and successors, the Holy Quran, states, dear creator, omnipotent of the world, accept our regards and respects towards your chosen messengers, Abraham, Moses, Jesus, and Prophet Muhammad, who brought the message of justice, spirituality, and proper behavior and compassionate comportment to the people of the world, and they destroyed the foundations of injustice and lack of fairness to allow humans to build a new world for their future. Ladies and gentlemen, Mr. Secretary-General, the foundational need for a better world is justice. All of the hopes and aspirations of humankind are built on justice, and they have the capacity for the creation of such a framework of all-encompassing justice, which means elimination of injustice. We are defenders of a fight against injustice in all of its forms against humanity, against spirituality, against the Almighty, against the people of the world, no matter where it may occur. A wish to be closer to the Creator and the teachings of the Creator exists in all humanity, and the willingness for change is witnessed in revolutions throughout the history of humanity. Even though a lot of movements never reach the maturity of a revolution, many of the revolutions deviated from their original path. However, the success of many people and nations such as the nation of Iran in the realization of their aspiration for the Islamic revolution has strengthened in the heart of the people around the globe such aspirations. The Islamic revolution of Iran was the realization of the movement of the people of Iran towards justice and fairness. Even though faced with a lot of plots throughout the decades, it has been able to safeguard itself as a first step, the nation of Iran based on an advanced social and organizational order created the Islamic Republic of Iran in order to create justice internally and bring to the world order a message of justice and fairness. Key components on this path where spirituality, multilateralism, ladies and gentlemen, I am grateful and honored to be the representative of a people in a nation that has inherited a great civilization that has been free for millennia and has always managed to defeat the plots of the enemies that sought to conquer it. A nation that has always seen oppression as an existential enemy and has always fought in order to destroy the enslavement of Babylonians all the way to the Palestinians we believe in a common fate for humanity and we are for the globalization of justice what we seek for ourselves we wish on to others as well and what we do not wish for ourselves we do not impose on others. The nation of Iran believes that justice brings unity brings cohesion and warfare is a destroyer of all things for a country that wishes internally to have justice but then outside of its own borders creates or trains various terrorist groups and unleashes them on various nations must be ashamed in the face of humanity must be ashamed when faced with principles of freedom and justice and fairness humanity does not only belong to certain segments of the world the Islamic Republic of Iran by taking aspiration from its constitution and the values the spiritual values upon which it is based sees as one of the most effective ways to safeguard human rights and has used the most useful tools in order to realize and assist in the realization of the rights of all of the oppressed across the globe sees that as one of its inherent duties the Islamic Republic of Iran rejects some of the double standards of some governments vis-à-vis human rights and sees that as the most important factor which has rendered banal the topic of human rights in the eyes of many because this is something that is currently taking place at this course that is taking place in the Islamic Republic of Iran where we started speaking of and creating a dialogue about the deaths of tens of innocent women in a Western country so until we have these double standards where attention is solely focused on one side and not all equally we will not have true justice and fairness human rights belongs to all but unfortunately this trampled upon by many governments the native tribes of Canada whose bodies bodies of hundreds of their children were discovered in mass graves in a school the rights of the Palestinians the right to life of the occupied people of an occupied people of those who have fallen victim to terrorism those who seek freedom and refuge but only to have their children locked up in cages all of this shows that the place of the accused and the defender must not be judged solely as it is represented by some it does need a foundation which many lack these days in order to claim the right to safeguard human rights when talking about and remembering the savagery and the crimes of ISIS of Daesh that enslaved Christian and Yazidi and other religious minorities women and children it shows when we entered the arena to defeat them it shows that we have been clearly on the side and as defenders of human rights and those who defended and promoted Daesh ISIS had to be seated at the table of the accused dear ladies and gentlemen gathered here today we see today that we are witnessing a change of the world order a unilateral world a world of hegemony a world in which in which finance financial power gains control over standards of behavior where criminal and oppressive sanctions against nations and the use of international organizations as a tool of oppression and exerting pressure on defenseless nations in other words we're speaking of a world completely privy of justice and fairness so this order has lost its support in the thought of nations and people throughout the globe a new order has been has been shaping up to take its place and it's undoubtedly it's without a doubt that it will be created from Lebanon to the Palestine occupied territories all in all over our region we see the defeated policies of such an old system now we see terrorism we see the trampling upon of native cultures and religions and standing unjustly against multilateralism unilateral actions all of these have created great challenges on the path to human progress we firmly believe that in order to face the challenges old challenges as well as new frameworks in the world we have no choice but cohesiveness and unity based on multilateralism and justice based on shared human and common values based on divine teachings there is no other path we believe that all freedom seeking nations have their hearts tied to such deep rooted values and the defense of all of these values against the oppressors across the globe rests on our shoulders what we seek is the right of the Iranian nation of the Iranian people a relationship based on oppression will not be tolerated we will stand firm and proudly defend the rights of our people and our nation we believe that any oppressive action is an action against world peace and stability which is a threat to the entire world reaching security throughout the world through any path other than justice will not be sustainable or permanent and that is precisely what we expect of the united nations to support and do of course the implementation of justice and fairness is quite challenging and difficult and perhaps it is because of that that many of those who claim to be on the side of peace they run away from the responsibility of peace so we say on to them since you do not wish to carry the burden on your shoulder do you not even wish to carry the burden of fighting against oppression our belief is deeply rooted in the Quranic culture that says do not be oppressors nor oppress anyone and the fate of many nations is tied to exactly these principles those who run away from the logic of character fairness and justice run to unilateralism and oppressive powers a nation that lacks logic relies on coup d'etats military interventionism boots on the ground a chosen and unfair selective fighting against terrorism and many other injustices the use of nuclear weapons did that take the world closer to fairness justice and peace or did it become the foundation for hegemonic powers the killing of hundreds of thousands of Yemeni iraqi syrian and afghan children which human value did that serve were these not the evil faces of the total lack of justice and fairness in many parts of the world and in reality what does it what does the islamic republic of