's happening to this young man? Is it a reason of mental case? What is it? What's wrong with him? I'm just wondering when those people are found Someone who has committed an act, but they're still alive and well Are they taken to the emergency room as well or are they taken to hospital? Just in general because I would think that um takipatwa. Maybe he has stabbed somebody I feel like hey, it's an emergency figure. What's wrong with you? Yeah, but it could just be me that thinks it's an emergency. Yeah. Yeah, okay. Um, that's a good question. And um, I think I can say that Sometimes we neglect mental health that Mental health is an emergency There are psychiatric emergencies. It's a topic in psychiatry. It's a specialty. It's something that people do Yeah, and psychiatric emergencies include things like suicide And to some extent homicide, you know, we want to think about Making sure that um the perpetrator maybe pays for the crime But as always whenever We are taking someone through the judicial process There's always the psychiatrists coming in to assess the mental status To assess whether it was a pre-planned crime whether it was an act of passion You know a sudden thing that just happened. Yeah, and I think um I feel like I want to appeal to the youth Please do both men and women. You can do that as you look at the camera. It's never that serious, you know, it's it's It's something I think if you talk to older people, maybe older people should mentor the youth I mean we've been through this we've seen these relationships. It ends you move on. Yeah, so really we need to


Thank you everybody for for coming and and thank you so much to to has geek and to Sequoia And to everybody who has sponsored my trip here and for the kind invitation and and for the wonderful Generosity that everybody has shown me since I've been here My name is Mike place. I am on the core engineering team at Saltstack. I am from obviously not here I am from Salt Lake City, Utah and My Twitter handle is is cached out. I'm easy to find and What I want to talk to you today is What's hopefully a very gentle introduction to Saltstack? I don't know how many people in here have any experience with Saltstack if you've ever heard of Saltstack Could you potentially raise your hand? You know that's fantastic used Saltstack. Oh That's really wonderful. I'm glad to hear it Love Saltstack. Hopefully that's the same number as the last one So there are a couple of things that that we want to talk about today Obviously introductions. Where did Saltstack come from? Why do I need it a little bit about remote execution 101? And then some basics to be completely honest with you When I proposed to my bosses that I come out here They said okay fine, and they they turned me over to the marketing department who set me up With the set of slides and they had all of these very complex Relationships on them and they just look like business slides and I threw them all away Because I don't like them. I'm an engineer. I'm not here to sell you stuff I'm here to to talk to you about actual engineering problems So anyway the point being that after we run out of these few slides We're going to go straight to the terminal and we're going to do live demos and have some fun So hopefully that'll be a good time So Saltstack right now as I've mentioned before is an open-source project It is also backed by a commercial company We now have about 45 people in our office and a number of people around the world We are hiring so I would be very interested to to talk to people who were interested in that sort of thing I Always talk I always start my talks with with this slide Does anybody know who this is? Dennis Richie. Yeah, that's right. Does anybody know who the other one is that one's actually a little harder It's Ken Thompson. I couldn't tell if somebody said that if you did well done The reason that I showed the slide. This is Dennis and Ken at 18t Bell Labs This is what's called the the Unix room and this is Where much early work on Unix was done The reason that that I bring this slide up is because it's important in the DevOps movement I think to remember where we came from Because right now we're in a very very interesting space where operations and development are coming together And DevOps is well known for having a very broad set of tooling But the reason that I that I point these guys out is that there was a point in time In the history of computing when we didn't necessarily have the idea of tooling at all In fact, we had a single machine that sat in the room and there was no difference between development and operations If you were on the team You wrote punch cards and then you walked across the room and you fed them into the computer Of course right now things have become considerably more complex As we've moved away from from single systems and moved away from physical computing Into virtualization and now recently into containerization We've seen problems that the Dennis and Ken potentially never anticipated the idea that Even very very small teams could be administrating not just one big machine in a room But potentially thousands tens of thousands or hundreds of thousands and so very very recently We've been introduced to a whole set of problems and salt stack is about solving those problems Hopefully in in new and interesting ways So I want to talk a little bit about where salt came from before we get into the nitty-gritty Thomas Hatch who is is my friend and my boss Started salt stack in February of 2001 He got his first contributor there in March 2001 and then the Holy Terror set in which is that third spot there Which is when Tom got an email Asking for a little help and it had a very interesting domain on the end it was it was linkedin.com and Tom said that's odd and He went back and forth and it turned out that Tom writing salt stack in his basement Had written something that was actually at this point deployed in and powering large parts of LinkedIn's infrastructure Which terrified him he didn't want to come out of his bit his basement at all It still terrifies him a little bit But this was well before we had a company in in 2012 and then of course, you know, we we started to hire a couple of Developers we won some awards, which is all fine and good And then from there the project really really began to explode to give you an idea of the amount of Or the level to which salt stack is a very active healthy open source