Question 15, Part 1 of Summa Theologica Terziapars, Trietis on the Saviour. This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, please visit LibriVox.org. Summa Theologica Terziapars, Trietis on the Saviour by St. Thomas Aquinas, translated by the fathers of the English Dominican province. Question 15 of the defects of soul assumed by Christ in 10 articles. Part 1, articles 1 through 5. We must now consider the defects pertaining to the soul, and under this head there are 10 points of inquiry. First, whether there was sin in Christ. Second, whether there was the fomez of sin in him. Third, whether there was ignorance. Fourth, whether his soul was passable. Fifth, whether in him there was sensible pain. Sixth, whether there was sorrow. Seventh, whether there was fear. Eighth, whether there was wonder. Ninth, whether there was anger. Tenth, whether he was at once wayfarer and comprehensor. First article, whether there was sin in Christ. Objection 1, you would seem that there was sin in Christ, for it is written in Psalm 21 verse 2, O God my God, why hast thou forsaken me? Far from my salvation are the words of my sins. Now these words are said in the person of Christ himself, as appears from his having uttered them on the cross. Therefore, you would seem that in Christ there were sins. Objection 2 further, the apostle says in Romans 5.12 that, in Adam all have sinned, namely because all were in Adam by origin. Now Christ also was in Adam by origin, therefore he sinned in him. Objection 3 further, the apostle says in Hebrews 2.18 that, in that wherein he himself had suffered and been tempted, he is able to succor them also that are tempted. Now above all do we require his help against sin, therefore it seems that there was sin in him. Objection 4 further, it is written in 2 Corinthians 5.21 that, him that knew no sin, that is Christ, for us God hath made sin. But that really is which has been made by God. Therefore there was really sin in Christ. Objection 5 further, as Augustine says in On Christian Struggle 11, in the man Christ the Son of God gave himself to us as a pattern of living. Now man needs a pattern, not merely of right living, but also of repentance for sin. Therefore it seems that in Christ there ought to have been sin, that he might repent of this sin and thus afford us a pattern of repentance. On the contrary, he himself says in John 8 verse 46, which of you shall convince me of sin? I answer that as was said above in question 14 article 1. Christ assumed our defects that he might satisfy for us, that he might prove the truth of his human nature, and that he might become an example of virtue to us. Now it is plain that by reason of these three things, he ought not to have assumed the defect of sin. First, because sin no wise works our satisfaction, rather it impedes the power of satisfying, since as it is written in Ecclesiasticus 34.23, the Most High approveeth not the gifts of the wicked. Secondly, the truth of his human nature is not proved by sin, since sin does not belong to human nature, whereof God is the cause, but rather has been sown in it against its nature by the devil, as Damascene says, in On the True Faith 3.20. Thirdly, because by sinning he could afford no example of virtue, since sin is opposed to virtue. Hence Christ no wise assumed the defect of sin, either original or actual, according to what is written in 1 Peter 2.22. Who did no sin, neither was Gile found in his mouth. Reply to Objection 1. As Damascene says in On the True Faith 3.25, Things are said of Christ, first, with reference to his natural and hypostatic property, as when it is said that God became man and that he suffered for us. Secondly, with reference to his personal and relative property, when things are said of him in our person which no wise belong to him of himself. Hence in the Seven Rules of Tychonius, which Augustine quotes on Christian teaching 3.31, the first regards are Lord and his body, since Christ and his church are taken as one person, and thus Christ speaking in the person of his members says, confer Psalm 21 verse 2, the words of my sins. Not that there were any sins in the head. Reply to Objection 2. As Augustine says in On the Literal Meaning of Genesis 10.20, Christ was in Adam and the other fathers not altogether as we were. For we were in Adam as regards both seminal virtue and bodily substance, since, as he goes on to say, as in the seed there is a visible bulk and an invisible virtue, both have come from Adam. Now Christ took the visible substance of his flesh from the virgin's flesh, but the virtue of his conception did not spring from the seed of man, but far otherwise from on high. Hence he was not in Adam according to seminal virtue, but only according to bodily substance, and therefore Christ did not receive human nature from Adam actively, but only materially, and from the Holy Ghost actively, even as Adam received his body materially from the slime of the earth, actively from God. And thus Christ did not sin in Adam in whom he was only as regards his matter. Reply to Objection 3. In his temptation and passion Christ has suckered us by satisfying for us. Now sin does not further satisfaction, but hinders it, as has been said. Hence it behooved him not to have sin, but to be wholly free from sin, otherwise the punishment he bore would have been due to him for his own sin. Reply to Objection 4. God made Christ sin, not indeed in such sort that he had sin, but that he made him a sacrifice for sin, even as it is written in Hosea 4-8. They shall eat the sins of my people. They, that is, the priests, who by the law ate the sacrifices offered for sin. And in that way it is written in Isaiah 53-6 that the Lord hath laid on him the iniquity of us all. That is, made him to have the likeness of sinful flesh as is written in Romans 8-3. And on this account of the passable and mortal body he assumed. Reply to Objection 5. A penitent can give a praiseworthy example, not by having sinned, but by freely bearing the punishment of sin. And hence Christ set the example to penitence, since he willingly bore the punishment not of his own sin, but of the sins of others. Second article. Whether there was the fomez of sin in Christ? Objection 1. It would seem that in Christ there was the fomez of sin. For the fomez of sin and the passability and mortality of the body springing from the same principle to wit from the withdrawal of original justice, whereby the inferior powers of the soul were subject to the reason and the body to the soul. Now passability and mortality of body were in Christ. Therefore there was also the fomez of sin. Objection 2 further. As Damascene says in On the True Faith 319, It was by consent of the Divine Will that the flesh of Christ was allowed to suffer and do what belonged to it. But it is proper to the flesh to lust after its pleasures. Now since the fomez of sin is nothing more than concupiscence, as a gloss says on Romans 7-8, it seems that in Christ there was the fomez of sin. Objection 3 further. It is by reason of the fomez of sin that the flesh lusteth against the spirit, as is written in Galatians 517. But the spirit is shown to be so much the stronger and worthier to be crowned according as the more completely it overcomes its enemy, to wit the concupiscence of the flesh. According to 2 Timothy 2.5, he is not crowned except he strived lawfully. Now Christ had a most valiant and conquering spirit and one most worthy of a crown according to Apocalypse 6.2. There was a crown given him and he went forth conquering that he might conquer. Therefore he would seem especially that the fomez of sin ought to have been in Christ. On the contrary, it is written in Matthew 1.20. That which is conceived in her is of the Holy Ghost. Now the Holy Ghost drives out sin and the inclination to sin, which is implied in the word fomez. Therefore in Christ there ought not to have been the fomez of sin. I answer that as was said above in Questions 7, Articles 2 and 9. Christ had grace and all the virtues most perfectly. Now moral virtues, which are in the irrational part of the soul, make it subject to reason and so much more as the virtue is more perfect. Thus temperance controls the concupisable appetite, fortitude and meekness, the irrational appetite as was said in the second part, Question 56, Article 4. But there belongs to the very nature of the fomez of sin and inclination of the sensual appetite to what is contrary to reason. And hence it is plain that the more perfect the virtues are in any man, the weaker the fomez of sin becomes in him. Hence since in Christ the virtues were in their highest degree, the fomez of sin was no wise in him. Inasmuch also as this defect cannot be ordained to satisfaction but rather inclined to what is contrary to satisfaction. Reply to Objection 1. The inferior powers pertaining to the sensitive appetite have a natural capacity to be obedient to reason, but not the bodily powers, nor those of the bodily humours, nor those of the vegetative soul as is made plain in Ethics 1.13. And hence perfection of virtue, which is in accordance with right reason, does not exclude passability of body, yet it excludes the fomez of sin, the nature of which consists in the resistance of the sensitive appetite to reason. Reply to Objection 2. The flesh naturally seeks what is pleasing to it by the concupiscence of the sensitive appetite. But the flesh of man, who is a rational animal, seeks this after the manner and order of reason. And thus with the concupiscence of the sensitive appetite, Christ's flesh naturally sought food, drink, and sleep and all else that is sought in right reason as is plain from Damocene and on the true faith 3.14. Yet it does not follow therefore that in Christ there was the fomez of sin for this implies the lust after pleasurable things against the order of reason. Reply to Objection 3. The spirit gives evidence of fortitude to some extent by resisting that concupiscence of the flesh which is opposed to it. Yet a greater fortitude of spirit is shown if by its strength the flesh is thoroughly overcome so as to be incapable of lusting against the spirit. And hence this belonged to Christ, whose spirit reached the highest degree of fortitude. And although he suffered no internal assault on the part of the fomez of sin, he sustained an external assault on the part of the world and the devil and won the crown of victory by overcoming them. 3. Weather in Christ there was ignorance. Objection 1.  Although it does not belong to him to his divine nature as suffering and death, but ignorance belongs to Christ in his human nature. For Damascene says in On the True Faith 3.21 that he assumed an ignorant and enslaved nature. Therefore ignorance was truly in Christ. Objection 2 further.  For some kind of knowledge was wanting to Christ. For the apostle says in 2 Corinthians 5.21 he that knew no sin for us he hath made sin. Therefore there was ignorance in Christ. Objection 3 further.  