iran seek other than obtaining its own logical and fair right which has caused havoc and chaos among the oppressors of the world dear colleagues today the willingness to move in support of hegemony has become a sore point for humanity throughout the world and it is a serious threat it is the wish of the nations across the world on an increasing basis to obtain justice independence while enjoying security at the same time the realization of the front of resistance shows i repeat it the realization of the doctrine of resistance shows the extreme and deep rooted willingness of many people to obtain true justice whereas unilateralism has been the tool that has used that that has been used to hold many countries back on a selective basis america cannot accept that certain countries have the right to stand on their own two feet and they keep equivocating militarism with security the friends of america do not enjoy a better situation what is occurring today in europe is a mirror image of what has occurred in western in western asia in the past few decades the the comportment and the result of the movement of the troops throughout these regions all she have yielded the same results because all of them have shown that the fate of many countries shows that america has pursued her own interest at the expense of the interest of many other countries mr secretary general dear colleagues the islamic revolution in iran was the beginning of the movement of a great nation of iran to seek her own place in the world and through the decades we have been faced with foreign plots such as coup d'etats oppressive sanctions as well as hegemonic interventions but none of the successes of the iranian nation have been acceptable to the great powers from the time that the first president of the islamic revolution of iran miss the late mr rajah he showed the soul of his feet that had been tortured savagely and placed his foot upon this podium four some 40 years ago and showed the scars of the torture that he was subjected to at the hands of the shah secret police after that speech in this very hall he was martyred by the hypocrites about a decade after the late imam humaini made it so that the nation of iran could was able to repel foreign aggression from her territory and be in charge of her own destiny the people of iran who have themselves been victims of terrorism have today become a supporter that can be counted on in the fighting and terrorism throughout the region today the islamic republic of iran in order to reach her just aspirations has spent much capital from the time when saddam hussein torab the al-jir's a court and attacked iran in an unprovoked manner all the way to the time when the american government trampled upon the nuclear accord and we saw a new face of criminal behavior against humanity sometime ago the previous president of the united states of america announced that ices was created by the united states of america for us it makes no difference whether ices daesh was made by which administration a rich american government what matters is that a government on the other side of this planet decided to bring havoc and chaos to the geography of our region at the expense of the lives and the blood of women and children and the innocence but the islamic republic resistance put an end to that movement to that destructive movement and the leader that descended into the arena of the fight against terrorism was no one other than the beloved late martyr general asem solimani a man a freedom seeking man who became a martyr on the path of obtaining the freedom of the nations of the region and the previous president of the united states of america effectively managed to sign the document of the savage crime and illegal crime and immoral crime and what was said in so many words shows that the oppression that is imposed upon the nations of the region in such a fashion it has managed to heal some of the broken hearts that we saw in result of this crime the proper pursuit of justice in the face of a crime that the american president admitted to have put a signature on will not be abandoned we seek through a fair tribunal we will pursue through a fair tribunal to bring to justice those who martyred our beloved general asem solimani ladies and gentlemen the history of iran is the history of a nation that has learned to stand on her own two feet and not to lean on anyone else to depend on anyone else iran learned this lesson after in both world wars it announced its neutrality yet was always subject in both wars to occupy foreign occupation and after in the 1950s when it came towards america and relied on america in order to obtain the national dream of the nationalization of the oil industry it was again betrayed and after the nuclear accord was signed and accepted within the framework of the united nation security council even that accord was trampled upon unilaterally mr secretary general ladies and gentlemen who the nation of iran has learned the policy of resistance and progress which has been focused on pursuing because of an advanced and logical social order in which the islamic republic of iran today despite the oppressive sanction has become a strong country with many impressive goals in the fields of technology and knowledge and expertise that have been obtained we do believe that the world today needs a strong iran today while having the capabilities to export and in addition to our exports of oil and gas we do have distribution networks for electricity throughout our vast nation in knowledge knowledge seeking uh biosciences nanotechnology nuclear sciences we are at the forefront and iran's growth in these sectors is considerable and it shows our social efforts were in many instances for example when we have tried to bring universal health care coverage to 85 million people and the pursuit of the will of the people is a foundation of the system of the islamic republic of iran whereas during the times of the imposed war by iraq against iran we were even prevented from being able to purchase barbed wire but today we have been able to manufacture through indigenous knowledge and capabilities the most modern needed systems to defend our nation people of the world dear colleagues mr secretary general it wasn't that our enemies took a step back it was our nation that managed to drive all of her enemies from the arena by participating in an impressive and unprecedented fashion in the islamic revolution to solidify values of faith and divine will in the second step the policy of good neighborly relations progress in economic and trade relations have now been brought to the forefront of the islamic republics foreign policy we wish to have extensive relations with all nations throughout the world particularly with our neighbors neighbors war is not the solution to crises dialogue and conversations and negotiations are the true solutions the islamic republic of iran as a powerful country in the region is present and willing to solve crises during the past few years the regional trade of iran has seen impressive increases and we have now entered with our neighbors into a new season of expansion of friendly neighborly and brotherly ties this brings stability this brings security to all sides we proved during the hard times of all of our neighboring countries that we are the true friends during the numerous conversations that have had with regional leaders one of the main points was that the regional security must be be born from within and not from the outside and the way to realize that is collaboration and cooperation not by forming opposing blocks we must rely on brotherly and friendly relations if we leave the fate and the destiny of the nations of the region in their own hands then the occupiers will be gone and neighbors will remain for one another in eternity in a not too distant past we saw the fires of war between the two brotherly nations of iraq and iran by the encouragement of enemy powers throughout the world but today we see the marches of arba in in observation of the 40th day of the martyrdom of imam hussein we see that that grand glorious march takes place in observance of that martyrdom and in order to renew our faith in those values and to respect those who gave their lives the descendants of the prophet who gave their lives for human dignity and human