Project on any given week salt stack merges somewhere between a hundred and fifty to three hundred pull requests We churn anywhere between fifty to two hundred and fifty thousand lines of code And we have about a thousand unique contributors that we deal with And which is really really wonderful and it just goes to show that if you make a popular or if you make a Project that solves real problems that that people will will show up So why do I need it? This is one of these slides delivered to me by the marketing department that I don't actually really know what it means To be to be completely honest. I just want to get I just want to get to the code, right? So stack provides predictive infrastructure orchestration and configuration management The thing that I want to say about that is that most people know about salt stack as a configuration management platform Which is all fine and good salt stack is does have a configuration management component But I think it's important to to go out and spread the word that it's not really how we view ourselves configuration management is an old solution to an even older problem You know Mark Burgess started work on a CF engine in the early 90s 93 to be exact So it's inaccurate to say the configuration management is something that suddenly Come to us as a result of DevOps or virtualization or any of this. That's just not true Nor certainly is the need for automations a new need or a sudden need but Salt stack instead takes a much broader approach to configuration management And I want to talk a little bit about what our thinking is before we get into some demonstrations about that As you begin to scale out dramatically you begin to have a very interesting set of problems one of those problems is as you have these application stack silos that begin to emerge you need to have some sort of messaging bus that can communicate between these silos and allow you or us as Dev OS practitioners or as I just call them systems administrators because that's what they are and that's what we should call them dammit Anyway We need some sort of some sort of universal messaging bus that we can use to connect These disparate systems together so that we can build complex systems That have stateful understanding of all of its components. So Salt stack is built on top First and foremost on top of a high-speed messaging bus Initially we used zero and Q Probably many people are familiar with them zero MQ with a standalone Messaging service that provides pub sub and push pull and all of these typical messaging patterns We for people who use salt stack you may be pleased to know that We're now moving In other directions and additional to zero MQ We now have in development a pure TCP Transport which eliminates the need for zero MQ Anyway on top of this this high-speed messaging bus You if you have a system that you can use to connect all of your disparate components together You can begin to solve problems Like remote execution or configuration management What we call the or what we hope is the future of this idea is something that we call event-driven infrastructure And so when you hear us talk about event-driven infrastructure What we're talking about is this idea that if you have a messaging bus that could connect all of your systems together that your entire application stack can speak to and Services that can ride upon it such as configuration management suddenly you can build truly adaptive and reactive and Reflexive systems because that stateful Understanding can work up and down the stack and configuration management then becomes something that does the heavy list lifting that allows your infrastructure To react and adapt to its own state or to its own failure I know that sounds kind of abstract. We'll do some demos that kind of bring that back down to earth You know salt is extremely flexible It becomes very very challenging in fact to talk about Because we see salt as being much more of a toolkit Or even a distributed operating system than simply a configuration management platform Salt at its core is highly highly pluggable As we'll see during some of our demonstrations. We have right now. We're shipping with salt about 23 different pluggable systems from remote execution to to state stateful management To log handling to to whatever you like And that pluggability and that modularity means that in addition to just being a software package that you can download from github We have tried to design it so that it's something that is very very easy to use as a development tool Inside your own workflow to add additional modules to what have you As I've mentioned now, hopefully several times salt is extremely scalable Salt is in many many deployments now that are in the tens of thousands And in fact, there are many deployments in which salt it controls many tens of thousands of Minions, which is what we call the machines being controlled from a single master, which is the controlling machine So our scalability in that direction is very very good and there are several deployments which are which are now reaching The many many tens of thousands and probably soon into the hundreds of thousands Security obviously all of this is is is backed by a well-tested encryption framework And of course remote execution is where things started And the reason that that we started there is because that's the problem that we were trying to solve initially, right? Because this was that was back in 2011 Right at that time we had puppet and we had chef and we wanted to be able to do very basic things, right? For example run a single command on a thousand or in ten thousand machines and doing stuff like that in puppet And in chef being the declarative Configuration management languages that they are is not as easy as it could have been And of course many many other people were solving that with other tools at the time fabric and was and still is very popular But the fact is that most people were still solving this with bash scripts, right? And that you know more or less worked fine But of course if you're using bash scripts to try and do remote execution to try to run Singular commands against many hundreds or thousands of hosts it becomes slow and you have to deal You know with drift, right? What if I have different login credentials different operating systems? What if I need to do something more complex with the output than just use t or write to a file or whatever it is? And