Therefore in Christ there was ignorance of certain things. On the contrary, ignorance is not taken away by ignorance. But Christ came to take away our ignorance for he came to enlighten them that sit in darkness and in the shadow of death. Luke 1.79 Therefore there was no ignorance in Christ. I answer that as there was the fullness of grace and virtue in Christ so too there was the fullness of all knowledge as is plain from what has been said above in Question 7 Article 9 as well as in Question 9. Now as the fullness of grace and virtue in Christ excluded the fullness of sin so the fullness of knowledge excluded ignorance which is opposed to knowledge. Hence even as the fullness of sin was not in Christ neither was there ignorance in him. Reply to Objection 1. The nature assumed by Christ may be viewed in two ways. First in its specific nature and thus Damascene calls it ignorant and enslaved. Hence he adds, For man's nature is a slave of him that is God who made it and it has no knowledge of future things. Secondly it may be considered with regard to what it has from its union with the divine apostasis from which it has the fullness of knowledge and grace according to John 1.14. We saw him as it were the only begotten of the Father full of grace and truth. And in this way the human nature in Christ was not affected with ignorance. Reply to Objection 2. Christ is said not to have known sin because he did not know it by experience but he knew it by simple cognition. Reply to Objection 3. The prophet is speaking in this passage of the human knowledge of Christ.  Nor are we to understand this as if he had been some time a man without knowing it but before he know, that is, before he is a man having human knowledge, literally, the strength of Damascus and the spoils of Samaria shall be taken away by the king of the Assyrians. Or spiritually, before his birth he will save his people solely by invocation as a glass expounds it. Augustine however, in one of his homilies, says that this was fulfilled in the adoration of the Magi. For he says, Before he uttered human words and human flesh, he received the strength of Damascus, that is, the riches which Damascus vaunted. For in riches the first place is given to gold. They themselves were the spoils of Samaria because Samaria is taken to signify idolatry. Since this people, having turned away from the Lord, turned to the worship of idols. Hence these were the first spoils which the child took from the domination of idolatry. And in this way, before the child know, may be taken to mean before he show himself to know. Fourth article. Whether Christ's soul was passable. Objection one. You would seem that the soul of Christ was not passable. For nothing suffers except by reason of something stronger. Since the agent is greater than the patient, as is clear from Augustine in On the literal meaning of Genesis 12.16 and from the philosopher in On the soul 3.5. Now no creature was stronger than Christ's soul. Therefore Christ's soul could not suffer at the hands of any creature. And hence it was not passable. For its capability of suffering would have been to no purpose if it could not have suffered at the hands of anything. Objection two further. Tully in his questions says that the soul's passions are ailments. But Christ's soul had no ailment. For the soul's ailment results from sin, as is plain from Psalm 40 verse 5. Heal my soul, for I have sinned against thee. Therefore in Christ's soul there were no passions. Objection three further. The soul's passions would seem to be the same as the fomas of sin. Hence the apostle in Romans 7.5 calls them the passions of sins. Now the fomas of sin was not in Christ, as was said above in Article 2. Therefore it seems that there were no passions in his soul and hence his soul was not passable. On the contrary it is written in Psalm 87 verse 4 in the person of Christ. My soul is filled with evils. Not sins indeed, but human evils, that is, pains as a glass expounds it. Hence the soul of Christ was passable. I answer that a soul placed in a body may suffer in two ways. First with a bodily passion. Secondly with an animal passion. It suffers with a bodily passion through bodily hurt. For since the soul is the form of the body, soul and body have but one being. And hence when the body is disturbed by any bodily passion, the soul too must be disturbed, that is, in the being which it has in the body. Therefore since Christ's body was passable and mortal, as was said above in Question 14 Article 2, his soul also was of necessity passable in like manner. But the soul suffers with an animal passion in its operations, either in such as are proper to the soul, or in such as are of the soul more than of the body. And although the soul is said to suffer in this way through sensation and intelligence, as was said in the second part, as well as in Question 41 Article 1. Nevertheless the affections of the sensitive appetite are most properly called passions of the soul. Now these were in Christ, even as all else pertaining to man's nature. Hence Augustine says in On the City of God 14.9, Our Lord having deigned to live in the form of a servant took these upon himself whenever he judged they ought to be assumed, for there was no false human affection in him who had a true body and a true human soul. Nevertheless we must know that the passions were in Christ otherwise than in us in three ways. First as regards the object, since in us these passions very often tend towards what is unlawful, but not so in Christ. Secondly as regards the principle, since these passions in us frequently forestall the judgment of reason, but in Christ all movements of the sensitive appetite sprang from the disposition of the reason. Hence Augustine says in On the City of God 14.9 that Christ assumed these movements in his human soul by an unfailing dispensation when he willed, even as he became man when he willed. Thirdly as regards the effect, because in us these movements at times do not remain in the sensitive appetite but deflect the reason, but not so in Christ. Since by his disposition the movements that are naturally becoming to human flesh so remained in the sensitive appetite that the reason was no wise hindered in doing what was right. Hence Jerome says commenting on Matthew 26.37 that Our Lord in order to prove the reality of the assumed manhood was sorrowful in very deed.  So that it is a perfect passion when it dominates the soul that is the reason and a pro-passion when it has its beginning in the sensitive appetite that goes no further. Reply to Objection 1. The soul of Christ could have prevented these passions from coming upon it and especially by the divine power. Yet of his own will he subjected himself to these corporeal and animal passions. Reply to Objection 2. Tully is speaking there according to the opinions of the Stoics who did not give the name of passions to all but only to the disorderly movements of the sensitive appetite. Now it is manifest that passions like these were not in Christ. Reply to Objection 3. The passions of sins are movements of the sensitive appetite that tend to unlawful things and these were not in Christ as neither was their fomes of sin. Fifth Article. Whether there was sensible pain in Christ. Objection 1. It would seem that there was no true sensible pain in Christ. For Hillary says in On the Trinity 10.  And further on he says, The only begotten assumed human nature not ceasing to be God and although blows struck him and wounds were inflicted on him and scourges fell upon him and the cross lifted him up. Yet these wrought indeed the vehemence of the passion but brought no pain as a dart piercing the water. Hence there was no true pain in Christ. Objection 2 further. It would seem to be proper to flesh conceived in original sin to be subject to the necessity of pain. But the flesh of Christ was not conceived in sin but of the Holy Ghost in the Virgin's womb. Therefore it lay under no necessity of suffering pain. Objection 3. Further the delight of the contemplation of divine things dulls the sense of pain. Hence the martyrs in their passions bore up more bravely by thinking of the divine love. But Christ's soul was in the perfect enjoyment of contemplating God whom he saw in his essence as was said above in Question 9 Article 2. Therefore he could feel no pain. On the contrary it is written in Isaiah 53 verse 4 Surely he hath borne our infirmities and carried our sorrows. I answer that as is plain from what has been said in the second part the Parsprima Secunde Question 35 Article 7 for true bodily pain are required bodily hurt and the sense of hurt. Now Christ's body was able to be hurt since it was passable and mortal as stated above in Question 14 Articles 1 and 2. Neither was the sense of hurt wanting to it since Christ's soul possessed perfectly all natural powers. Therefore no one should doubt but that in Christ there was true pain. Reply to Objection 1. In all these and similar words Hillary does not intend to exclude the reality of pain but the necessity of it. Hence after the foregoing he adds nor when he thirsted or hungered or wept was the Lord seen to drink or eat or grieve but in order to prove the reality of the body the body's customs were assumed so that the custom of our body was atoned for by the custom of our nature. Or when he took drink or food he exceeded not to the body's necessity but to its custom. And he uses the word necessity in reference to the first cause of these defects which is sin as above stated in Question 14 Articles 1 and 3 so that Christ's flesh is said not to have lain under the necessity of these defects in the sense that there was no sin in it. Hence he adds for he that is Christ had a body proper to his origin which did not exist through the unholiness of our conception but subsisted in the form of our body by the strength of his power. But as regards the proximate cause of these defects which is composition of contraries the flesh of Christ lay under the necessity of these defects as was said above in Question 14 Article 2. Reply to Objection 2. Flesh conceived in sin is subject to pain not merely on account of the necessity of its natural principles but from the necessity of the guilt of sin. Now this necessity was not in Christ but only the necessity of natural principles. Reply to Objection 3. As was said above in Question 14 Article 1 second reply by the power of the Godhead of Christ the beatitude was economically kept in the soul so as not to overflow into the body lest his passability and mortality should be taken away and for the same reason the delight of contemplation was so kept in the mind as not to overflow into the sensitive powers lest sensible pain should thereby be prevented. End of Question 15 Part 1 Read by Michael Shane Craig Lambert, LC Question 15 Part 2 of Summa Theologica Terziapars Treaties on the Saviour This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer please visit LibriVox.org Summa Theologica Terziapars Treaties on the Saviour by St. Thomas Aquinas Translated by the Fathers of the English Dominican Province Question 15 of the defects of soul assumed by Christ in 10 articles Part 2 Articles 6-10 Sixth Article Whether there was sorrow in Christ Objection 1 You would seem that in Christ there was no sorrow for it is written of Christ in Isaiah 42 verse 4 He shall not be sad nor troublesome Objection 2 further It is written in Proverbs 12 verse 21 Whatever shall befall the just man it shall not make him sad And the reason of this the Stoics asserted to be that no one is saddened saved by the loss of his goods Now the just man esteems only justice and virtue as his goods and these he cannot lose Otherwise the just man would be subject to fortune if he was saddened by the loss of the goods fortune has given him But Christ was most just according to Jeremiah 23-6 This is the name that they shall call him The Lord are just one Therefore there was no sorrow in him Objection 3 Further the philosopher says in Ethics 7 13 and 14 that all sorrow is evil and to be shunned But in Christ there was no evil to be shunned Therefore there was no sorrow in Christ Objection 4 furthermore As Augustine says and on the city