values uh dear colleagues i would like to direct your attention to one of the most egregious points that shows the oppressive powers present in the region the region has not seen previously such a occupying savage power such as the design regime in its midst in the past the killing of children and women are present in the dark report card of the Zionist regime it has managed to form the biggest prison in the world in Gaza and the building of the expansion of settlements and housing on illegally on Palestinian territories and on Palestinian farms and the killing of their children and new generations shows everyone that seven decades of Israeli occupation and savagery is still with us and not ending but the world powers must show why they keep running away and evading the solutions proposed by the Islamic Republic of Iran in order to resolve the Palestinian crisis all of the Palestinian territory from mountains region to the sea requires only one solution which is the reliance on the votes of all Palestinians composed of muslims christians and jews in a completely comprehensive referendum the occupying Zionist power that has occupied Jerusalem and occupies other lands in the region cannot be a partner for security and stability dear colleagues allow me to focus your attention on another face of lack of justice and fairness which is the double standard used when speaking of the nuclear capacities nuclear science capacities of the Islamic Republic of Iran and we all know that it's for only human and peaceful endeavors but some countries are keen on portraying this as a threat in order to sweep under the rug what they should rightly face themselves which should be denuclearization and i announce as the leader of the government of the Islamic Republic of Iran the Islamic Republic of Iran is not seeking to build or obtain nuclear weapons and such weapons have no place in our doctrine this has been brought into the framework of a fatwa of an official fatwa announced by his eminence supreme leader Imam Homen E and a sharia-based fatwa issued by his eminence is more valuable than any measures with any outside or international agencies and all of this is taking place in an environment where countries themselves who seek to show us unjustly as a threat keep pursuing nuclear weapons and development and testing and have made a gift of those weapons of mass destruction to the Zionist government and those governments that must be disarmed are awarded but those who are observing proper frameworks are even threatened by npt measures and in a framework where only two percent of the nuclear activities of the world are taking place in Iran Iran has been the subject of 35 percent of nuclear inspections i will repeat only two percent of world nuclear activities are taking place in Iran 35 percent of nuclear inspections are in Iran so i ask all of those here present today to please focus on the next following points with precision one the Islamic Republic of Iran with goodwill signed an agreement accepted an agreement in 2015 and in a first phase did live up to all of her commitments without any exceptions but the result of that was the trampling upon by america on that agreement and as them they said themselves said in so many words it they were unprecedented measures oppressive sanctions measures in history sanctions sanctions are an imposed punishment on the people of Iran further for being freedom seekers a weapon of mass destruction that's what sanctions are and abiding by those or cooperating in the implementation of those is helping oppression take root it would too it was america that trampled upon and left the agreement not iran the international atomic energy agency issued 15 different reports stating precisely that iran had remained fully committed to all of her commitments number three iran while simultaneously paid the price for having lived lived up to her commitments but as a result of the trampling upon by the united states and the cooperation of the european side by the united states has man has not been given the opportunity to obtain the rewards of such agreement the rights of such agreement we did give the ample opportunities for those who trampled upon and left this agreement to return to it we have been extremely flexible and had it not been for our flexibility the negotiations would have stopped in the very first few days the logic of negotiations of iran is a just analysis of what is going on and our wish is only one thing commitment observance of commitments now the issue of guarantees is not just for something that may happen we're basing that on lived experience we're speaking of the experience of america having left the jcpoa and we have a year year and a half of negotiations with the current american government to return for her to return to the fulfillment of her commitments and while today they speak of observing their commitments to this deal they keep repeating the same old stories of the past which puts a great deal of doubt on her true commitment to return to this agreement thank you


Hi, everybody. Welcome to our talk. Thanks for joining us today. I'm Flavio Castelli from SUSE, and I have with me a colleague of mine. Hello, I'm Rafael. I'm really glad to be here. So we are here today to talk about how to keep your Kubernetes cluster secure by writing policies, tailor-made policies for them. So security is a really big topic for Kubernetes as well. There was a recent survey that provided a really staggering information. So 97 percent of organizations are concerned about the security of our Kubernetes cluster. Digging deeper into this number, there are many areas of concern for them. But if you look at the first one, the one at the top, this is about having policies that are applied in a consistent way across different teams, Kubernetes clusters, and it's not there. But looking into this state report, another important piece is not just applying policies for the sake of keeping things secure, but also to keep the infrastructure compliant. So there are policies that are not just securing the infrastructure but are making sure that compliance is happy as well and is enforced. So this is impossible to be done by hand to have something that scales that is consistent. So the answer to that is to handle policies as code as well, in the same way as we handle infrastructure as code, we can write code that describe policies and Kubernetes has already some powerful mechanism built into it. You have row-based access control that basically defines who can do what inside of the cluster, like let's say the user alpha can create parts inside of a staging namespace, but he can't create them inside of the production namespace and he can't list them only inside of certain namespaces. So our back policies are really important and the key aspect of keeping your cluster secure, but they are just focused on one problem and that's fine. To have a completely secure cluster, you have to pull in different solution, each one of them tackling an aspect like pod security policies which are there to basically prevent user from creating containers that have more privileges, that can offer a wider attack surface. By the way, pod security policies are also deprecated right now. They're going to be dropped soon by Kubernetes ever going to be replaced by new mechanism or by admission controllers, which we're going to talk more about pretty soon. There are networking policies, I just mentioned over them. They are there to prevent network communication between unwanted containers. So you might want to say, I have these database running inside of my cluster, and I want only the pods running the front-end service gas book to be able to talk with it. So this is what the networking policies are about. Then you have admission controllers. Admission controllers are there to basically decide whether something with a request that has already been accepted by our back can be completed or not. So what happens is that the user Rafa, before he wants to create a pod. So our back says, Rafa wants to create a pod inside of the namespace staging, that's fine. I am going to approve that. But then after this is approved, there are one or more admission controllers that might be interested in evaluating this request. So what these controllers do, they look at the JSON object which describe what is about to happen. So this user is starting to create this pod with this specification instead of this namespace, and then using some business logic, they are going to decide whether this is something that can be completed, so it's accepted or something that should not be allowed. So it's rejected. There are also cases where you have admission controllers who have the ability to mutate an incoming request. So they can approve the request, but change that on the fly, so that the end result is something different.  