what if I need to do this many times so you think to yourself, oh, okay, no problem I'll build a script, right? And you do that and you think okay. Well, this is fine. This is working, you know for the time being but again It's really hard to scale that sort of approach, right? Because you need to do great, you know error handling and logging and authentication and all of this stuff I don't have to explain this problem to you. Everybody here is has dealt with it, right? And then of course, you know you deal with even more problems, right? Like, you know, how do you detect? You know properly detect conditionals between disparate environments for example, you know, like different OSes, right? Or very basic orchestration problems, which are sort of hard to handle in a bash environment, right? I want to do X on a group of servers Y before, you know, Z happens and less A, B or C, right? That can be very hard to manage in strictly a bash sort of SSH environment, right? And of course, keeping external data secure is challenging. So we've built the SaltStack infrastructure. This is one of those graphs that essentially means nothing. We'll look at all this stuff anyway. So forget about it, all right? So salt, as I mentioned before, is is based on a master minion model. I don't think I have a... No, I don't unfortunately... Okay, great. Thank you. Salt is based on a hub-and-spoke model, right? The idea that we have a central controlling machine, right? Or machines, right? Called masters, right? And then we have multiple minions on them, okay? One of the ways right now in which there is a battle in the configuration management space is between the idea of agent-based and agent-less systems. You've probably heard this debate if you talked about this. What's unfortunately not well known is that salt is both, right? Salt both has an agent-based approach in which you run demons on particular machines, right? You can run them on your minions, which of course gives you a very, very rapid response time. The memory footprint is very low and it allows you to have something always running in case you need to do remote execution very, very quickly or orchestration or what have you. But it also has an agent-less mode, which we call salt SSH, which means that you don't need any type of demon running on these minions. You can in fact connect and use all the power of salt simply over SSH. We'll look at that here in a couple of minutes. Salt has an open API for third-party cloud and software integration. We actually have our own cloud deployment platform. It's called Salt Cloud and what it does is it allows you to connect to and provision virtual machines on many, many different commercial cloud providers or your own private cloud. Be it LXC or OpenStack or whatever it is. And it allows you to command and control and provision those machines. I'm sorry, it allows you to provision those machines and then it allows you to turn things over to salt for command and control. No more slides, finally.  Okay, let's do some demos, okay? Now, I'm going to run through a couple of things that I just generally think are interesting. If people have questions along the way or something isn't clear or if you want to to see something different, please don't wait until the end. Please feel free to raise your hand and and we can go back and forth. So what we have here just to give you a walkthrough kind of what we're looking at, this window down here in the lower left, this is going to be our salt master, okay? All right. It's very easy to start. Salt, in case I haven't mentioned it before, is written in Python. It's very easy to contribute to and it runs on a very, very wide variety of machines. Everything from REL5 to AIX to Solaris to Raspberry Pis. Pretty much whatever you like, we will support. I'm going to bring up a single minion and I'm going to connect it to this machine. Over here is a regular terminal, okay? And what we can do is we can illustrate that, first off, that command and control, actually, let's do this. This is the Salt CLI. It's how we do remote execution. And There's a demo fail right there. There we go. As you can see, Salt is quite fast. Now, you may be saying to yourself, well, okay, Mike, this is not the most elegant demo because all you're doing is basically sending a ping to one machine, which is local to this one and asking for it to reply. And to that I say, fair point. But what if we did something like this? Actually, not that. Actually, let's do this, dash, dash, master. So what we're going to do here, let's be very brave. Let's bring up, oops, 100 minions. Okay. We'll do that. Now, I should point out that right now I'm running the Salt Master in open mode, which means that it blindly accepts connection requests. Of course, in a production environment, authentication initially is a public key to communicate shared AES key. And so normally you authenticate things that way. But for the purposes of the demo, we're not going to do that. So let's ask ourselves, all right, we were able to communicate with a single minion in 0.19 seconds. Let's look at the response time. 400 minions. Not bad, all right? 0.26, 0.27. So you can see that Salt scales pretty well in terms of adding additional hosts. The load on the master is quite light. Let's now actually look at some code. One of the things that I like most about Salt is that Salt takes a very, very open approach. We don't like magic, right? We like easy to understand interfaces that appeal to people who can actually go and look at code, all right? So in terms of remote execution, I mentioned this modular framework. Here are the remote execution modules which Salt ships with out of the box. As you can see, there are quite a lot. There are some PYC files in there, of course, so those are duplicates. Ignore those. But just in terms of what you can do with a very basic Salt installation, you can, let's see, let's clean out these PYC files so that we can actually see here. So let's see what might be interesting to look at today. How about any requests? I couldn't quite hear that. I'm going to need a microphone. Oh, the font size, yeah. Is that better? Oops. One more? Or is that good? A couple of more. Okay. This is going to be hard for me to see, but I'll give it my best. Okay. All right. Well, let's just look at a very simple one here, all right? Okay. All right. Okay. This is manipulating, right, a host file, okay? Obviously, this is Python, right? But what we do is we map remote execution directly to the function signatures in these files here, right? And so what that means is if we want to use the add host module, right? Obviously, we see the documentation there. It's quite straightforward. Add a host to an existing entry. If the entry is not in place, then create it with the given host, right? So, okay, that's easy enough, right? Let's do, all right, salt, right? Let's do this. So we give it a target, all right? Add host, right? 