of God 14-6 Sorrow regards the things we suffer unwillingly But Christ suffered nothing against his will for it is written in Isaiah 53 verse 7 He was offered because it was his own will Hence there was no sorrow in Christ On the contrary our Lord said in Matthew 26 verse 38 My soul is sorrowful even unto death And Ambrose says in On the Trinity 2 that As a man he had sorrow for he bore my sorrow I call that sorrow fearlessly since I preach the cross I answer that as was said above in article 5 Third reply By divine dispensation the joy of contemplation Remained in Christ's mind so as not to overflow Into the sensitive powers and thereby shut out Sensible pain Now even a sensible pain is in the sensitive appetite So also is sorrow But there is a difference of motive or object For the object and motive of pain is hurt Perceived by the sense of touch as when anyone is wounded But the object and motive of sorrow Is anything hurtful or evil interiorly Apprehended by the reason or the imagination As was said in the second part The Bar's Prima Secunde question 35 articles 2 and 7 As when anyone grieves over the loss of grace or money Now Christ's soul could apprehend a things as hurtful Either to himself as his passion and death Or to others as the sin of his disciples Or of the Jews that killed him And hence as there could be true pain in Christ So too there could be true sorrow Otherwise indeed than in us In the three ways above stated in article 4 When we were speaking of the passions of Christ's soul in general Reply to Objection 1 Sorrow was not in Christ as a perfect passion Yet it was incohactively in him as a pro-passion Hence it is written in Matthew 26 verse 37 He began to grow sorrowful and to be sad For it is one thing to be sorrowful And another to grow sorrowful As Jerome says on this text Reply to Objection 2 As Augustine says in On the City of God 14.8 For the three passions Desire, joy and fear The Stoics held three Eupathias That is good passions In the soul of the wise man, notably For desire, will For joy, delight For fear, caution But as regards sorrow They denied it could be in the soul of the wise man For sorrow regards evil already present And they thought that no evil could befall a wise man And for this reason Because they believed that only the virtuous is good Since it makes men good And that nothing is evil except what is sinful Whereby men become wicked Now although what is virtuous is man's chief good And what is sinful is man's chief evil Since these pertain to reason which is supreme in man Yet there are certain secondary goods of man Which pertain to the body Or to the exterior things that minister to the body And hence in the soul of the wise man There may be sorrow in the sensitive appetite By his apprehending these evils Without this sorrow disturbing the reason And in this way are we to understand that Whatsoever shall befall the just man It shall not make him sad Because his reason is troubled by no misfortune And thus Christ's sorrow was a pro-passion And not a passion Reply to Objection 3 All sorrow is an evil of punishment But it is not always an evil of faults Except only when it proceeds from an inordinate affection Hence Augustine says in On the City of God 14.9 Whenever these affections follow reason And are caused when and where needed Who will dare to call them diseases or vicious passions Reply to Objection 4 There is no reason why a thing may not of itself be contrary to the will And yet be willed by reason of the end to which it is ordained As bitter medicine is not of itself desired But only as it is ordained to health And thus Christ's death and passion Were of themselves involuntary and caused sorrow Although they were voluntary as ordained to the end Which is the redemption of the human race 7th Article Whether there was fear in Christ Objection 1 It would seem that there was no fear in Christ For it is written in Proverbs 28, verse 1 The just, bold as a lion, shall be without dread But Christ was most just Therefore there was no fear in Christ Objection 2 further Hillary says in On the Trinity 10 I ask those who think thus Does it stand to reason that he should dread to die Who by expelling all dread of death from the apostles Encouraged them to the glory of martyrdom Therefore it is unreasonable that there should be fear in Christ Objection 3 further Fear seems only to regard what a man cannot avoid Now Christ could have avoided both the evil of punishment Which he endured and the evil of faults which befell others Therefore there was no fear in Christ On the contrary it is written in Mark 4, verse 33 Jesus began to fear and to be heavy I answer that As sorrow is caused by the apprehension of a present evil So also is fear caused by the apprehension of a future evil Now the apprehension of a future evil If the evil be quite certain does not arouse fear Hence the philosopher says in Rhetoric 2.5 We do not fear a thing unless there is some hope of avoiding it For when there is no hope of avoiding it The evil is considered present and thus it causes sorrow rather than fear Hence fear may be considered in two ways First, inasmuch as the sensitive appetite naturally shrinks from bodily hurt By sorrow if it is present and by fear if it is future And thus fear was in Christ even as sorrow Secondly, fear may be considered in the uncertainty of the future event As when at night we are frightened at a sound not knowing what it is And in this way there was no fear in Christ as Damasin says in On the True Faith 3.23 Reply to Objection 1 The just man is said to be without dread Insofar as dread implies a perfect passion drawing man from what reason dictates And thus fear was not in Christ but only as a pro-passion Hence it is said in Mark 14.33 that Jesus began to fear and to be heavy With a pro-passion as Jerome expounds Commenting on Matthew 26.37 Reply to Objection 2 Hillary excludes fear from Christ in the same way that he excludes sorrow That is, as regards the necessity of fearing And yet to show the reality of his human nature He voluntarily assumed fear even as sorrow Reply to Objection 3 Although Christ could have avoided future evils by the power of his Godhead Yet they were unavoidable or not easily avoidable by the weakness of the flesh 8th Article Whether there was wonder in Christ Objection 1 You had seen that in Christ there was no wonder For the philosopher says in Metaphysics 1.2 That wonder results when we see an effect without knowing its cause And thus wonder belongs only to the ignorant Now there was no ignorance in Christ as was said in Article 3 Therefore there was no wonder in Christ Objection 2 further Damascene says and on the true faith 2.15 That wonder is fear springing from the imagination of something great And hence the philosopher says in Ethics 4.3 That the magnanimous man does not wonder But Christ was most magnanimous Therefore there was no wonder in Christ Objection 3 further No man wonders at what he himself can do Now Christ could do whatsoever was great Therefore it seems that he wondered at nothing On the contrary it is written in Matthew 8 verse 10 Jesus hearing this, that is the words of the Centurion Marvelled I answer that wonder properly regards what is new and unwanted Now there could be nothing new and unwanted As regards Christ's divine knowledge Whereby he saw things in the word Nor as regards the human knowledge Whereby he saw things by infused species Yet things could be new and unwanted With regard to his empiric knowledge In regard to which new things could occur to him day by day Hence if we speak of Christ with respect to his divine knowledge And his beatific and even his infused knowledge There is no wonder in Christ But if we speak of him with respect to empiric knowledge Wonder could be in him And he assumed this affection for our instruction That is in order to teach us to wonder at what he himself wondered at Hence Augustine says in his letter against the Manicheans Our Lord wondered in order to show us that we Who still need to be so affected must wonder Hence all these emotions are not signs of a disturbed mind But of a master teaching Reply to Objection 1 Although Christ was ignorant of nothing Yet new things might occur to his empiric knowledge And thus wonder would be caused Reply to Objection 2 Christ did not marvel at the Centurion's faith As if it was great with respect to himself But because it was great with respect to others Reply to Objection 3 He could do all things by the divine power For with respect to this there was no wonder in him But only with respect to his human empiric knowledge As was said above Ninth article Whether there was anger in Christ Objection 1 You would seem that there was no anger in Christ For it is written in James 1 verse 20 The anger of man worketh not the justice of God Now whatever was in Christ pertain to the justice of God Since of him it is written in 1 Corinthians 1.30 For he of God is made unto us justice Therefore it seems that there was no anger in Christ Objection 2 further Anger is opposed to meekness As is plain from Ethics 4.5 But Christ was most meek Therefore there was no anger in him Objection 3 further Gregory says in his commentary on Job 5.45 That anger that comes of evil blinds the eye of the mind But anger that comes of zeal disturbs it Now the mind's eye in Christ was neither blinded nor disturbed Therefore in Christ there was neither sinful anger Nor zealous anger On the contrary it is written in John 2.17 That the words of Psalm 58 verse 10 The zeal of thy house hath eaten me up Were fulfilled in him I answer that as was said in the second part The parts Prima Secunde question 46 article 3 third reply And in the parts Secunda Secunde question 158 article 2 third reply Anger is an effect of sorrow For when sorrow is inflicted upon someone There arises within him a desire of the sensitive appetite To repel this injury brought upon himself or others Hence anger is a passion composed of sorrow And the desire of revenge Now it was said in article 6 that sorrow could be in Christ As to the desire of revenge it is sometimes with sin That is when anyone seeks revenge beyond the order of reason And in this way anger could not be in Christ For this kind of anger is sinful Sometimes however this desire is without sin Nay is praiseworthy for example When anyone seeks revenge according to justice And this is zealous anger For Augustine says commenting on John 2.17 That he has eaten up by zeal for the house of God Who seeks to better whatever he sees to be evil in it And if he cannot write it bears with it in size Such was the anger that was in Christ Reply to Objection 1 As Gregory says in his commentary on Job 5 Anger is in man in two ways Sometimes it forestalls reason and causes it to operate And in this way it is properly said to work For operations are attributed to the principal agent It is in this way that we must understand that The anger of a man worketh not the justice of God Sometimes anger follows reason and is as it were its instrument And then the operation which pertains to justice Is not attributed to anger but to reason Reply to Objection 2 It is the anger which outsteps the bounds of reason That is opposed to meekness And not the anger which is controlled and brought within Its proper bounds by reason For meekness holds the mean in anger Reply to Objection 3 In us the natural order is that the soul's powers Mutually impede each other That is if the operation of one power is intense The operation of the other is weakened This is the reason why any movement whatsoever of anger Even if it be