Hello, everyone. Welcome to Cloud Native Live, where we dive into the code behind Cloud Native. I'm Annie Tolasco, and I'm a CNCS ambassador, as well as a Senior Product Marketing Manager at Camunda, and I will be your host tonight. So, every week, we bring a new set of presenters to showcase how to work with Cloud Native Technologies. They will build things, they will rate things, and they will answer all of your burning questions. So, you can join us every Wednesday to watch live. So, this week we have Kuberna, to talk about what's new with Kuberna, which is really exciting. So, and as always, a bit of housekeeping to kick us off. So, this is an official live stream of the CNCS, and as such, it is subject to the CNCS Code of Conduct. So, please do not add anything to the chat or questions that would be in violation of that Code of Conduct. Basically, please be respectful of all of your fellow participants as well as the presenters and speakers. So, with that, I'll hand it over to the speakers to kick off today's presentation. Okay, thanks, Annie. Hello, everyone. Let me quickly share my screen, and then I'll start the presentation today. Let me know if you cannot see my screen like the slide stack. All right, I guess that's a yes. Hello, everyone. I will come to this CNCS webinar for Kuberna, and we're gonna talk about upcoming features in Kuberna 160 release, and today, just a few background about the speakers. Today, we have Chip Zoller, and I'm shooting down. We're both Kuberna maintainers, and Chip is the one focusing on contributing to all different phases of Kuberna, except for developing, and I'm currently leading the Kuberna project on the development side. All right, so today we're gonna have, this is like then overview of the topics for today. We're gonna have a quick introduction of Kuberna's architecture and the structures of the Kuberna policies, and then we'll jump directly to the new features in Kuberna, and we have a whole bunch of like different demos today, like, and we'll show you like how that new features work in the in the Kubernetes cluster, right? And we'll take the questions at the end, but if you have, like in case you have any questions popped up in between, feel free to pause us there and I'll help you to help. All right, so like for the Kuberna high level architecture, as you know, like the Kuberna is the Kubernetes policy engine, which is native to Kubernetes, and it runs as the emission controller, which registers the mutation and validation but her configurations in order to like inject the thoughts and validate configurations based on the emission reveal data. And based on the policy decision, Kuberna can either reject your resource creation or operation or just like simply let it pass and audit the results to the policy reports. And besides that in the mutating web hook, Kuberna also verify the image signatures as well as the testations. And you can also look up the data from the external registry and to further utilize that in your inner policy. And in addition to that, Kuberna also runs this generate controller, which is triggered on the emission web hook and generates this intermediate resource or a CR called generate request. And the generate controller will pick up the generate request later and apply the generate policies on the trigger resource. And other than that, Kuberna also generates the policy report, which is just like audit the policy results in this policy report CR. And then you can have the aggregate view of the results of the policy decisions. And other than that, Kuberna runs a monitor in the web hook server, which keeps monitoring the web hook status and as well as managing the Kuberna secrets and config maps. So basically this is the high level architecture of the emission controller of Kuberna. And Kuberna also provides the CLI-2 that allows you to apply policy without the cluster. And you can also use the CLI, automate that in your CSV pipeline and take your validate configuration. Okay. And so this is like the structure of the Kuberna policy and a policy here is just a Kubernetes CRD and you can create like multiple cluster policies or policies as the Kubernetes CR. And then in each policy you can define one on multiple rules, but then each rule you will have like this match and exclude block to select various source based on different information. And then in its rule body, you can specify one of those core type of rules to mutate, validate, generate resources, as well as verifying image signatures and the test stations. Okay. So this really is just a quick entry of Kuberna. There are a lot of like good resources out there for the introductory and how we can use Kuberna to apply the basic mutate valid policies. And today we're just gonna like mostly focus on the new features in 1.60 since this is the big release after the KubeCon last year, October. And this release includes a lot of new features and critical enhancements. So we're gonna highlight them, some of them in today's session. Okay. So the first thing I wanna talk about is this image verification policy. With Kuberna 1.5, we have this type of rule enabled to verify the image signatures that are signed with or without the keys. And you can use this tool called cosine to sign the