27. Actually, let's do <IP_ADDRESS>, right? Fubar, right? So you can see there, right? We've got the function signature IP alias, right? That maps directly here into the command line, right? The two arguments that we need, right? I keep forgetting to do that. Oh, sorry. So the way that this works, right, is that it's module name, function name, right? So it should be really straightforward. Obviously, over here, right? This file is called host.py and the function that we're using is add host, right? Yep. Okay. There we go. Done. So, right? So, you know, whether it's one machine or a thousand machines, remote execution command and control becomes very, very easy. Now, the other thing that I want to point out is that it should be, if you know any Python at all, very, very easy to write your own execution module. Literally, right, all you have to do, let's write one called rootconf.py, right? Okay. Def say hello, right? And actually, let's do, just do this. Okay. Okay. We may need to restart this guy. Okay. And we called this rootconf.say hello, right? Very simple. So if we, you know, if as a part of your continuous deployment or as a part of your day-to-day system administration needs, instead of encapsulating all of this in batch scripts or even worse in a wiki or, you know, just in your head somewhere, you can actually encapsulate very, very easily your commonly used system administration commands directly into Python functions, simple, easy, no problem. Any questions about that? So, yeah. So I think what you're asking is about targeting here. Okay. So as you can see here, the syntax is salt, and then a target, right? And then a function to run, and then any arguments to pass it into that function. Because I have all of these other minions running on the same laptop, it doesn't make any sense to have all of the minions write to the same host file, which ultimately is the same file, right? Obviously, if you were in a real infrastructure and we had, you know, a thousand minions, then, yeah, it would be something that looks like this, okay? Oops, like that, right? Okay. So that's really, really nice because I do want to talk about targeting for a second, and I'm actually running out of time a little bit. Salt supports very complex targeting, and the way that it does that is that we have a system called grains, right? Grains are similar to puppet facts if you've ever used those, right? Let's look at what grains might look like, right? Okay. Just like that, right? So you could see there, here's a bunch of information. Of course, you can write your own custom grains. Interestingly, you can either declare custom grains in a configuration file, right? i.e., to say, this host is part of cluster x or part of y, or you can write a Python that will then generate and produce a grain. So do something like go out and query a database and figure out which cluster I should be in, so on and so forth, right? You can see here this particular minion has some roles, so then what I can do is something along the lines of this, right? Actually, let's, font? Oh, thank you. Is that better? Okay. Let's do, let's target everything with this particular, let's just do this, everything that's running Arch Linux, right? Oops, yeah. So root conf.say hello, okay? So we can build really, and we can do compound targeting, right? We can do, you know, grains. We can do lots, all sorts of things. We don't unfortunately have time right now to go through all of it. Before I run out of time, though, I do want to look at Salt's state system really quick and give you a quick run through of what that looks like. Since configuration management, of course, is something that many, many people end up using Salt for, okay? So let's go here, all right? Salt has this concept of SLS files, their state files, and we're using the same paradigm here, right? This idea that we can write states, i.e., in Python, right, with a particular function signature, and then we can simply write data structures, right, which map to those. I'll give you an example since I'm not going to do live coding right now since I'm running out of time, but I'll give you an example of how that might look, right? So what we have here are our two states at the very beginning. The first line is an ID declaration that's completely arbitrary, and then secondly we have a state module, right, and a function. This is extremely similar to, all right, I got the font this time, all right, to what we saw in execution modules, right? If we look at this, all right, and I should say that it's not required that you have to go in and look at the code. Of course, this is all, you know, heavily documented on the web, so on and so forth, so please don't assume that you have to pop open the code every time you want to do something. But as you can see, this maps quite cleanly into the function arguments here, right? The name, right, sorry, I'll make this bigger, user minute, hour, so on and so forth, right? Of course, when we talk about stateful configuration management, right, the idea behind it is that it's idempotent, right, i.e., that if you run the same command, unlike simply remote execution or something from the shell, if you run the same command multiple times, the first time it, or every time rather, it will look for whether or not the thing that you want to be true is enforced. If it is not enforced, it will enforce it.  So let me show you what that looks like, okay? As you can see, right, we've gone through just that first block there. So these state files, our state configurations are quite easy to write. If you don't like YAML, which some people don't, obviously this is YAML, SALT is completely data agnostic. If you want to use Mako, if you want to pass the stuff in with Pi DSL, so long as you can pass SALT a data structure of your choosing, we're completely fine with it, which I think is really, really nice. They're not strictly a DSL, they're just a data structure representation, right? So to give you an idea of how this would render, the question was whether this is really a DSL or what we're really looking at here. This is really just a data structure representation. Just to give you a crash course on YAML, if you see the colon at the end, you're looking at a key value pair. If you see the dash, right, you're looking at a list, so on and so forth. So this breaks down quite quickly.  