To do that, you also want all your users to specify resources whenever they declare a workload. So when a user is not declaring the resources for his workload, a mutation admission controller can fill in some default value so that the user is happy because his request is accepted and the operator is happy as well because the default values for resource consumption are enforced and are put into place. So this is what mutation admission controllers are about. So Kubernetes provides a lot of built-in admission controllers that are actually part of the binaries of a control plane, but of course they can't cover any possible scenarios. So let's say that, for example, you want to prevent users from deploying containers that are coming from the Docker hub. So there's no way that one of the built-in admission controllers of Kubernetes can do that for you. But luckily, Kubernetes has a way to extend its admission controllers. And this is done through the dynamic admission controllers. In this case, you have an external admission controller, an external as in it's not part of the control plane, it's not part of the Kubernetes official binaries. This is a workload that usually is running on top of the same Kubernetes cluster. They are implemented as webbook endpoints. So they are simple web application that receive the JSON blob to examine from the Kubernetes API server and then they provide back an answer to the API server. And then the API server based on what the admission controller responded back is going to accept or reject or accept the mutated version of the original request made by the user. So they're really powerful, but if you want to write a dynamic admission controller from scratch, this becomes pretty boring and repetitive because there are many operations that you have to keep doing over and over again every time you want to create a new policy. And this is basically a big waste of time. So unless you have a real specific use case for which we start from scratch, what everybody is doing is to leverage what are called Kubernetes policy frameworks. So here you can see open policy agent, there is also gatekeeper, which is basically based on that. You have Kaiverno and there is Q Warden, which is what we're going to talk about. So these are basically, you can see them as platform as a service. So you provide some your policy, which is just the business logic of it. And then you deploy on top of this pass that is then going to do the heavy lifting of integrating with Kubernetes and doing many other things for you. So you just focus on writing the policy. Talking about writing policies, who is supposed to do that? So again, from a really recent survey, you can see that there are clear expectation here. So there are still security teams instead of organization that are just doing security work and they are expected to provide some policies for their clusters, but the expectation is that developers and operators, they are going to provide ways to secure their cluster, which includes also the act of writing policies. So the reason why we started this project called Q Warden is because we think there is a better way for writing and maintaining policies. We really want to lower the barrier here to make it easier for these people to cope with the amount of policies they have to write and maintain. Also, we want to provide a different and simpler way to consolidate all these policies and distribute them. So how did we do that? Well, as you might have guessed from the title of this presentation, we leverage WebAssembly. WebAssembly is a key point of this solution. So for the ones who don't know what WebAssembly is, I'm going to do a quick overview. So WebAssembly is a binary instruction format. What it means, it means that you start from a program written using a programming language like C++, Rust, assembly script, which is kind of JavaScript, a Go, and then you run it through a compiler and the compiler, instead of producing a Linux x86 binary, it's going to produce a WebAssembly module. These binary artifacts, you can take it and then you run it on top of a WebAssembly runtime. The WebAssembly was born for the web. So the first WebAssembly runtimes were browsers that were using WebAssembly that are using WebAssembly to extend their capabilities. But WebAssembly is so interesting and powerful that recently there have been a lot of efforts to run WebAssembly to standardize the usage of WebAssembly also outside of the browser. So you have WebAssembly runtimes that are not browsers that you can run on top of any operating system. So the interesting aspect here is that regardless of the runtime, be it the browser or a standalone runtime, WebAssembly modules do not care about what is the underlying operating system or architecture, and this is pretty powerful. We will see that pretty soon. So why is WebAssembly a game changer for policy offer? Well, that allows the usage of WebAssembly allows policy offer to be productive since the beginning. They don't have to learn domain specific languages just for the sake of writing policies. And so by just using a language they are comfortable with they can just be productive since day one. And this is not just about writing policies. Policies as code means that you must have someone who is also going to review these policies, hopefully someone who is not the author of the policy. So by using WebAssembly, by being able to use regular programming languages inside of your team, inside of your company, you suddenly have many people who are able to review policies, write them, maintain them. So this is pretty powerful.  Also, let's say that you want to write a policy that performs some semantic versioning check. Well, this is easy. You just go ahead and look for a semantic versioning library for Rust and just consume that as you would do with any kind of regular program. Also, you can go ahead and reuse the existing CI CD pipelines that you have in place to ship your code. You just reuse them to ship policies. So what can you do with the policies of Kubewarden? Well, we provide to policy offer several SDKs. We have SDKs for Rust, for Go, for Swift and many more are coming. With these SDK, you can easily write policies that validate or mutate objects. So you have a full spectrum of possibilities covered. Also, we offer you the ability to pull some extra information from the cluster while evaluating the incoming objects. So for example, let's say that you want to write a policy that is validating ingress objects. So looking just at the ingress object that is about to be created is not enough because you need to know what are the other ingress objects that are already part of the cluster. So this is what we call context-aware policies and this is something that we cover as well. Now you are a policy offer, you created your policy, you're happy with it. The next step is to distribute the policy. So here, WebAssembly can be pretty handy for us because WebAssembly modules, first of all, are really small. It's refreshing if you compare them to container images. So to give you some ideas, a WebAssembly policy written in Go is about 300K. A Rust one is 101 megabyte and half. A Swift one is nine megabytes and half. The size depends on how mature the compiler is when it comes to producing WebAssembly modules. As you can see, Swift is not there yet but things are improving. So these are really small compared to regular container images and most important of all, they are portable. As I said before, WebAssembly doesn't care at runtime whether it's running on Linux or Mac, on ARM, on Intel. That means that as a policy offer you can build your policy on your Apple machine running on Apple Silicon and then run that very same binary unchanged on top of the Linux cluster using Intel as the underlying platform. So