image. And it has this keyless signing ability so that in Kuberna policy, you just need to create the route or provide the route CA so that Kuberna can validate or verify your image signatures using the provided certificate. And I wanna like what's new in 1.6 is this use Kuberna policy to verify image attestation. And there was a recent new feature added like to look up image data from external registry. And then the image, the background scan is also enabled for this type of loop so that you can have the policy report based on the configured image verify policy, right? So before we jump to the demo, I wanna like, just give you a little bit background about the attestations. So we use this tool called intoto. And it is like a Linux foundation project which has a like a standard attestation format. And as you can see here, the then attestation statement, you can either like customize payload or define some of the feet in payload and later use that in Kuberna policy to validate configurations, right? So the attestation is just something you can sign that and attach to the image and then stored in the registry. And Kuberna by default, if you have such policies configured, it'll look up from that registry and get all the attestation statements. Okay, that's a little bit background about attestation. Let's switch to the policy I have for today and we have a few demos for this image verify type of group. Okay, so the first thing we have here is a Kuberna Validate Policy. And as you can see here, I set the validation failure action to enforce, which means I wanna reject the resource creation or operation if there's any violations on my incoming resource, right? And then in the tool body, I'm just trying to specify this verify image rule and it's matching the image coming from my own registry and it provides the public key to verify the image signatures. And this attestation attributes, I'm just saying that, okay, I wanna verify my image is coming from the right branch and the reviewers of the image has to be in this, like the listed reviewers. And before we do that, I wanna show you the image, like the Tasman image I've just built. As you can see here, it's a simple POS container, which is used in Kubernetes and it has the signature ID because I've signed the sign image with the private key and push it upstream. And then after that, I just wanna verify the attestations in the image. So far it doesn't have any. So let's see what happens if I create, if I install the policy and create the resource or a pod using the image that doesn't have any attestations, okay? So like I'm running a Kubernetes 123 cluster and currently I have Kubernal installed, like this is the latest the one six release candidate. Let me just check the tag on that. Right, it's running Kubernal 160 RC1. And then so far I don't have, I don't think I have any policies installed, right? So C-Poll here is just the short name of the cluster policy. You can either like do kubectl get cluster policy or kubectl get C-Poll, it'll return you the existing cluster policies. All right, so let's create the policy first. Let's say kubectl apply, check review. In that case, I wanna verify the policies been installed and it's becoming ready, right? So it indicates this policy is ready to serve the emission request. Okay, so now we have the policy in place. And let's see if I run a just a standalone pod using my POS container image, which does not have any attestation information, right? So let's create that pod. And ideally I should see Kubernal blocks that resource creation because, okay, the signature doesn't match, right? So this rule is actually blocking the resource creation. And then this, remember this cosine COI2, it also provides the attest command for you to sign the attestation and attach it to the image, like the container image, and then push up the screen, right? So let's run that command called the test. By the way, before I do that, I want to add these attestations to my image and saying that, okay, this image was viewed from men branch and this is the reviewer who reviews that image, right? It's just the simple information here. And then if I run cosine attest with the key, and then I attach the entire review JSON, which is the attestation with this flag and attach the container image here, then it'll sign the attestation and attach it to the container I have, right? Just entering the password for the private key. Okay, so now our container image should have that attestation. Let me quickly refresh that, okay, good. Now you can see there is another signature here, which has this dot ATT that's indicating that attestation has been added to your container image, right? And then let's run the part using the same image again. And in this case, because the image is coming from the men branch and it's reviewed by bot, then our key rental just allows that part creation. Okay, so this is just like an example of how you use key rental to verify the image attestations. Let me just quickly pause here and see if we have any questions. Okay, I guess. Not so far, but hopefully we will get more and more as we go along. Okay, I think I can just proceed from here. All right, and the next example I have is to look up image data from your image registry and use that