Okay, so, all right. In this case, what we're doing is we're calling state.sls. State is an execution module, which just happens to be the entry point for the state system, for the configuration management system. We're calling the sls function, and we're giving it the name of this state file here, which as you can see is cron demo, right? Oops, and I did exactly the same thing again. And this failed for some reason. Let me comment this out here. Very pleasant. As you can see, this is an example of a configuration management system being idempotent, because if we look at this crontab, we can see that in fact this does already exist. If we edit it such that it does not, right, and we run this again, obviously it's added it. If we run it again, it says that it is already present, right? So this is how we go out and we enforce states on a system. Of course, salt like many other configuration management engines does have a complex requisite grammar, and that's just a fancy way of saying we allow you in state files to create a dependency tree such that you can say only enforce state x if state y happens to be true, right? Or for example, watch what's happening in state x, right? Watch the configuration of my Apache vhost configuration and if it changes, restart Apache, so on and so forth. Any questions about how that operates? Oh, okay. I wanted to look and see what the last thing that I wanted to talk about here was. What I want to do at the end here is do a couple of things. We talked about this messaging bus. In salt, we call it the event bus. And the nice thing with the event bus is that it's effectively universal. You can use it as a part of your continuous deployment process. You can use it for monitoring. So for example, you could tell your application to signal or drop signals onto the event bus every so often. You can have salt watch those signals and when one of those signals happens to hit, you could invoke the configuration management engine to make a change to your infrastructure, which I think is a very, very powerful paradigm, which is what I would like to close with today. Oh, I do actually, before I do that, want to show you salt SSH just in terms of, well, actually, no, we really don't have time. But salt SSH, of course, does everything that we just did, right, i.e., whether it's with the state system or with remote execution, but it doesn't require a demon running on the other side. In that case, that actually opened up an SSH connection to the local host. No demon required. It stood up a salt system, which is how these agentless approaches actually work, which I think is very, very interesting, right? Because in my view, memory isn't necessarily saved if you have to use it every time you want to deploy something, right? To me, that doesn't strike me as a particularly compelling argument for agentless architecture, but it is very valuable in things like deployment, right, or provisioning, but it may not be as appropriate for the long life cycles of machines. So to just jump back real quick, I want to conclude with this demonstration of the reactor system. What I want to do here is show you that, we have this idea of runners. Runners are master side pieces of Python that can go out, execute arbitrary commands, do things in an ordered way, but it runs entirely master side, whereas obviously the remote x stuff and the state configuration management stuff runs minion side. Okay. Oh, that's not good. So what I want to do here is show you the reactor system, and what the reactor can do is it can watch this event bus on the master for salt events or events coming from your application or what have you, and then map the detection of those events into your state system for configuration management or what have you. Okay. All right, prepared this already? All we need to do here, right, is enable what we call the reactor, give it an event tag to look for, that's this, right, and a state file to run, which is that. Okay. All right. For purposes of demonstration, we will see that the state file, cleverly, looks like this. This will be the end of the presentation because when this minion starts up, it will fire an event saying that it has started up. The salt master, the reactor will detect that event and then it will run this, which will, in theory, shut the laptop down and end the presentation. And if it doesn't, then I'll just have to stand up here all day. So hopefully it works. Okay. So we'll restart the salt master here to make sure that we have that configuration. Okay. And here we'll, in this guy down here, you'll see the events flying past. All right. And here is the, what should be the minion starting up. All right. And thank you very much. That's it. And I know that we only covered bits and pieces of salt. There's so much. Obviously, we're going to be giving a training class on Sunday. Please come by and see the many, many, many things that we didn't get a chance to cover and talk about your individual deployments and how salt can fit into your infrastructure. It looks like I have just a couple of minutes, so I'm happy to take some questions. Oh, I have 15 minutes. Oh, okay. Well, I can take some questions. Hi. I have a question on salt. Actually, we have built a scheduler on top of Jeff that has got pre-built cookbooks and recipes. We found some performance issues and we're trying to migrate to salt. Uh-huh. One of the things that we found in salt was you showed that a minion actually runs in your laptop, but when you go to an infrastructure, your minion needs to run inside a virtual machine. Sure. So in terms of Jeff, we have got an ability to bootstrap that virtual machine and the minion connects to the master. To get around this problem, what is that you would suggest? The typical workflow for that in salt is to use salt SSH to connect to the machine. Salt has its own bootstrap engine that can either download directly from GitHub or wherever you like, and you can use that to bootstrap the machine and have it connect to a master. You could also