tempered by reason Dimms the mind's eye of him who contemplates But in Christ by control of the divine power Every faculty was allowed to do what was proper to it And one power was not impeded by another Hence as the joy of his mind in contemplation Did not impede the sorrow or pain of the inferior part So conversely the passions of the inferior part Know wise impeded the act of reason 10th Article Whether Christ was at once a waferer and a comprehensor Objection 1 It would seem that Christ was not at once a waferer and a comprehensor For it belongs to a waferer to be moving towards the end of a beatitude And to a comprehensor it belongs to be resting in the end Now to be moving towards the end And to be resting in the end cannot belong to the same Therefore Christ could not be at once waferer and comprehensor Objection 2 further To tend to be attitude or to obtain it Does not pertain to man's body but to his soul Hence Augustine says that Upon the inferior nature which is the body There overflows not indeed the beatitude which belongs to such as enjoy and understand The fullness of health that is the vigor of incorruption Now although Christ had a passable body He fully enjoyed God in his mind Therefore Christ was not a waferer but a comprehensor Objection 3 further The saints whose souls are in heaven and whose bodies are in the tomb Enjoy beatitude in their souls although their bodies are subject to death And they are called not waferers but only comprehensors Hence with equal reason It would seem that Christ was a pure comprehensor And no way is a waferer since his mind enjoyed God although his body was mortal On the contrary it is written in Jeremiah 14.8 Why wilt thou be as a stranger in the land And as a wafering man turning into lodge I answer that a man is called a waferer from tending to be attitude And a comprehensor from having already obtained the attitude According to 1 Corinthians 9.24 So run that you may comprehend And in Philippians 3.12 I follow after if by any means I may comprehend Now man's perfect be-attitude consists both in soul and body As stated in the second part The Bar's Prima Secunde, Question 4, Article 6 In the soul as regards what is proper to it In as much as the mind sees and enjoys God In the body, in as much as the body Will rise spiritual and power and glory and corruption As is written in 1 Corinthians 15.42 Now before his passion Christ's mind saw God fully And thus he had be-attitude as far as it regards what is proper to the soul But be-attitude was wanting with regard to all else Since his soul was passable And his body both passable and mortal as is clear from the above Article 4 as well as Question 14, Articles 1 and 2 Hence he was at once comprehensor In as much as he had the be-attitude proper to the soul And at the same time waferer In as much as he was tending to be-attitude As regards what was wanting to his be-attitude Reply to Objection 1 It is impossible to be moving towards the end and resting in the end In the same respect But there is nothing against this under a different respect As when a man is at once acquainted with what he already knows And yet is a learner with regard to what he does not know Reply to Objection 2 Be-attitude principally and properly belongs to the soul with regard to the mind Yet secondarily and so to say instrumentally Bodily goods are required for be-attitude Thus the philosopher says in Ethics 1-8 That exterior goods minister organically to be-attitude Reply to Objection 3 There is no parity between the soul of a saint and of Christ for two reasons First, because the souls of saints are not passable as Christ's soul was Secondly, because their bodies do nothing by which they tend to be-attitude As Christ by his bodily sufferings tended to be-attitude As regards the glory of his body For more information or to volunteer, please visit LibriVox.org Summa Theologica Terziapars Triates on the Saviour by St. Thomas Aquinas Translated by the Fathers of the English Dominican Province Question 16 Of those things which are applicable to Christ in his being and becoming In 12 articles Articles 1-5 We must now consider the consequences of the Union And first, as to what belongs to Christ in himself Secondly, as to what belongs to Christ in relation with his Father Thirdly, as to what belongs to Christ in relation to us Concerning the first, there occurs a double consideration The first is about such things as belong to Christ in being and becoming The second regards such things as belong to Christ by reason of unity Under the first head, there are twelve points of inquiry First, whether this is true, God is man Second, whether this is true, man is God Third, whether Christ may be called a Lordly man Fourth, whether what belongs to the Son of Man may be predicated of the Son of God and conversely Fifth, whether what belongs to the Son of Man may be predicated of the Divine Nature And what belongs to the Son of God of the Human Nature Sixth, whether this is true, the Son of God was made man Seventh, whether this is true, man became God Eighth, whether this is true, Christ is a creature Ninth, whether this is true, this man, pointing out Christ Began to be or always was Tenth, whether this is true, Christ as man is a creature Eleventh, whether this is true, Christ as man is God Twelfth, whether this is true, Christ as man is a apostasis or person First article, whether this is true, God is man Objection one, you would seem that this is false, God is man For every affirmative proposition of remote matter is false Now this proposition, God is man, is on remote matter Since the forms signified by the subject and predicate are most widely apart Therefore, since the aforesaid proposition is affirmative, it would seem to be false Objection two further The three divine persons are in greater mutual agreement than the human nature and the divine But in the mystery of the incarnation, one person is not predicated of another For we do not say that the Father is the Son or conversely Therefore, it seems that the human nature ought not to be predicated of God by saying that God is man Objection three further Athanasius says in his symbol of the faith that As the soul and flesh are one man, so are God and man one Christ But this is false, the soul is the body Therefore, this also is false, God is man Objection four further As it was said in the first part, question 39 article four That what is predicated of God, not relatively but absolutely Belongs to the whole trinity and to each of the persons But this word man is not relative but absolute Hence, if it is predicated of God, it would follow that the whole trinity and each of the persons is man And this is clearly false On the contrary, it is written in Philippians two verses six and seven Who being in the form of God emptied himself, taking the form of a servant Being made in the likeness of man and in habit found as a man And thus he who is in the form of God is man Now he who is in the form of God is God Therefore God is man I answer that this proposition, God is man, is admitted by all Christians Yet not in the same way by all For some admit the proposition, but not in the proper acceptation of the terms Thus the Manicheans say the word of God is man Not indeed true but fictitious man In as much as they say that the Son of God assumed an imaginary body And thus God is called man as a bronze figure is called man If it has the figure of a man So too those who held that Christ's body and soul were not united Could not say that God is true man But that he is figuratively called man by reason of the parts Now both these opinions were disapproved above in question two article five And in question five article one Some on the contrary hold the reality on the part of man But deny the reality on the part of God For they say that Christ who is God and man is God not naturally But by participation that is by grace Even as all other holy men are called gods Christ being more excellently so than the rest On account of his more abundant grace And thus when it is said that God is man God does not stand for the true and natural God And this is the heresy of photonis Disapproved above in question two articles ten and eleven But some admit this proposition together with the reality of both terms Holding that Christ is true God and true man Yet they do not preserve the truth of the predication For they say that man is predicated of God by reason of a certain conjunction Either of dignity or of authority or of affection or indwelling It was thus that Nestorius held God to be man Nothing further being meant than that God is joined to man By such a conjunction that man is dwelt in by God And united to him in affection and in a share of divine authority and honour And into the same error fall those who suppose to supposita Or he post a season Christ Since it is impossible to understand how of two things distinct In suppositum or hypostasis One can be properly predicated of the other Unless merely by a figurative expression In as much as they are united in something As if we were to say that Peter is John Because they are somehow mutually joined together And these opinions also were disapproved above In question two articles three and six Hence supposing the truth of the Catholic belief That the true divine nature is united with true human nature Not only in person but also in suppositum or hypostasis We say that this proposition is true and proper God is man Not only by the truth of its terms That is because Christ is true God and true man But by the truth of the predication For a word signifying the common nature in the concrete May stand for all contained in the common nature As this word man may stand for any individual man And thus this word God From its very mode of signification May stand for the person of the Son of God As it was said in the first part Question 39 article four Now of every suppositum of any nature We may truly and properly predicate a word Signifying that nature in the concrete As man may properly and truly be predicated Of Socrates and Plato Hence since the person of the Son of God For whom this word God stands Is a suppositum of human nature This word man may be truly and properly predicated Of this word God as it stands For the person of the Son of God Reply to objection one When different forms cannot come together In one suppositum The proposition is necessarily in remote matter The subject signifying one form And the predicate another But when two forms can come together In one suppositum The matter is not remote But natural or contingent As when I say something white is musical Now the divine and human natures Although most widely apart Nevertheless come together By the mystery of the incarnation In one suppositum In which neither exists accidentally But both essentially Hence this proposition is neither In remote nor incongent But in natural matter And man is not predicated of God Accidentally but essentially As being predicated of its apostasis Not indeed by reason of the form Signified by this word God But by reason of the suppositum Which is a hypothesis of human nature Reply to objection two The three divine persons agree in one nature And are distinguished in suppositum And hence they are not predicated One of another But in the mystery of the incarnation The natures being distinct Are not predicated one of the other In the abstract For the divine nature is not the human nature But because they agree in suppositum They are predicated of each other In the concrete Reply to objection three Soul and flesh Are taken in the abstract Even