in like the validate or the mutate policy for further policy application, right? So again, I have a cluster policy here, which is matching the pod. And simply I'm just filtering out the delete request and with this validate rule, I'm gonna iterate through like each container images and trying to calculate the image size, right? As you can see, I have defined the context attributes here and it's trying to use this James pass operation to get the size of that image and stored in this image size policy context variable, right? And this variable is later consumed by the deny rule. And here I have a condition say that, okay, if my image size is greater than two gig, then block the resource for me, otherwise allow the creation, right? So let me clean up the previous like cluster policy. And then I'll delete the workloads, the pod I just run, like the pod task. And then apply that like block image policy to cluster. Okay, let's check whether the image is ready or not. It's not ready yet. Okay, now it became ready. And then I'm gonna create, first I'm gonna create like a busy box pod. Apparently a busy box size is this, there's no chance it exceeds the limit, right? So I should see the busy box creation should be allowed. And let's just execute that command. The demo dash dash image, busy box one of 28. And in this case, Kivana look up the image data and tries to calculate the size of the busy box image. And after that, you just see the pod creation pass through. And then I'm gonna create another like a pod using this large image, which its size apparently exceeds two gig. And ideally Kivana should block that resource creation for me. So let's run that command. Okay, now you can see that, okay, my policy block large images, just block the demo block creation because the image size exceeds two gig. All right, and next I'm gonna have another like a policy leveraging the image data, but it's been used in the state policy. And it's just trying to solve, replace the image tag to the resolved rep. Again here, I have a cluster policy matching a pod and trying to filter out the lead and the request. And there I have this for each mutate rule defined. And again, trying to iterate through container images and store that resolved image information to this policy context variable. And this variable is later used in this mutate patch strategy merge pattern. And it just tries to replace the image by its reference. Okay, so let's apply the policy to a cluster, say resolve, and then, okay, let's do that pos image again. So if I run, do I have that? Let's try, okay, it did well. All right, I don't have that, great. So you can see the pot has been created. And if we inspect the pot like image, you'll see that the image should be replaced by its resolved reference instead of like the image I specified in the command. Okay, this is an example of how to use image data and validate and mutate policies. All right, and going back to the slides. I'm gonna- There was a question from the audience as well. We got some answers in the chat already, but if you want to expand a bit. So there was a center asking about, I'm sure they got the details, thank you. And then there was Amir asking about Jin's path, which is a query language for Jason. So if you want to expand on those, yeah. Okay, I saw them are already answered and some of the links are provided, but if you want to learn more about Jimmy's path or that type of policy, feel free to browse our like Qerano website and we have all the documentations ready like on this writing policies page. And also we're working on like 1.6 release, trying to publish everything along with the Qerano 1.6 release. And to just expand on the James path, because this is the theme that comes up pretty frequently in Qerano policies, just a real quick overview. You can obviously go and read the link, but James path is just a query language for Jason that we use internally to perform filtering and selection on complex data structures. And this has been official because it's not a, you can get many of the powerful things that you need to buy policy without having to write a programming language. So by tapping into a filter language, we can allow some pretty complex expressions to be built to do pretty much anything or most things for sure that you'd need to do with policy. So a little bit of background on James path and you'll see that across many Qerano policies. It's not a requirement, but some things you may need to use James path for. Others just a simple pattern statement. Perfect. And then there's a extra question. So I'm gonna continue. What if we want more complex mutations? Yeah, I mean, it's like with most use cases, if your use case gets more and more complex, then you may need to involve some James path, but for simple mutations, you may not need any. If you need to, if you do need to do complex mutations, whatever the definition of that is, that may be one number one stating what your needs are. And then if you look at the documentation and we try and keep the documentation pretty up to date and pretty descriptive of all the capabilities, you can see examples of how that would be done, including in the policies which shooting is showing, and I'll show these a little bit later, but we've got an easy way that she's pointing out to filter mutate so that you can see how that's done to solve either your use case or in many cases, it may already be done. You just pick it up and use it. Right, exactly. Currently we have 22 mutate policy samples here available on the website, but feel free to browse it. But if it cannot address your use case, feel free to reach out and we'll definitely add that to our sample posts. Perfect. And then there's one additional question more. So I'm gonna continue. So we cannot use scripting languages like who are something? Yeah, right now the scripting language that we're enabling is James path. It's not a bring your own scripting language.  