this is really interesting. The way the policies are distributed then, actually, practically speaking, we are distributing them using container registries, which is pretty handy, we think, for container operators, sorry, for cluster operators because inside of the regular container registry you end up having your container images and also the policies that are going to regulate this application or your cluster. And that means that all the processes that you use to distribute container images, you can apply that also to the distribution of a keyboard and policies. All the mechanism you have in place to secure the container registries for images, you have them in place also for your policy. So this is really a smooth transition for operators. Also, when it comes to the policy themselves, the actual end binary, WebAssembly is really flexible because it allows us to enrich the final file with some additional metadata. And we took advantage of that to bundle into the single WebAssembly file information such as the name of the policy, the version, the license, all of that. But I think it's really interesting that we also bundled inside of it the documentation of the policy. So if you find a policy, you already have bundled the usage of the policy inside of the same file. Also, we provide some metadata that is then used to scaffold the Kubernetes custom resource definition that you use to enforce a policy. And Rafa will show that into the demo later on. So you have all this information in a single place in a single file moving across different registries always in sync. And last but not least, these policies, you can run them also outside of Kubernetes. Rafa is going to show that to you. And this is pretty handy because an operator can discover a policy, download it, run it outside of Kubernetes to see how it behaves and then automate all of that inside of maybe a CI system to make sure that the policy is still doing what is expected to be doing. So this is really flexible and handy. Another key aspect of WebAssembly that we're leveraging is security. So as I said before, WebAssembly was originally conceived for the web to be used by browsers, which are exposed to many kinds of attacks. So when the WebAssembly format was designed there were a lot of efforts spent to make sure that certain type of attacks cannot be done when executing WebAssembly binaries. I don't want to dig into the details. There is a link on this slide. Go ahead and look at it. It's pretty interesting stuff. So, given that we are a project in the security space is also pretty useful for us to know that WebAssembly is offering some safety when it comes to run these binaries that you find on the policy up, which Rafa is going to show to you later. Also another key aspect that WebAssembly provides is isolation. So all the policies, all the WebAssembly modules, generally speaking, all WebAssembly modules are run inside of their own sandbox, be it inside of the browser, be it outside of the browser. In our case, we have a component which is called the Polish server, which is the place where all the policies are run and are used to evaluate incoming requests. So these software is written using Rust and using a WebAssembly runtime call wasn't time and wasn't time is provided to us for free sandbox and inside of each sandbox, we have a policy. So all the policies are unaware of other policies that cannot see each other and they cannot even interact with the host. On top of that, when we deploy a policy server inside of the Kubernetes cluster, we are running that inside of a regular Linux container. So we have even more isolation added on top of that. One last important aspect of WebAssembly, another feature that we're leveraging is that WebAssembly is kind of, it's a universal format. So as soon as you have something built into WebAssembly, you can just reuse that. And so I mentioned in the beginning that there are other ways to write policies for Kubernetes. The first project in this space was Open Policy Agent and there is also Gatekeeper, which is based on that. So Open Policy Agent has policies that are written using a query language, which is called Rego. So the interesting fact is you can take a Rego policy and then build that into a WebAssembly module. So you can do the very same thing with the Gatekeeper policy, they're all Rego files. The interesting thing is we instructed our WebAssembly runtime so it can understand policies of OPA and Gatekeeper and that leads to a really interesting scenario where you have a policy server of Q Warden, which is not just running a Q Warden native policies, like I don't know a policy written in Rust or one written in Go. It's also writing side-by-side policies that were written for OPA or for Gatekeeper. And we also updated all our tooling that Rafa is going to show to you so that you can distribute these WebAssembly binaries created by OPA or Gatekeeper. You can distribute them with OCI registries. You can enrich them with the metadata so that you have the documentation, the usage, the scaffolding all together. So this is really leading towards Q Warden being a universal platforms for your policies, which means that if you already have invested into OPA or Gatekeeper, you can reuse all these technologies. Now, another, one last topic I want to touch and this is not about strictly speaking WebAssembly, but more about policies code. We want to have policy treated in the same way as all the other parts of your infrastructure. So you're already, you're interested. You want to know how your application are performing, how your infrastructure is performing. You want to have observability on your policies as well. So because of that, we extended the SDKs of Q Warden so that when you write a Q Warden policy, you can also generate trace events from it. And then we instructed the policy server so that it can collect all these events and then push them to an open telemetry collector. So by doing that, we enable deep introspection into how policies are behaving. So here you can see that we collected an event which describes the execution of the policy, which is basically the evaluation of an incoming request from Kubernetes. And we pushed that through open telemetry to a Yeager endpoint. And here with a Yeager view, we can drill down into the policies and see how they are behaving, how they are performing and deep down into a single request. We can see all the different steps that the policy took to evaluate. So this is all for me, this is all. Now I want to show to you how everything looks like in action. So Rafa is going to give a really nice demo to you. All right, thank you, Flavio. Okay, so let's go ahead and define the problem first that we want to show because we are going to work with policy for this demo and I would like to explain first what we want to achieve. So let's say that we have a cluster on our organization and that this cluster is only exposed in services to be consumed by our users. And so we want these services to have valid certificates. Let's see what we are using as manager as well. And so what we are doing is on our ingresses, we are annotating our ingresses with the cluster issuer that we want for let's encrypt using sort of manager. And so we have two cluster issuers. One is the, let's say, the staging one and the other is the production one. And so in this case, despite the ingresses valid in itself, what we want to achieve is to only allow ingresses that have the production annotation one because if someone by mistake deploys the ingress with the staging annotation, then it will be exposed to the world. And then everyone could see that the certificate is not valid early. It comes from a staging let's encrypt certificate. So for that, I know that I need to change the annotation. So let me go ahead and share with you the policy hub because this is what we use to find new policies and this is how it looks. So I know that I need to work with annotations. So what I would do in this case is look and search for annotations and we see a policy that actually builds perfectly. This policy, you can see that it works on any kind of resource, it's a super generic policy. It has a homepage, it has more information. But the important thing that we want to see here is that we can copy this URL and this is where this is coming from. So this is