as Godhead and manhood But in the concrete we may say Animate and carnal or corporeal As on the other hand God and man Hence in both cases the abstract Is not predicated of the abstract But only the concrete of the concrete Reply to objection four This word man Is predicated of God Because of the union in person And this union implies a relation Hence it does not follow the rule of those words Which are absolutely predicated of God from eternity Second article Whether this is true Man is God Objection one It would seem that this is false Man is God For God is an incommunicable name Hence Wisdom 1310 and Wisdom 1421 States that idolaters are rebuked For giving the name of God Which is incommunicable to wood and stones Hence with equal reason does it seem unbecoming That this word God should be predicated of man Objection two further Whatever is predicated of the predicate May be predicated of the subject But this is true God is the Father Or God is the Trinity Therefore if it is true that man is God It seems that this also is true Man is the Father Or man is the Trinity But these are false Therefore the first is false Objection three further It is written in Psalm 80 verse 10 There shall be no new God in thee But man is something new For Christ was not always man Therefore this is false Man is God On the contrary it is written in Romans 9 verse 5 Of whom is Christ according to the flesh Who is over all things God blessed forever Now Christ according to the flesh is man Therefore this is true Man is God I answer that Granted the reality of both natures That is divine and human And of the union in person and apostasis This is true and proper Man is God Even as this God is man For this word man May stand for any apostasis of human nature And thus it may stand for the person of the Son of God Whom we say is a apostasis of human nature Now it is manifest that the word God Is truly and properly predicated of the person of the Son of God As was said in the first part Question 39 article 4 Hence it remains that this is true and proper Man is God Reply to Objection 1 Idolaters attributed the name of the deity To stones and wood Considered in their own nature Because they thought there was something divine in them But we do not attribute the name of the deity To the man in his human nature But in the eternal suppositum Which by union is a suppositum of human nature As stated above Reply to Objection 2 This word Father is predicated of this word God Inasmuch as this word God stands for the person of the Father And in this way it is not predicated of the person of the Son Because the person of the Son is not the person of the Father And consequently it is not necessary that this word Father Be predicated of this word man Of which the word God is predicated Inasmuch as man stands for the person of the Son Reply to Objection 3 Although the human nature in Christ is something new Yet the suppositum of human nature is not new but eternal And because this word God is predicated of man Not on account of the human nature But by reason of the suppositum It does not follow that we assert a new God But this would follow if we held that man Stands for a created suppositum Even as must be said by those who assert That there are two supposita in Christ Confer question to articles 3 and 6 Third article Whether Christ can be called a Lordly man Translator's note The question is hardly apocet in English St. Thomas explains why we can say in Latin For example, orazio dominica, the Lord's prayer Or pasio dominica, our Lord's passion But not speak of our Lord as Omo dominicus, a Lordly man End of note Objection 1 It would seem that Christ can be called a Lordly man For Augustine says in his 83 questions Question 36 that We are to be counseled to hope for the goods That were in the Lordly man And he is speaking of Christ Therefore it seems that Christ was a Lordly man Objection 2 further As Lordship belongs to Christ By reason of his divine nature So does manhood belong to the human nature Now God is said to be humanized As is plain from Damascene in On the True Faith 311 Where he says that Being humanized manifests the conjunction with man Hence with like reason it may be said Denominatively that this man is Lordly Objection 3 further Lordly is derived from Lord So is divine, derived from Deus, God But Dionysius in On the Ecclesiastical Hierarchy 4 Calls Christ the Most Divine Jesus Therefore with like reason May Christ be called a Lordly man On the contrary, Augustine says in his retractions 119 I do not see that we may rightly call Jesus Christ a Lordly man Since he is the Lord himself I answer that as was said above in article 2, 3rd reply When we say the man Christ Jesus We signify the eternal suppositum Which is the person of the Son of God Because there is only one suppositum of both natures Now God and Lord are predicated essentially of the Son of God And hence they ought not to be predicated denominatively Since this is derogatory to the truth of the union Hence since we say Lordly, denominatively from Lord It cannot truly and properly be said that this man is Lordly But rather that he is Lord What if when we say the man Christ Jesus We mean a created suppositum As those who assert to supposita in Christ This man might be called Lordly in as much as he is assumed To a participation of divine honor, as the Nestorian said And even in this way The human nature is not called divine by essence But deified Not indeed by its being converted into the divine nature But by its conjunction with the divine nature in one hypothesis As is plain from Damocene in On the True Faith 3, 11 and 17 Reply to Objection 1 Augustine retracts these and like words in his retractions 119 Hence after the foregoing words he adds Wherever I have said this Notably that Christ Jesus is a Lordly man I wish it unsaid Having afterwards seen That it ought not be said although it may be defended with some reason That is because one might say that he was called a Lordly man By reason of the human nature Which this word man signifies And not by reason of the suppositum Reply to Objection 2 This one suppositum which is of the human and divine natures Was first of the divine nature that is from eternity Afterwards in time it was made a suppositum of human nature by the incarnation And for this reason it is said to be humanized Not that it assumed a man But that it assumed human nature But the converse of this is not true Notably that a suppositum of human nature assumed the divine nature Hence we may not say a deified or Lordly man Reply to Objection 3 This word divine is want to be predicated even of things of which the word of God is predicated essentially Thus we say that the divine essence is God By reason of identity And that the essence belongs to God or is divine On account of the different way of signifying And we speak of the divine word though the word is God So too we say a divine person Just as we say the person of Plato On account of its different mode of signification But Lordly is not predicated of those of which Lord is predicated For we are not want to call a man who is a Lord Lordly But whatsoever belongs to a Lord is called Lordly As the Lordly will or the Lordly hand or the Lordly possession And hence the man Christ who is our Lord cannot be called Lordly Yet his flesh can be called Lordly flesh And his passion is the Lordly passion Fourth article Whether what belongs to the human nature can be predicated of God Objection 1 It would seem that what belongs to the human nature cannot be said of God For contrary things cannot be said of the same Now what belongs to human nature is contrary to what is proper to God Since God is uncreated, immutable and eternal And it belongs to the human nature to be created, temporal and mutable Therefore what belongs to the human nature cannot be said of God Objection 2 further To attribute to God what is defective seems to be derogatory to the divine honour And to be a blasphemy Now what pertains to the human nature contains a kind of defect Just to suffer, to die and the like Hence it seems that what pertains to the human nature can know wise be said of God Objection 3 further To be assumed pertains to the human nature Yet it does not pertain to God Therefore what belongs to the human nature cannot be said of God On the contrary, Damascene says in On the True Faith 3.4 that God assumed the idioms, that is the properties of flesh Since God is said to be passable and the God of glory was crucified I answer that on this question there was a difference of opinion between Nestorians and Catholics The Nestorians wished to divide words predicated of Christ in this way That such as pertained to human nature should not be predicated of God And that such as pertained to the divine nature should not be predicated of the man Hence Nestorius said If anyone attempt to attribute sufferings to the word let him be anathema Confer the Council of Ephesus Part 1 Chapter 29 But if there are any words applicable to both natures Of them they predicated what pertain to both natures as Christ or Lord Hence they granted that Christ was born of a virgin and that he was from eternity But they did not say that God was born of a virgin or that the man was from eternity Catholics on the other hand maintained that words which are said of Christ Either in his divine or in his human nature may be said either of God or of man Hence Cyril says again in the Council of Ephesus Part 1 Chapter 26 If anyone ascribes to two persons or substances that is hypostases Such words as are in the evangelical and apostolic scriptures Or have been said of Christ by the saints or by himself of himself And believes that some are to be applied to the man And apportions some to the word alone let him be anathema And the reason of this is that since there is one hypostases of both natures The same hypostases is signified by the name of either nature Thus whether we say man or God the hypostases of divine and human nature is signified And hence of the man may be said what belongs to the divine nature As of a hypothesis of the divine nature And of God may be said what belongs to the human nature as of a hypothesis of human nature Nevertheless it must be borne in mind that in a proposition in which something is predicated of another We must not merely consider what the predicate is predicated of But also the reason of its being predicated Thus although we do not distinguish things predicated of Christ Yet we distinguish that by reason of which they are predicated Since those things that belong to the divine nature are predicated of Christ in his divine nature And those that belong to the human nature are predicated of Christ in his human nature Hence Augustine says in On the Trinity 111 We must distinguish what is said by Scripture in reference to the form of God Wherein he is equal to the Father And what in reference to the form of a servant Wherein he is less than the Father And further on he says again in On the Trinity 113 The prudent, careful and devout reader Will discern the reason and point of view of what is said Reply to Objection 1 It is impossible for contraries to be predicated of the same in the same respects But nothing prevents their being predicated of the same in different aspects And thus contraries are predicated of Christ Not in the same but in different natures Reply to Objection 2 If the things pertaining to defect were attributed to God in his divine nature It would be a blasphemy since it would be derogatory to his honour But there is no kind of wrong done to God if they are attributed to him in his