potentially use salt cloud itself to deploy the machine and that also has the ability to bootstrap it, actually to bring the entire virtual machine up, whether it's in a public cloud or a private cloud, deploy it with salt and then connect it to a master. Does that answer your question? Yeah. We tried salt cloud as well. Salt cloud needs to run inside the virtual machine, right? Salt cloud just needs to run on a Linux machine. It doesn't need a master running at all. But it needs to run by the minioness, right? Sorry? It needs to run by the minioness, right? No. It can run standalone. It doesn't need a minion running. Okay. Thank you. Hi. So basically, we are using salt in our infrastructure. So what we wanted to know is the same thing like how we can dynamically host to the master without any manual intervention. Right. So the question was in a highly dynamic infrastructure, how you can add minions. So this reactor demo is actually a very, very popular, a good illustration of how that might be done, right? So the classical way that people do that is they bring their minions up, right? Watch for that connection, right? And then perhaps invoke key acceptance or whatever your security policy is going to be, right? And then from there, once the key is accepted, you should be able to go about your business with command and control. One more question here is basically when we are bringing up a container, is it dependent on the MAC ID anyhow? Because what we are doing is we are maintaining the same IP address and the same minion ID. But every time I destroy the container and bring up the key, means it doesn't match. But I have the same fingerprint. Right. Yeah. So salt uses public key authentication for the key exchange, right? If you bring up a new minion with the same ID, salt is just going to generate a new set of keys, right? So that's what's happening there. So what's happening is you're presenting this new set of keys. The master is like, aha, you're trying to trick me. You're not who you were the last time I saw you. And so it's rejecting the session. What you want to do is either preserve the keys or manage that in some other way with being aware of that condition. Hi. Hello. Thank you. So there may be a few odd slash corner use cases where the runtime state of the application may necessitate a few changes to your to your infra. So is there like a non-command line tool interface also? So where then from my application, I could actually invoke salt and make it do things to my infrastructure. Are you looking for a graphical? No, no, no. Just to change the state of my infra at runtime. So there's maybe something in my caching layer that's changed. And now I need to, you know, update the conflicts of a few machines to reflect that change. Right. Are you looking to do that automatically or? Automatically from within the running app. Right, right, right. So yeah, I mean, that's part of the event driven infrastructure view that we have, right? So in our sense, it should be very, very easy to write a small bit of Python or call out to a CLI, right? From whatever service is making the change, right? Announce onto the salt event, event bus that the change is being made, right? The salt master and the reactor, just as in that last demo, watches for that change and then configuration management happens in response. And that configuration management can be very simple, like the one we just pointed out, or it can be very complex orchestration with many dependencies and what have you. It just depends what you need. Hi. Thanks for the nice introduction to salt. Could you touch upon the distributed capabilities of salt? For example, can I have a, you know, cluster of minions sharing distributed state across them? Can I have a high availability in my minions and my master and things of that nature? Right, right, right. So right now in terms of the distributed state, it's brokered by the master. And so, you know, you can create clusters, but there's, you know, messaging is still going to be brokered in that way, right? Now you can, you know, there are some limited decision engine capabilities on the master, right, to decide who's going to get what information and you can do some filtering. We're doing some development work in that area to try and make things better. In terms of true distributed peer-to-peer communication, we have the ability to publish from the minion messages or remote execution destined for other minions, right? But it's not a distributed mesh in the way that like a classical distributed system might be. Does that answer your question? Yeah, do you have plans to extend that? We're trying, yeah, we're trying to go in that direction. Yeah, very much so. Right now, we're engaged in a transport layer addition, adding TCP transports and a couple of other custom transports. So that's a direction that we'll be going. Thanks. I have a question about orchestration. I did mention. Hi. Thank you. Thank you. So I did see orchestration somewhere in the slide, you know. Could you just elaborate more on how exactly orchestration has been done? Sure. Orchestration is one of those words that's like cloud was in 2006 or 2007. Everybody's saying orchestration and nobody really knows what they mean. So let me tell you what I mean when I talk about orchestration. Orchestration is the idea that through targeted sets of, we call them minions, right? Through targeted sets of minions, right? You can have a deployment process which has dependencies between those sets, right? So let me give you an example of how that might look. A typical orchestration workflow might say something like, okay, I'm going to deploy my application, right? Therefore, make sure get checkout happens, right? If the get checkout is successful, then go over here to my load balancer cluster and take down 10% and then, right, start to do that deploy on the web tier, so on and so forth with the ability to create those dependency chains and of course fail hard and potentially roll back at any point where that stuff fails. Great. So of course a workflow that you sort of set up based on rules, it sort of go ahead and execute. Can it go and talk to multiple different, I would say, systems in the data center because it might, yeah. So can you just give some examples on that? That's what I was most interested in. Of multiple different systems, do you mean like servers as well as network gear? Yes, servers, networks, yes. I