where it's published. We can just go ahead and pull that one. So, okay, I copy that and then I will go back to my terminal and you can see now, let's go ahead and share the terminal. And now you remember that we copied that URL. So I'm going to use KWCTL. KWCTL is the CLI go-to tool for Q Warden and KWCTL allows you to do a lot of things. For example, it allows you to run policies locally without the need of having any Kubernetes cluster. You just have a policy, a Wasm policy and then use KWCTL to run that policy with some settings. For example, with KWCTL, you are also able to annotate the policy. As Flavio said, our policies have also metadata that goes with the binary itself and with KWCTL, you are able to annotate the binary. So let's say that it's expanded with this metadata. With KWCTL, you're also able to pull policies from a registry or an HTTP server or you're able to push policies to an existing OCI registry. And so KWCTL works in a sense like if you think about Pullman or Docker where you have like Docker images or Pullman images. So in this case, you can run KWCTL policies. We have a store, a local store in your home directory here. So KWCTL is only for your local development or local testing. So if I run that, I have an empty output because I didn't pull anything. And since I copied and pasted before on the policy hub, the URL, now I can just go ahead and pull this policy. And this is going to pull this policy inside the store that I was talking about. That was empty on the previous step. So now it finished, I just pulled it. And now if we try to list policies again, we see now that we have one policy only in our store and that it reads some information from the metadata because these policies are already annotated inside the OCI registry. And so it can read some information from it. And as you can see, it says that it's not a mutating policy, it's just a validating one. It's not context aware because this is just going to evaluate the request in isolation. It also provides some SHA, SHA-SAM for the policy itself, the size of it. So you can see some basic information about it. But you can also see more information. And this is going to go ahead and read the annotations from the binary itself. So we can run KDVC in inspect for the policy that we pulled. And now if we go to the top of this command, we see that it has some details. Like who is the author or the authors, the URL, source, license, whether it's mutating or not, context aware, what is the execution mode. So you can see some things. Also the rules, for example, this policy is super generic because since it's only checking annotations, this works on the metadata and basically it works on any kind of resource. So what this policy says is that I can work on any kind of API group, any kind of API version, any kind of resource and for operations create an update. And I'm validating this kind of resource. Of course, then when you deploy this policy on a real cluster, you can narrow down what requests it is evaluating. An important bit here is that this policy says that it can understand any kind of thing. And if you had another policy, for example, that is very tight to validating some kind of pod, for example, so you are sure that it has, I don't know, validating. It has a liveness probe, for example, and to reject any kind of pod without liveness probes, you would say that it would target pods, for example. So that would be a very tight policy to the result of this evaluating. And so you also have a free form text usage where the policy offer can write anything they want here. So you know how to use it. And this is, as I said, free from text and you can see here what kind of settings it allows, what kind of settings it understands. And we're interested in constraining annotations because we want to ensure that any kind of fingers that this created inside this cluster will only be tied to a production, let's include cluster issuer from CERN Manager. And so let's go ahead and look for a request, this one that has a production one. So if we look at the request, this is our request that got recorded from the API server. You can see that the cluster issuer in this case is let's include production. So this would be a request that we actually want to accept. And so we can go ahead and evaluate the request with KWCTL run. And we are able to provide some settings to it in a JSON format, you can also provide that in a file that contains this JSON. But here we are saying, okay, we constrain the annotations and this annotation in particular, so it's the cluster issuer from CERN Manager has to be let's include production. And so the request path is a request that I previously stored from the API server. I recorded it somehow or I generated it. It doesn't really matter but it needs to be a valid request from the API server because this is what the API server will ask for if you deploy that to production. And then you say what policies you want to run. So in this case is the one that we saw on the policy hub is basically the same URL. And now we see that this is a load. So this is the answer from KWCTL. This is the answer from our policy and this is the expectation because this is actually a production one. Now let's go ahead and see a staging one. So if I look for issuer again here you can see that this one has a staging that's in feed cluster issuer. This should not be accepted in this cluster because we don't want that. And so if I try to basically run these policies with the same settings because we still want only production ones but I target this request that is the staging one. What I'm getting is that the value of sermanet as issuer doesn't pass the user defined constraint which is the expected response from it and it's not a load. And now let's go ahead and now that we are able to run this locally to go to the policy hub, search for it, pull that, inspect it, see how it works, see the documentation of it in an offline mode, let's say like locally in my machine, in my laptop or desktop. Now I want to go ahead and deploy this to a real cluster, to a real Kubernetes cluster. And this is where QBotan is super useful because it will do a lot of the paperwork or Kubernetes of Kubernetes for us. It will do many, many things for us and we just have to deploy the custom resource from QBotan. In this case, this is the cluster and mission policy. And the cluster and mission policy is a resource that is able to say, you can deploy as many of cluster and mission policies as you want in a cluster. They can target cluster wide resources, they can also target namespaces resources in any namespace. And so you are able to basically deploy all your policies targeting wherever you want. We will introduce also namespace one, so people who don't have these privileges to create this kind of cluster wide resources can also perform some kind of compliance into their own namespaces. But for now, this is the way we work with this custom resource. And we have a sub command for KWCTL which is able to scaffold a manifest for us. And so we can run the manifest sub command with a type cluster and mission policy. This is the only one that we have right now. So I was saying, and we can request KWCTL manifest to fill some settings for us. So this is the settings we are interested in because the constraint and this is the one that we want, the production one. And this is the policy we want to generate the manifest for. And so if I go ahead and generate that, it goes into the standard output and I can see that this cluster and mission policy, it gets a name that we would like to configure later on. But yeah, did we get the module over there? This is the URL again that we will see before and the settings that I requested the manifest will also provide. And the rules are automatically filled from the manifest from the metadata of the policy. Of course, I could narrow down this for right now and just target ingress because this is what I'm interested in. But for now, it's fine. You can just keep it as it is. For example, it also says it's mutating in false because it also reads this from the metadata of the policy. So this is the manifest itself. So now let's go ahead and actually deploy that on Kubernetes. So I'm running the same command on the type that KWCTL apply. If I run that, it will take a second and I will