assumed nature Hence in a discourse of the Council of Ephesus it is said God accounts nothing wrong which is the occasion of man's salvation For no lowliness that he assumed for us injures that nature which can be subject to no injury That makes lower things its own to save our nature Therefore, since these lowly and worthless things do no harm to the divine nature But bring about our salvation How dost thou maintain that what was the cause of our salvation was the occasion of harm to God? Reply to Objection 3 To be assumed pertains to human nature Not in its suppositum but in itself And thus it does not belong to God Fifth Article Whether what belongs to the human nature can be predicated of the divine nature Objection 1 It would seem that what belongs to the human nature can be said of the divine nature For what belongs to the human nature is predicated of the Son of God and of God But God is his own nature Therefore what belongs to the human nature may be predicated of the divine nature Objection 2 further The flash pertains to human nature But as Damascene says in On the True Faith 3.6 We say after the blessed Athanasius and Cyril That the nature of the word was incarnate Therefore it would seem with equal reason That what belongs to the human nature may be said of the divine nature Objection 3 further What belongs to the divine nature belongs to Christ's human nature Such as to know future things and to possess saving power Therefore it would seem with equal reason That what belongs to the human may be said of the divine nature On the contrary Damascene says in On the True Faith 3.4 When we mention the Godhead we do not predicate of it the idioms That is the properties of the humanity For we do not say that the Godhead is passable or createable Now the Godhead is the divine nature Therefore what is proper to the human nature cannot be said of the divine nature I answer that What belongs to one cannot be said of another Unless they are both the same Thus risible can be predicated only of man Now in the mystery of the incarnation The divine and human natures are not the same But the hypothesis of the two natures is the same And hence what belongs to one nature Cannot be predicated of the other if they are taken in the abstract Now concrete words stand for the hypothesis of the nature And hence of concrete words we may predicate indifferently What belongs to either nature Whether the word of which they are predicated refers to one nature As the word Christ by which is signified Both the Godhead anointing and the manhood anointed Or to the divine nature alone As this word God or the Son of God Or to the manhood alone as this word man or Jesus Hence Pope Leo says in one of his letters It is of no consequence from what substance we name Christ Because since the unity of person remains inseparably One and the same is altogether Son of man by his flesh And altogether Son of God by the Godhead Which he has with the Father Reply to Objection 1 In God person and nature are really the same And by reason of this identity The divine nature is predicated of the Son of God Nevertheless its mode of predication is different And hence certain things are said of the Son of God Which are not said of the divine nature Thus we say that the Son of God is born Yet we do not say that the divine nature is born As was said in the first part in Question 39 Article 5 So too in the mystery of the incarnation We say that the Son of God suffered Yet we do not say that the divine nature suffered Reply to Objection 2 Incarnation implies union with flesh Rather than any property of flesh Now in Christ each nature is united to the other in person And by reason of this union The divine nature is said to be incarnate And the human nature deified as stated above In Question 2 Article 1 Third Reply Reply to Objection 3 What belongs to the divine nature is predicated of the human nature Not indeed as it belongs essentially to the divine nature But as it is participated by the human nature Hence whatever cannot be participated by the human nature As to be uncreated and omnipotent Is no wise predicated of the human nature But the divine nature received nothing by participation From the human nature And hence what belongs to the human nature Can no wise be predicated of the divine nature End of Question 16 Part 1 Read by Michael Shane Craig Lambert, LC


All right, first of all, thank you so much for being here. Especially many of the maintainers and the members who have contributed to Spiffy and SIRT Manager, who have enabled us to be here and talk about securing edge workloads with Spiffy and SIRT Manager. My name is Sitaramayur, and I'm here with Riyaz, Riyaz Mohammad. Hi, y'all. And our job, obviously, at JetStack is to talk to many of our customers. And one of the things that we have heard many of her very often is the challenges around securing workloads, especially as they are deployed across multiple different clusters, multiple different domains. And as we sort of started to think about the motivation for this session, we essentially wanted to look at it purely from a perspective of, what does it take to provide a standard way of generating identities or workloads across clusters and essentially build trust? That's the simple motivation that we started to look at this from. Securing workloads, having the ability to generate an identity, and distributing trust across multiple different trust domains. That was the purpose with which we started thinking about the challenge that needs to be addressed. And this actually started off purely from many of the conversations that we have had with some of the customers. And specifically, a customer that is in the financial space. And while this picture that you see here may look very simple, the challenge that the specific financial institution had is massive. And we will demonstrate with some of the edge devices that we have here, how we have addressed that, how we have solved that, and what does it mean to address and secure workloads. So what you're seeing there on the picture is a bunch of terminals, obviously, and then a set of services that are caught there. The simplest way to sort of think about this is the bank here provides a set of services that are consumed by different merchants. And as part of that, the merchant terminal that's out there, science generates some kind of a private key pair, sends it across with Jot, obviously the bank validates it, and sends a token back. Describing this in a very, very simple form. And over a period of time, this token is used to sort of manage payments, refunds, and things like that. And this is the standard operating model in which various different merchants work, payment terminals, core bank services. The challenge that really started to sort of surface for this bank was when a merchant terminal was, or rather a merchant was off-boarded, terminals were lost, terminals were sort of, you know, repurposed for other purposes. And that sort of, you know, made a challenge for the bank one to figure out who is using the terminal. And it also started to come into the notion of a fraud where a fake merchant or a fake, you know, somebody who has an account terminal would essentially use this terminal to process refunds. And that sort of, you know, obviously, as you can imagine, translates to, or translated to millions of dollars of loss for this bank. And as we sort of think about this, you know, we said, what if, what if, what if every workload has a unique identity? And, you know, if you've been here, if you're here in this session, you're probably a little bit interested in understanding a little bit more about SPIFI, what it can do. If you're thinking about, you know, TLS and X-Fi 9, you're probably using or are familiar with cert manager. So what we're trying to do is basically mapping this, what ifs to various different scenarios under which you will essentially use cert manager, SPIFI, and a few other things that we're gonna talk about in the next 10, 15 minutes. So what if this identity was used by the workload to say who it says it is. And that is one of the things that we wanted to ensure that happens. And then what if trust was automatically distributed when a terminal is activated. So we talked about these terminals and the way they activate themselves with some kind of a bootstrapping process, talks to the bank services, and then it's all ready to go. The way we were thinking about this, there should be some sort of a trust model or a trust that can be established in a way where services on the back can know exactly what the terminals are and how they work. And the same way, how do you sort of, you know, manage or rather figure out a way to sort of, you know, revoke that trust when a merchant is off-boarder. So these are essentially some of the what if challenges that we started to look at, you know, purely from the perspective of, you know, addressing, providing an identity for every single workload, ensuring that, you know, each of these workloads can talk to each other in a seamless, mutually authenticated way and all of those things. And obviously, as we started looking at it, we said, of course, Spiffy. Spiffy is the answer to many of the things, especially in this context. And if you have visited the Spiffy, sort of, you know, the Pavilion, or, you know, if you've talked to anybody who is the maintainer of Spiffy, you know, if you have not, please do, because they'll talk a lot about the things that can be, that are, and that could be applicable to you, the work that you do within your organization. So, basically, from a perspective of Spiffy, you know, what is Spiffy? Secure identity for every workload, irrespective of where they're running. I mean, a very simple way of describing it, it basically allows you to authenticate mutually in an easy and reliable way. Very simple definition. Obviously, we want to get a little bit deeper on this to show how it works and what it means, but from the perspective of a definition, you should see that, you know, Spiffy essentially allows you to, one, attach some kind of an identity to a workload and based on that, securely and mutually and reliably allow access to other workloads as you sort of, you know, talk to each other. So, the last bullet there, obviously, is something that's important. Spiffy just graduated within the CNCF and it also means that if you go to the CNCF store there, you'll find a lot of jackets, t-shirts, socks, feel free to buy them, you know, they're nice and looks good. The other project that I want to talk about, and before that I want to just tie in a little bit of the basics of Spiffy. You know, we hear Spiffy a lot and I'm pretty sure a lot of you are curious or many of you may know what Spiffy does, but there are several characteristics of Spiffy that we need to understand before we sort of, you know, say what does that secure identity look like. At the heart of, you know, anything that you do with Spiffy is a workload. I mean, we keep saying, you know, there is a workload that needs an identity, but what exactly is a workload? Workload is basically any software.  