But as of right now, it's really just one. And quite honestly, we found that with James path, there are, I mean, at least in my experience and I keep to a lot of what the community is doing. I haven't run across much if anything that can't be accomplished with Coverno policies and James path. I'm sure there are some use cases, but they're probably not fairly, they're not prevalent. Right. And we're also avoiding like doing external costs if we enable like the JavaScript, there's no control on that, right? So currently Coverno can look up data from existing clusters through config map through API costs. And this image like data look up, it just recently added. But that's all like for the lookups of Coverno. So that's one of the other reasons we're just kind of hesitating adding that to the Coverno. Perfect. Thanks for the extra info and keep the questions coming up everyone. We will answer as we go as well as in the end. Thank you so much for the questions so far. Okay. Thanks. Sounds good. Let me just continue from here. All right. And there are also a few other critical enhancements we added to Coverno one six. One is related to the Coverno performance as we've seen that in Coverno prior to Coverno one six, the memory usage grows if you have like a large scale of clusters. And the reason for that is we use this dynamic informers in the background controller and by default the Kubernetes informers maintains the memory cache for that. So if you have thousands of load resources and so in the cluster, Coverno memory would grow in that case. And with one six, we kind of moved away from dynamic informers in the policy controller and it's been verified that the memory usage was reduced from around like 400 Mac to 200 Mac with 80 crown jobs and 10K config maps scheduled in the cluster, right? So just in general, we don't want the Coverno like memory usage to grow if especially when you're running it on the large scale of clusters and we're also in the release candidate of one six. So we're trying to collect more data on that and keep monitoring the memory usage in the future. Okay. And another related is like how you use Coverno like how Coverno deals with failure scenarios, right? We've heard of like some of use cases from the community that the user shuts down the entire cluster, at least the data plan at night and then restart the cluster in the morning without terminating Coverno gracefully. So in that case, when you bring back your cluster there could be a chance that Coverno is not recovered yet. So the admission webhook configurations will block all the resource from recurring, right? So in that case in one six, Coverno enabled this namespace selector by default for you to exclude the namespace dynamically, especially for the namespace like COOP system and other default namespace, you may want to exclude the workloads in those namespaces. And you can also configure the failure policy for webhook configurations per Coverno policy. And by doing that on like, for example, if you set the failure policy to fail, in that case, if webhook is not responding or if there's any arrow of the admission webhook, Kubernetes will just reject the admission request on that. Otherwise, if you have it set to ignore then after the timeout, Kubernetes will just allow everything to pass. Okay, and we also have this dynamic webhook which is introduced in one five. So this is something a Coverno will automatically manage the webhook configurations based on the installed policy. That is to say, when you don't have any policies installed in your cluster, then Coverno won't impact any of your like the cluster workloads or the resources. Okay, one last demo from me for today is these namespace scoped failure action. So as you've seen in the previous demo before some of the resource creation got rejected because I have the failure action set to enforce. And in that case, like especially for a cluster policy you can only control the failure action across entire namespaces. And with this override ability on the failure action you're able to make exceptions for Kubernetes namespaces and simply either like to enforce or audit the policy violations, right? So the example for that I have for today is this Validate Policy. So let's look at the rule body it's trying to match the pods and verify the pods has to have this label app defined under the labels block, right? And here by default the failure action is set to audit. Well, I have this overrides defined and then I'm saying that within the prod namespace I'm enforcing the workloads and the pods must have this label