get the generated policy created. And now this is being deployed by the keyboard and controller that is doing all this paperwork for us. So we just need to wait for the webhook to be configured and then we will be set. So now it's our policy right now is completely working. Like it's completely activated. Now let's go ahead and look again for a production ingress resource. In this case, again, as you can see, I am going to create this ingress resource that has the cluster user let's include production, which is the expected one. So if I go ahead and deploy this one, it should be accepted. Okay, that is fine. And now let's try to do the same thing. But this time, if you look at that, it's the let's include the staging one. And if I try to apply this one, we get an error back from the policy. The server is coming from the policy server and it's coming from the policy on the same and from the policy in the end. And so this is what we have in terms of how you can go ahead, find some policy on the policy hub, pull them into your local store, inspect them, generate some manifest for Kubernetes and deploy it on top of Kubernetes. And you can see that everything is pulled from the registry. And in this case, the GitHub registry, but any kind of OCI registry works and everything works out of the box and in a nice way. And now let's go for the second part of the demo in which I have a gatekeeper policy and I went ahead directly to their GitHub project. And I went ahead and just downloaded, copied and paste one policy called required labels. So what I want to do right now with this policy is to enforce that we have on every resource that we create. For example, this could be a rule inside the forward company. Every kind of resource needs to have an owner. And so the required labels is super useful for that. And so if we look at the required labels policy from gatekeeper, we see that this is coming from Regal, we have the packets, we have the entry point that is called the violation and basically I don't want to go too much into the details but we have like this, this is the query. This is the entry point that we want to call. And so we have two ways of violating this policy. One is by not providing the label that we are requesting from the settings. And the other is by providing a valid value for the key provided on the setting. So there are two ways to violate this policy. And so let's go ahead and build a policy. And for that, I need to run OPPA build because this is a Regal policy. It's starting gatekeeper but it's written in Regal. And so I can use OPPA build and target wasn't. I can provide the entry point, which is the packets, Kubernetes required labels slash the entry point. In this case, the violation are constrained. And then I just need to provide the files where my policy is. It can be in different files across different files. So I just build that and OPPA build will generate a table for me. And I extract the policy that wasn't far from there. And then I'm going to show a request that is valid now. So in this case, this ingress resource has the label. So if you look into that, we have the owner team label here and it's pointing to an email of my company. And so this is actually fine. And if I try to run that with KW-CTL, in this case, we need to provide what is the execution mode of this policy because with Rego, you can either build policies targeting the OPPA framework or the gatekeeper OPPA is open policy again or the gatekeeper framework. And so we cannot tell the difference between them just by looking at the wasn't file. And so you need to provide some information to KW-CTL on how to execute this, how to provide the inputs, how to read the outputs from it. And so we provide the execution mode of gatekeeper. We also provide some settings over there and we also provide the request path that we are evaluating. And we also provide, of course, the wasn't file. Of course, you can annotate policies written for gatekeeper for OPPA as well. There wasn't files. So you can also provide annotations over there. You can run KW-CTL annotate on them. So you can also set this gatekeeper or open policy again the execution mode on the metadata of the policy itself and it will fly with the metadata, with the policy itself anywhere it goes. And so you wouldn't need to provide this parameter, the gatekeeper one, but right now I need to do that this ID and annotate this policy, I just built it. And so as expected, this is a load and this is fine. And now let's look at a request that is invalid. In this case, as you can see on the metadata it is lacking the labels part. So we don't have an owner over here. So this request should get rejected by the policy. And now I run that with the same settings. You can see labels, key, owner team, we are forcing that. And now if I just run that, I see that I get an error, this is not a load and this is the error that I get back from the policy. And this is everything that we have regarding the written policies. And so let me go back to the presentation. Answer that with all of you. Okay. So how do we get involved after all this? So we are, everything we do on QBorden is in the open. So everything that you want to say to us, everything that if you want to get involved in anything, just go ahead and tell us. So we have this main website called QBorden.io. You can see some information over there. We also have a blog over there where we write from time to time. We also have some documentation over there. So have a look at that. We have the policy hub. This is where we expect people to share policies, publish new policies for policy authors, discover new policies for class administrators. We have the GitHub QBorden organization where we have all our projects over there regarding QBorden. We have a number of them because it's a kind of a split project across different repos. We also have a QBorden channel on the QBorden at this workspace on Slack. So feel free to join there. And we also have the Twitter account, this is a one for QBorden. And I don't know if I'm missing anything, Flavio. No, no, everything was great. So I would say thanks to everybody for joining us today. I'm really looking forward to talk with you, to share ideas and collect your feedback. Thanks. Thank you for your time and yeah, have a great day. Thank you for staying here. Bye-bye.


YFI, Urined Finance experienced a significant drop, plunging over 35% in 24 hours. The decline led to over $4.7 million in liquidations, with contract positions once reaching $160 million. Trading data shows a decrease in both trade volume and open interest for YFI. The downturn reflects the volatile nature of cryptocurrencies, and highlights the unpredictability of the crypto market. In the roller coaster world of cryptocurrencies, Urined Finance, YFI is currently riding one of the most vertiginous drops, leaving many in the crypto community both baffled and concerned. Over the past 24 hours, YFI has nosedived over 35%, and the ripple effect of this plunge is palpable, with over $4.7 million worth of liquidations. This unexpected plummet is not just a blip on the radar, it's a full-blown storm in the crypto sea. Diving into the nitty-gritty the Urined Finance token's contract positions skyrocketed to a staggering $160 million, only to then take a dramatic nosedive. This abrupt shift in fortunes has been mirrored across major platforms, with YFI positions dwindling rapidly. But what's really intriguing here, is the trading data. We're looking at a 49.36% plummet in trade volume, coming in at about $1.09 billion, and a 20.15% decrease in open interest, now standing at $67.53 million. The derivatives data paints a picture of an asset under siege. On the one hand, you have a long, short ratio teetering at 0.9897, while the top traders' long, short positions hover around 1.02. These figures are more than just numbers. They're the pulse of YFI's current health, or lack thereof. It's like watching a high-stakes poker game where the chips are suddenly vanishing from the table. So, what's causing this drastic downturn? Let's peel back the layers. On platforms like Binance and OKX, the YFI-USDT pair shows a significant shift in trader sentiment. The weighted funding rate and open interest on exchanges like Bybit and BingX tell a similar story of a token in turmoil. It's as if YFI is a