believe, yes, that should be the case, right? What I mean to say, let's say I've got SAP and I have got, let's say, I don't know, Active Directory and I have got Apache server. All of them are part of my infrastructure because it's heterogeneous. So how exactly I can do orchestration here? Right. Yeah, I mean very much, you know, in the way that I've already talked about, you know, because, you know, you can put minions on all of these machines, you can control networking gear like Juniper gear, right? You use salt state files to declare how that orchestration is going to operate, right? What the workflow for your deployment process or whatever it is is going to be. And then, of course, you just kick off that orchestration either, you know, in an automated fashion or manually. And later we can probably talk about the particulars of your infrastructure and get into how that might work for you. I saw another question I thought. Yeah, there it is. How do you test or unit test those plugins? Yeah. How do we unit test the plugins? Yeah. We use a lot of magic mock, actually. So the unit testing is heavily mocked. A lot of people ask about how do they test state files like infrastructure testing, all right, which is a different question. Salt, I didn't demonstrate it, but salt has a test equal true mode, right, which basically will go out, you know, examine the state of the systems and determine whether or not it will make changes. Yeah. Did that answer the question that you had? Yeah. Okay. Oh, the plugin side. Yeah, yeah. So, yeah, we have our own test suite. Unfortunately, it doesn't take two minutes to run. I was very jealous of that. But yeah, there's unit testing and, of course, there's integration testing for the plugin stuff as well. Absolutely, yeah. The test suite that we have is very well done and very elaborate and quite easy to run on your own machine. Yeah. There's, you'll just want to download. We maintain a separate repository for our testing dependencies. So you'll just grab that and then you'll be off to the races. Yeah. Hi. Hi. So how is it different from Ansible? I mean, I see a lot of advancement over Puppet in SaltStack, but how different is it from Ansible and what are the parts that I have using SaltStack over Ansible? Okay. Yeah. Ansible is a very popular product. This can be a hard question for me to answer because I don't want to speak for the Ansible people, but I'll just speak in generalities. I think Ansible tends to be focused more on the provisioning deployment side. Our view is that machines, even in immutable infrastructure, machines have life cycles, right? And you need to manage a machine beyond the point that you simply install the packages that you might need. So conceptually, our approach is more focused on the complete life cycle of the system versus the initial deployment step. Of course, the big and most notable difference is that Ansible talks a lot about being agentless. Salt, of course, has an agent-based and an agentless mode, which I believe makes that point moot. They focus a lot on simplicity, which certainly has value. However, complex infrastructures have complex needs, and that's not to dismiss simplicity as a principal or a virtue. But we would much rather solve hard problems even if it makes the software slightly more complex. Does that answer your question? Hi. Yeah. One is the selectors.  Okay. And how users can define that? Yeah. And the other one is, given you are, you were talking about salt in a cloud-based environment, right?  You see there is disparity between machines that are supposed to be the same, but they aren't. Usually in a declarative framework, the machines themselves come to a state that has been well-defined. In an imperative framework, you could, there is a possibility of entropy. So how do you deal with that? Right. So I think part of that's, I'll address the second part of the question first. And I think the question was mostly about imperative declarative differences, right? So to fill people in a little bit about this, there has been a very long debate in the configuration management community about whether declarative approach is the correct one or whether an imperative approach is the correct one. To give you some feedback or to give you an idea, a declarative approach declares the intended state of a system, right, in a very general sense. Whereas an imperative approach says, do x, do y, right? Sorry, I missed the last part. Yes, where things are elastic, right?  And so when things, you know, come and go, right? You know, there is, there certainly comes a certain point where your application has to be aware of what's happening, of machines coming and going. Salt can, to answer the first part of your question, salt can target either via machine ID, via grains information, right, i.e., you know, facts about the machine, right? Private data, which we call pillars, which that machine might contain.  So if you need another targeting system, right, if you need, for example, to be able to pull from a database, right, somebody needed like CCO range once, I don't know if anybody's ever used that, as a targeting system and they plugged it in. So it's really whatever targeting system you need, but those are the ones we ship with salt right now. Hello, hi. Yeah, what do you talk about a particular scenario? Say I want to manage a lot of minions and these minions are installed on systems which are mobile in nature. Okay, and these systems are connected to the master through a very inconsistent internet connection, you know, which is very flaky, very slow. Such a scenario is salt a good choice? It depends on the extent to which you're going to want to command and control these machines. Salt, 0MQ is TCP based, right, which is, which kind of should be enough said, right, TCP is not necessarily designed for extremely long running session times and for really, really quick session reestablishment. What I would do in the scenario that you're describing is use one of our alternative transports. We have written our own network transport called rate, it's the reliable asynchronous event based transport, it's UDP based and it's much more resilient in the sorts of situations that you describe. And that's like production grade ready to be used something like that. Yes, it's being used in production at infrastructures in the tens of thousands of nodes right now. Okay, cool. Hey, this is a question, it's more about like, can