with a key app. Right, by the way, Qerano automatically handles the pod controllers like deployment, state for set and others by adding the additional auto gen rules to the policy. So let's just quickly apply the policy. Let me just clean up the previous one because I don't want my resource be blocked by any of the previous policies. Okay, after that let's apply the policy to the cluster say overwrite failure action. And then once I have it ready, it's ready now. So I'm going to create two pods one in the default namespace and another in the prod namespace both without the label app. And the expected behavior is that the default pod like the pod in the default namespace should be allowed while the pod in the prod namespace should be blocked. Okay. So let's say, could credit run what should be name I use, test, failure action and it's fun in gen X image. In the default namespace. So apparently you can see it's been the question's been allowed. And if I tried to schedule it to the prod namespace so in this case, the pod creation was blocked by Qerano, that's how you can control like make exceptions on the namespaces. So a couple of questions that came up here should think the label pattern is that a rejects and can you explain what the label pattern does? Right. So yes, indeed it's a regex and it's just trying to say you must have this label defined on your incoming pod or workloads. And the question marks it's indicating that you must have at least one and the star like a character is trying to match any of the patterns. And what are the possible action types that are available? Right, the action type. So currently we support creation, update, delete and connect. Connect is something like when you try to exact into a Kubernetes pod. So the emission request is send with the connect type operation. So that's four types of operations. And for the policy, if the question was more around what are the action types that a policy can take, there's really two, there's audit, which means that the resource will be allowed but it'll be reported on in a policy report and there's enforce which means that the object will be immediately blocked. Yes. So enforce and audit are the two options. Right, the failure action only supports enforce and audit. Okay, cool. All right. Okay, I guess that's all the demos from me for today. Let me quick stop here and I'll hand off to Chip. He will talk about like a few new Jamey has passed operators and the updated to rental policies. Yeah, thank you, Shiting. Let me go and flip this in and I realize I hit the wrong button but one thing that I'll mention that reminded me from Shiting's last slide that may not be fully appreciated is when she showed the screenshot here of the validation failure action overrides, you'll notice that this is a Qt control explain command and everything in Converno, all of the CRDs are open API v3 schemas, which means that you can do an explain on any aspect of any portion of a Converno policy or report and it should tell you what it does, what it means and how to configure that. And that's a super helpful thing, as I'm sure you all know, but you don't have to necessarily go and dig them through the documentation or go look at PRs, just Qt control explain whatever you want and it'll tell you how to go about writing that policy object. And Shiting and folks, if there are any questions as I'm going through this, either just stop me or we'll get them in the end. So I wanna keep going, we're Shiting left off as far as some of the new things that are coming out in 1.6 and also show some demos around these. First thing is we've got several new operators that make it even easier or in some cases allows some new policies to be written. And for those that aren't familiar, operators are just a way of when you're building an expression and a Converno policy rather than stating what the pattern, if it's a simple pattern that works well in a lot of use cases, but in other use cases you need to be more expressive around what things should be checked, how they should be checked and what set they should be checked. And so these operators are useful in preconditions which are a way to determine whether a policy is actually going to fire. It's sort of an intermediary in between a match statement and the actual policy body so you can further refine with a precondition based on these operators and an expression that you build, whether this policy should actually apply to an incoming object. And also in validate policies we have a type of validate that is a deny. So a validate rule is just saying I want you to make sure that it looks like this and a deny just inverts that and says go ahead and block if it looks like this instead. And so in both cases we can use these operators and we have got four new ones here and it's any in, all in, any not in and all not in. And let me flip over and demonstrate how this works. So I'm looking at a policy here that uses the all in operator. And so in our validate message here we're doing a foreach and just looping through all of the containers, the ephemeral containers and the end-net containers. And we are interested in knowing if any of these two values, so in this case we're looking at add, the objective here is to drop any pod that has any