ship trying to navigate through a storm, but the navigational instruments are spinning wildly. In the midst of this chaos, the wrecked data, or losses incurred due to liquidations, is particularly telling. In just 24 hours the total wrecked amount for YFI was a whopping $2.01 million, with long positions bearing the brunt of the blow at about $949.40,000, and short positions at $1.07 million. These aren't just numbers, they're SOS signals flashing in the dark waters of the crypto market. But it's not all doom and gloom. In the world of cryptocurrencies, volatility is the name of the game. The current plummet of YFI could be a precursor to a rebound, a cyclical movement that seasoned crypto enthusiasts have seen before. It's like a game of snakes and ladders, and YFI has just slid down a particularly slippery snake. Bottom line is the dramatic fall of urn finance, YFI, is a reminder of the volatile and unpredictable nature of cryptocurrencies. While the reasons behind this plunge are manifold, it's clear that YFI is undergoing a significant test. As the crypto community watches with bated breath, the coming days will be crucial in determining whether YFI can regain its footing, or if it will continue to be at the mercy of the market's tumultuous tides. One thing is for sure, in the crypto world, there's never a dull moment and YFI's current plight is proof of just that. At this point, YFI shocked the investors in the market with its decline of more than 40% and dropped to the level of $8,200. The decline in YFI also left investors in long and short positions upset. According to data received from Coenglass, there was a liquidation of $4.04 million in YFI futures positions in the last 24 hours. Of these liquidations, $2.88 million consisted of long positions and $1.16 million consisted of short positions. YFI continues to trade at $9,200. During the dramatic drop in value, over $300 million was wiped out in market capitalization from November's gains. According to data from CoinMarketCap, the YFI token is trading at $9,200 from $14,185 a day before. However, the token is still up 83% over the past 30 days. The sell-off has triggered another weekend of fear, uncertainty and doubt, or FUD, within the crypto community. On X, formerly Twitter, some users claim that 50% of the token supply was held in 10 wallets controlled by developers. However, Etherscan data suggests that some holders may be crypto exchange wallets. Some X users pointed out that opening short positions may have triggered the move. Furthermore, on-chain analyst LookOnChain reported a significant whale transfer involving a wallet, X0X48F9, moving $446 YFI worth roughly $5.8 million, most of which was deposited into exchanges. Despite this withdrawal, LookOnChain noted that a whale profited from the transactions before the crash. This issue is coming on the heels of the project's domain registrar issues in September. At the time, the DeFi protocol users could not access the protocol through urn.fi URL. However, the issue was subsequently corrected. Urn.finance is an aggregator service for decentralized finance DeFi investors, using automation to allow them to maximize profits from yield farming. Its goal is to simplify the ever-expanding DeFi space for investors who are not technically minded or who wish to interact in a less committal manner than serious traders. Launched in February 2020, the service, formerly known as Iron, has seen huge growth in recent months as new products debuted and developers released in-house token YFI. Urn.finance is the brainchild of Andre Cronja. After leaving the Iron project in February 2020, Cronja returned to oversee a rebirth with new tools emerging and YFI going live in July. Since then, its fortunes have turned around, with assets under total value locked, coming in at just over $1 billion as of the end of September 2020. Cronja has a long career in cryptocurrency and has become synonymous with DeFi in particular. He also has positions at Smart Contract Ecosystem Phantom and Crypto Briefing, a resource dedicated to initial coin offerings, ICOs, and crypto media. Urn.finance users can face a high risk of losing money thanks to market conditions changing rapidly and opportunistic entities attempting to profit from less experienced participants. Cronja himself has sought to maintain transparency about the platform's provenance, noting that even after code audits, Urn.finance could not be guaranteed to be 100% safe. DeFi involves inherent risk. Will there be a recovery from this altcoin or is our suspicion correct? We keep observing, please don't forget to subscribe for more updates. See you in the next video.


Welcome back and we've just been joined by Muda Shiru with the sports news and analysis. Hello Muda. It's good to be here on the show. All right. Let's have it. That's definitely. We have two interesting stories in the world of sports. Most times we focus on what's going on in Nigeria and the first after take us to the Flamingos, the federal government is yet to host the under 17 women's national team that brought so much joy to us, you know, we're celebrating because that's the first time any African team will get to the bronze medal of the World Cup. So it's interesting. And this is almost 175 days after that and there's so much tension going on that why is the federal government not hosting them? Why is it that with all the joy they brought to us, we are unable to host them? Well, information getting to us is that the media aid to the minister of sports, who is a well-known sports journalist himself, I'd say that perhaps is due to the touch, a due of the president that they are going and present more moderately and so I'm scared that this is just a normal thing they do all the time. So the demand to see the president might not see the light of today. So that's why it's trending across the group and a lot of people want to let's take our mind to what they did. For example, Kwame, a player of the match award in India and she did that and I'm sure historically there's the first time any African team will do that. So we're already hoping that perhaps the incoming president will do that. We are also hoping with a few days left that the presidency at least will do something for the girls. So it's more like the old world is talking about it, it's trending, why do the federal government don't really respect or do according to the awards and I'm sure there's more to talk on that subsequent on various platforms across the social media. Away from football, it's still football matters but in the Nigerian professional football league today, what's going on across that cycle is that Bender Insurance a few days ago did something we're all looking forward to and that was against economy, like in football and in life. Most times why one side enjoys the other side is always having in myself to blame. But this time around is Bender Insurance really, really happy about what they've done. After five goals, five draws in a row, both of them, they keep drawing 0-0-1-1, they did against economy. Well now, that means that economy will probably if not get a win before the end of this season that there will go relegation. So the group leaders, the group that second Bender Insurance with 31 points after 15 matches but defeats, we further do a lot for them. But economy chance of surviving in this professional football league this season in group A, we just nine points from the same number of games, not points, not good for the well-known economy more as well. I think we should go for this track and see our interest in it is that two goals that Bender Insurance scored, unless our economy scored a lead goal but that was not enough to salvage a point for them. That's an interesting moment in some of the Memodia Stadium and that's all on this segment of the show. Let's not forget, sometimes we give you all the talking points in sports on the breakfast. Well thank you so much, Moda Shirashitu and just before we go, we give you the quote of the day which is that your present circumstances do not determine where you go, they merely determine where you start and that's from Nido Kuben. Nyan go it's time to go. Yeah, we better go. Tomorrow we are going to return here with another bumper edition if I may and we hope that you're going to be there. Until then, bye for now. Bye.