you provide a brief info about what's the Windows support for salt, because that's something kind of a pain point when you compare different of the tools in the same domain. Yeah, so salt does have Windows support. We actually just finished master support for the Windows, which not a lot of people know. But yeah, Windows is a first class citizen for salt. We actually just hired about three months ago now a Windows development team. So we now have full-time Windows developers. Obviously, there has been a little bit of a backlog for Windows bugs, but those are rapidly, rapidly going away. So the improvement that you'll see on the Windows side in this most recent release is probably miles ahead of what you've seen in previous releases. Thank you, Mike. Please take the rest of your questions offline. We're out of time. So Mike's workshop is only going to have 12 participants. So please register quickly at the registration desk to get into the workshop. Thank you, Mike, and thank you, Sequoia, for getting him here.


Yeah, okay. So I'm here to talk about piecing together code application and Helm charts into one repository. I'm Omar, I'm a staff engineer at the Infra Group at SNCC where we practice platform as a product aiming to lower the cognitive load of our developers. Most of a long time using Augusta Day, really amazing to see so many people in this room today. And yeah, so I'm here to talk about one of the most common practices and documented as best practice of separating application code from the Kubernetes configuration. Because two years ago, we kind of broke it and combined them together into one repository. So our story really begins with two repositories. We follow the best practice, we create a repository for the application code and a repository for the Helm chart that has the Kubernetes config. And we build a deploying pipeline, a very simple one. It's build an image and it then changed the image tag to the version that was need to be deployed. And most of the time that was great, but in some use cases that increases the cognitive load significantly. And one of the best examples was when adding an environment variables. Because when adding an environment variables, the developers start with changing the code, introduce a code change that uses that environment variable. And that will deploy with the simple deployment pipeline, but nothing happens in the application because that environment variables not being called, nothing has changed. The developer need to remember, it's need to now get clone the Helm chart repo. So he does that, get clone, he finds the right service in that monorepo, the GitOps repo. He changed, he reduced the new change of the environment variables, he opened another PR, he gets another review, and then he's standing in the room and he's asking how I'm going to deploy that weird GitOps repo, I just clone it. I have nothing, this is the first time I'm doing a PR, he's standing there and asking for help and then he's come for us. That cognitive load, we don't want. I believe we can do a better developer experience for our developers. But best practices has a good reasons and Argos CD is doing amazing job in documenting that reasons. So we went after them and first one is separation of access in some organization. Different people change the Helm chart from the people that write the code, that's not relevant for SNCC. At SNCC, the application developer does everything. They own the whole application end to end. The second one is sometimes you can modify only the manifest and that can trigger a faster CIN CD, although that's true. We just saw having two different ways to deploy is not the best experience. Application can be built from different services so this is still possible under a solution but we found that it's not the most use case in SNCC. So in most applications in SNCC, the application builds from one repository. It can have different third parties but only one place with SNCC code. So rolling out those three, we're left with clean audit log and infinity CIN CD loop in the case where you aim to commit back the version to the same repo with the application code and then you trigger another CIN and then trigger another CIN. So the question is can we combine those two into one but have a clean audit log and without infinity CIN CD loop? And we found that the answer is yes, we just need to find a different place to commit the version. We still want a version. We still want it to be inside Git. So finally, our solution was to use the app of apps repository. So we already have that, we already had an apps of apps repository with the application CRD inside of it. This is what create all the application inside the cluster and we added the version of the application to the values. So every service now has a version for the pre-pro, the staging cluster to the production cluster. It can be different in the deployment system but eventually it will be the same. And now the application CRD template, the Helm chart can use that version. So we can see it's going to find the right version per the cluster and we'll inject that as Helm parameter to the Helm template. So the application can use that image tag value inside their versions, inside their Helm chart, sorry. And combining this together, we now have only one deployment pipeline because everything is inside the same repository, both the Helm chart of the application and the application code. We have only one deployment. It will always build a Docker image. It will always change the right version once for pre-prod, once for prod and it will actually do two things. So it will sync the app of apps, the application CRD itself, it will set the right application image tag parameter and then it will go and sync the application itself. So that solved that problem but we also got one amazing benefit from that. We now also have a version for the Helm chart. So we're not tracking the main anymore for the Helm template and we don't need to set different branches for different environments. We don't need to set different values or find different weird ways to deploy that GitOps repository. We can use the same version and have the Helm chart in the same version of that as the application code. And with that, we achieved, we reduced the cognitive load of the developers. We allow them to work on only one repository, one deploying pipeline and with one version of the Helm chart. So thank you and see you later.