Simply put, the second piece, which is important to understand from a Spiffy perspective is Spiffy ID. And this is something that you'll probably, sort of, you know, hurt quite a few times. Oh, if you're using Spiffy, you need to generate a Spiffy ID. What does Spiffy ID even mean? Simply put, it's essentially just an URI, a URI that identifies a workload. And most often, and from the specification perspective, this URI is represented as Spiffy colon slash slash, trust domain slash whatever workload that you want to identify, some kind of an identifier. There is no real way of saying, you know, this has to be in a certain way. The example that you see there represents some kind of a trust domain, a workload that is in a certain namespace, tied to a certain service account that owns that deployment. That's essentially representing a Spiffy ID for a certain workload that is deployed within your cluster. The third important aspect to understand within a Spiffy world is trust domain. Trust domains essentially represent some sort of a security boundary, a cluster, a namespace, a virtual machine, a physical server, whatever that might be, something that you can draw a well-defined box essentially represents your trust domain. Spiffy S-WIT, this is, as I'm building this, it's to help understand that there are several other things that you need to consider. It's one thing to say that I have identified or I have an ID for Spiffy which is represented by some kind of an URI. What you need to do next is to be able to make sure that this identifier can be attached with some kind of a cryptographically verifiable document which is essentially an X-Fi9 certificate. And that's essentially what Spiffy S-WIT is. Something that cryptographically helps you identify something that you have signed because end of the day when you say I have a workload, that workload needs to be tied back to something that can be cryptographically verifiable. That's Spiffy S-WIT. Then there is Spiffy workload. Essentially something that allows you for the private key to be signed because there is also the signing process. Somebody has to sign your workload. Somebody has to look at what CA should I use for signing. There's all of those things that has to happen before that ID is generated. Rather, the Spiffy S-WIT is generated. So that essentially is something that is happening with something that we're doing as a workload API. The last one, which is also important, is the notion of trust bundles. Trust bundles essentially represents, from an X-Fi9 S-WIT's perspective, a collection of root CA's, right? So that's what it is. He's a sync to cross namespaces in your cluster. Yeah, basically any CA's that you want to attach against workloads, and you could have a workload A running in cluster A, could have workload B running in cluster B, could be signed off of a completely different CA root, something across with a completely different CA root. How do you sort of manage the trust between those two clusters or two namespaces or two trust boundaries, so to speak, right? So trust domains rather. So trust bundles is a way of making sure that each of those workloads has, or at least have a way of being modeled to trust a certain chain of CA's that you are using within the workloads. That's basically what Spiffy basics are. Basically all of this in some way or the other map to things that you're doing, whether you're deploying your workload, whether you're deploying any other application, things to think about is from a perspective of Spiffy is understanding what are these various elements that you deal with. Obviously we go from here to ensure that everything can be absolutely automated. These things are automatically generated. These things are automatically managed. That's essentially what we want to do. And from that perspective, the other project that I want to talk about is cert manager. Cert manager is something that many of you use, many of you are familiar, essentially something that allows you to automate, provision, manage TLS certificates at scale. People use it for their ingresses. People use it to mount it to their parts. People use it in the context of anything that requires TLS certificate that will allow you to securely provide access to your application. Something that's very commonly used. And there are several add-ons. One of the things that we talk about very often is only cert manager. Cert manager has a lot of supporting add-ons. I usually call them cert manager and friends because these friends essentially allow you to build much more robust capabilities for your security infrastructure within Kubernetes. And we'll talk about some of those friends as we sort of get through the rest of the presentation. We are now in incubating. So this was announced, obviously, just two or three weeks ago. Cert manager is now an incubator within the CNCF ecosystem. We have a lot of maintainers actually here in Detroit. So if you haven't visited the cert manager booth at the Pavilion, please do. And we can talk a little bit more about what cert manager does. And at the top of the title, you will see me adding a few of those pluses. And that's intentional because I'm actually building some additional add-ons and I spoke about friends. These friends essentially will provide you the ability to sort of do additional capabilities. So we talked about cert manager. Cert manager CSI driver, Spiffy, is essentially a CSI driver plugin that allows you to basically make sure that you have an automated way of injecting Spiffy S-Wits to your workloads that your workloads can use. A simple way of thinking about it is, anytime you need an X-File 9 certificate to be mounted in a part that is Spiffy S-Wit, that is, then you just use Spiffy drivers, the CSI driver Spiffy. All you do is in your deployment specification, you'll add some volume attributes and then automatically you will have a certificate injected into it. The second add-on that I'm gonna talk about is trust. Trust Manager is a project that is part of cert manager, essentially to help distribute trust, or distribute trust bundles, so to speak. So if you go back to the definitions that we draw for Spiffy, we talked about some of these things, ability to distribute trust, ability to manage trust, and trust manager essentially is one of the projects that allows you to essentially distribute trust across your various different trust domains. The third one is also a most important sort of add-on, which we call obviously the approved policy. If you are familiar with cert manager and if you have used cert manager, one of the things you probably have seen is every time a certificate request resource is created, there are certain properties. There is an approved, denied, ready. And I would say 99% of you, if you have used cert manager, you probably saw that approved flag always true because the approval controller that is built into cert manager by default is true, which means every certificate request is automatically approved. Whether they are ready or not depends on your CA and the issuer configuration and all of that, but at the basic configuration perspective, if you create a certificate request or some other generator certificate, that will automatically be approved. However, from the perspective of Spiffy as with, there are certain things in the specification, so the list that you see there is actually from the Spiffy specification that every X509 SWID needs to have certain characteristics and those characteristics are defined there and what we provide as part of the CSI driver is an additional controller, a policy approval controller that ensures that every time a SWID is generated, it complies automatically to the specification defined by Spiffy. So you don't have to write your own or author policies, this is automatically built into the CSI driver Spiffy plugin. So it ensures that every single certificate that's generated complies to those properties that you're defined there. So from the perspective of the solution, I just wanted to walk through them and I spoke about a bunch of things and I talked about all of them in an individual way. If you sort of look at it at a view from where you have to think about how all of these work together, what you really have is a bunch of different components. You have a certain manager there, you see policy approval, you see the trust manager, obviously CSI driver, I'm representing down here primarily because it's a demon set, it is attached to obviously the node and every time a part is scheduled to the node, basically CSI driver says, okay, so part is scheduled, there is certain specification defined in the specification of a deployment that says these are the volumes, these are the volume mounts, and I need to make a volume, I need to publish that volume and as part of that deployment, I also need to mount the volume. Those are the specific things that sort of happen and as soon as that process is over, the CSI driver plugin essentially initiates a request to a certain manager with the CSR, that CSR contains a certificate with that specific properties that we just saw in the previous slide. It carries all of the information about your workload, it carries all of the information about the service account that's attached to it, basically just by saying those few lines that you see there, volumes, where you want to mount the volume and what that volume itself looks like, the CSI driver spiffy, just those six lines or three lines, I don't know how much, I can't count, but a few lines that you have there essentially enables you to make sure that every part that you have has a spiffy as with automatically mounted on that volume mount. And from the perspective of what really happened in this third step is basically that CSR was generated and once that happens, cert manager does the certificate reconciliation, it goes through the process of ensuring that that certificate is going to be fulfilled. Part of that, it also has to make sure that the trust and everything is generated, rather all of the trust bundle that was created is distributed back. I spoke about the policy, it ensures that you're not creating some certificate by hand using the issuer that is tied to your spiffy because there is the notion of an issuer tied back to your organization CA which could be backed by the security teams, managed HSM or whatever that might be, right? So after this, obviously it's basically just mounting the certificates, basically the TLS cert, the private key, the CA cert, all of these things that needs to be available for the part, specifically in that war run, secret spiffy.io, you'll have all of these things readily available there. And then, once these are all automatically mounted, so it's available for this spiffy driver to rather the part to be to use that application or use that SWID whenever it talks to other applications. So you can imagine that if you have this one single deployment, replica of five, every single one of them has a uniquely cryptographically verifiable X509 SWID mounted on the volume mount of that specific part because when those parts talk to other parts or if you're talking to other things, every one of them have an identity and your communication is built on the principle of mutual authentication, mutual TLS.  And once such a thing happens, obviously, all of the certificate material that is associated with that workload is gone. You destroy it because one of the things that you may be familiar with, when you create a certificate resource using cert manager, there is a TLS secret that is automatically created. With the case of spiffy driver, there is no TLS secret because all of the material that is required for that part is actually injected into the volume mount. And that part is deleted, it goes away. So there is no TLS secrets to manage, TLS ticket to track off, TLS ticket to our back on. And also from a security standpoint, some of the larger financial institutions have at least guidelines around not creating any TLS secrets, especially that has private keys and things like that in there in the material. So this sort of addresses that notion of an identity that is issued to a workload when it needs it, where it needs it, so that the other workloads, when they are in communication, they are all mutually talking to each other. That's the sort of a high level view of how all of these things work. Obviously, there is spiffy in word here, there's cert manager in word here, cert manager, CSI spiffy driver is in word here, trust manager is in word, policy approach is in word, lots of different projects, all sort of coming together to provide this ability to help sure that you are securing your workloads irrespective of where they are running. So the idea is that you're not just using one single component, you're using a combination of things to help satisfy that security aspects of how you secure your workloads. So I wanna now hand it off to Riaz to talk a little bit about the demo architecture.  All right, thanks, Sitaram. So for a demo architecture, we have a cluster that's running on K3S, it's a two node cluster that's running on Raspberry Pi. And then this is where all your client workloads are going to be, edge workloads are going to be running. And now we have another cluster which is a six node GKE cluster that's running in the cloud. So what you see here in the middle are all components that Sitaram already talked about. Set manager, speed driver, policy approver, trust. And these are all installed in both the edge as well as the GKE cluster. So what really happens, right? So let's look at a server-side component or a server-side microservice that is deployed on the GKE cluster. The CSI speed driver sends a CSR, set manager receives it, and it creates a certificate request. Now there's a certificate request policy that is bundled into the policy approver. The policy approver and approves the policy, set manager, set manager means X509S with and then mounts it onto the volume of the workload. Now this happens in both the server as well as the client. So each one have their own machine identity now. Now what about trust? How do they talk to each other, right? So that's where the trust bundle comes in. The trust bundle, so the trust bundle is distributed across both the clusters which have the CAs. So if you look at next slide, you would see that the client's CA as well as the server CA is within the trust bundle that is distributed in the GKE cluster. So this basically creates trust. Now once you want to revoke trust, what you do is you remove the CA from the trust bundle in your server application, oh sorry, in your server cluster. This basically revokes the trust between the two workloads. So it's like pretty simple. You're not going across doing East West traffic and you're both revoking trust as well as, yeah, you're enabling trust, sorry. Now that we have this, I'll go through a demo of what we have. So I have, so I've deployed, I've already installed the cert manager as well as the trust bundle on using Helm on my GKE cluster.  Now you would be creating, we are creating the certificate just for demo purposes, but then you would be using your PKI infrastructure to issue the certificate and cert manager would do that for you, right? Now this creates a certificate with the certificate contents as well as an issuer that is used to serve the trust domain. So let's do that. You see an issuer there? So now what I'm doing is I'm creating the CA certs as a secret and then also creating the trust bundle that references both the client and CA. Now this trust bundle, if you see, would be distributed across all the namespaces. So there's a set of config maps that are generated that are synced across namespaces here. Now when I see the contents of the trust bundle, I would see both the certificate of the CA, the CA certificate for the client as well as the server. Now I'm going to deploy the CSI speed driver and this I see that I'm already talked about. It's a demon set. So this may take some time because, okay, we'll have to have the approval running before we, so the CSI speed drivers running on my cluster now along with the policy approval. Now I'm going to create my application, right? So deploying my edge server application. And now what we'll do is let's look at what's the S width, what's the SPIFI ID of this app that's been, so if you see here, there's an S width that has been generated and sorry, an X509 S width that's been generated and there's a SPIFI ID that's attached to it. Now let's go to the client, which is my Raspberry Pi and I'm going to be switching to that context. And here I've installed all the cert manager, the trust project, the CSI SPIFI driver and all of that, so that's what you see here. And let me go in and see my CAs. Again, I created my trust already. This has all my trust bundles that are synced across my workspaces. And here if you see, it has both the CA and the server server. Now I'll deploy my client application. See if it started, it takes a while to start. Okay, cool. And now I'm going to be testing out my MTLS, right? Between my client and my server. So I have two methods here that I'm going to call. Oh, I'll have to, I'm going to do a port forward now so that I can access this. So what you see here is the client application that's running on my Raspberry Pi is talking to my server application that's running on the GKE cluster. And this is, there's a handshake. There's an MTLS handshake that's happening and we're getting edge activated message here. You can also, I have another one called edge pay and it says payment successful. This is what you would see in a terminal when you activate and start using the payment when you start doing payments, right? Now what we're going to do is we're going to update the trust bundle and then rework the trust. Now, once we do that, we should, you know, any handshake between the client application and the service application should not happen. So here what I'm doing is basically updating my trust bundle. And what you could see here is now I have just one CA. So I'm removing the trust for my client. So these are the logs from the server. So we did two activations and then we created a payment successful. We also invoked a payment and it said payment successful. So let's go back to the, so now if you look at it, when I try to call my edge pay or my edge activate, I get a message saying that device unauthorized. So it's as simple as just updating your trust bundle and unauthorizing your client altogether. Excuse me, let me check the logs on this. Can I switch to the presentation? Yeah. Excellent. Thanks, Riyaz. Hopefully that gives some context to, you know, how all of this work. That, those two pictures are definitely not ours. I have somebody else's pictures, as you can imagine. So I wanted to give a shout out to a couple of our colleagues, you know, who've been working on this for a long time, especially Josh, who is also here.  There's also a much more detailed blog about, you know, how to manage workload identities across multiple different cloud providers. Feel free to reach out to that thing as well. And most importantly, one of the things that we've spent time in the last, I mean, obviously a few months and, you know, at least a couple of years or so, really leading, reading, solving the bottom turtle. So if you haven't read this book, I strongly recommend you going through this because this essentially talks about a lot of different things that we just covered, but also in a much more detail. Also going beyond PIFI into the world of SPIRE and what does attestors mean? How do you sort of use specific technology-specific attestors and things of that sort? So that will tell you the next set of things that you can absolutely do. I want to also make sure that if you are somebody who uses search manager, obviously we talk about TLS as digital identities. If you want a wax seal printed physical certificate that we want to carry with you, come see us. So we are actually minting certificate by hand with a wax seal and then I will give one to you that you can take as a souvenir. So visit us at our booth. So that will give you something to take forward as well. So where do we leave from here? So obviously we showed some of the things that's possible. There was also a lot of things that we can work on. Some of the things that we identified that absolutely needs to be done is a model-driven ways. Today we saw that there were some things that we were doing, obviously managing trust in a way where you're creating this resource called bundle and managing it. So we want to be able to model that via rules and things like that, something that we've been thinking about. Obviously, trust distribution across trust boundaries is also something that we want to look at in an automated way. Today, you can manage it, but you can literally have to figure out how to distribute trust across multiple different things. But then again, we also look at what does it mean to have control plane that we've been working on to essentially manage trust across different security boundaries and how you manage it, how do you get it. That's where we are, obviously, now. There is a QR code to provide your feedback. We appreciate any feedback that you might have. Talk about it. And we can take questions if you have. How does the CERT Manager model for this process that you've laid out here, how does this interact with doing MTLS through a service mesh, which is another person that I've seen to doing this, is this something that plays with that or is this in place of doing that through a service mesh? How does that interact? Absolutely. So we do have integrations with service mesh. So there are different service meshes that sort of, for example, if you're using Istio, there is an add-on that specifically is called Istio CSR that essentially mounts CERT Manager as a way to provide that workload signing certificate into Istioid. So that way any of the workloads that is part of your mesh will essentially be delegated to be signed by the signing certificate that is managed by CERT Manager. So that's what Istio CSR does. It is an add-on that you would install in your cluster wherever your service mesh is. But as you sort of manage your service mesh, you would essentially not use the default built-in CSR server or that's mechanism through which the CA is used. But the mechanics of CERT Manager essentially enables you to plug your organization CA into the signing process so that it is possible. So obviously CSI driver and CSI SPFIS use more in the context of non-mesh workloads, but for mesh workloads there is absolutely that mechanism available. So some other question there? Hi, great presentation. So my question is, how does it work with multi-cluster or virtual cluster? Have you guys tested those cases? Yes, so in this case, this was a multi-cluster model. So we actually used two different clusters. Actually, we had two different clusters, one on Google Cloud and one was running Raspberry Pi. One is running right here. Yeah. So the idea is that the trust domains are across clusters. And we want to be able to distribute and manage trust across trust boundaries. Today, that management of trust across that is via a trust bundle that you distribute with the CAS that you manage. And that essentially connects the trust doors or the trust CAS or the CAS that you're managing across multiple different clusters to communicate with each other. So in this example, we were using a multi-cluster model to distribute trust. We'll be here. I'm happy to take any more questions. Excellent. Thank you so much.