container that's attempting to add both of these capabilities together, not just one or the other, but both of them together. So if you see a container that has in the add statement net raw and net bind service together, deny the pod. So using the all in operator we can do that and we're going to put those two values in the key statement and we're going to check and see if all of those are in, not just one, not the other, but all of those are in the value of whatever specified for the add statement in a pod. And so if we look at an example of a bad pod here I've got a pod that does add both of those. In addition, it adds a third one, SysChone but it also adds the two that we don't want. So I should be able to block this pod. I'll create the policy, make sure the policy's ready. And apply the bad pod. And we can see as expected, the all not in operator has blocked this because it sees that the two values were in the list of add the add array for this container. So it blocked that. And by comparison, if we look at a good pod that has one of the ones that we didn't want but both of them and the operator is all in. So we should be able to apply the good pod and as expected, that's allowed. So all not in, pretty straightforward. All of these operators are really helpful in building either allow lists or deny lists depending on how you build the expression. So that's all not in. And taking a look at our, that's all in. And then if we take a look at all not in, it's a basically an inversion of that statement where we can check and ensure that we deny. So it's a similar type of expression but we're saying deny a pod if these two in this case capabilities within a drop statement are not in what's in the drop. So an inverted check there. So we should be able to look at a bad pod. First, I'm gonna get my policies. Now I'll apply this policy. And so a bad pod says that we've got Syschone and Netvine service, but the policy said make sure that these two all of these are not in that. And as expected, that is been denied. And then by contrast, if we look at a good pod, it does have both of those. So all of those, those are contained that value. And then that's created. Yeah, and there's a question from the audience. How can we be notified whenever an audit action holds the pod to be blocked? And is there an alert system like the one in communities or something similar from a mirror? So yes, by default, and we mentioned this a minute ago, the validation failure action can be either enforced or audit, if it's an enforced, that means that the pod is gonna be blocked or whatever the resource is, is gonna be blocked immediately. If it's in enforced mode or in audit mode, it will be allowed, but it'll report in a policy report object. So you can see these if you do, for example, C Paul R is the alias for cluster policy report. I don't have anything there. And I don't have anything here, but there's nothing reported. But if I created that bad pod and the policy was in audit mode, I would be able to get the policy report for this namespace because the pod is a namespace resource and see that one of them had failed the validation. And so that's a way for you or if you wanted to decouple that functionality and say, since it's just another custom resource, you can delegate that to like a security group and the security group has the ability to read those policy reports. You can get that information that way, which is a really helpful thing for your Coverno administrators to be able to create policies and then some other group to be able to just simply see what's going on. But the metric angle, we also do have Prometheus metrics that are exposed. And yes, it will show in those metrics. And I don't remember what the exact one is offhand, but it will show a number of resources that have failed. You can go to the documentation and if anybody wants to post a link to that, there's a whole page on monitoring with Prometheus and all of the metrics that are exposed. And we've also got a really cool project that's out there. It's basically a front end, a policy reporter front end that'll show you a lot of these things that are going on in a nice GUI that doesn't entail you having to roll your own. If you want to install that, it's an optional component. If you want to install it alongside Coverno, it'll give you a nice web-based dashboard where you can go in and take a look and see all of your policies and what your audit status looks like. So several good tools there to help. Perfect, so we're getting all of those links to the chat. And I also want to say that thanks so much for everyone who said hi or greetings in the chat. Hello to all of you as well. Lovely that you joined today and yeah, perfect. Cool. So I'm going to skip over a couple of these just in the interest of time. But so talked about the first two, similar type of story with the other two. You know, the gist of these is it we're providing much more granularity for you to be able to select exactly what it is that you want when you build an expression by saying either of these things, can any of these things can be in or all of these things can be in and vice versa. And so super powerful, they'll help unlock new possibilities of either writing new types of policies or making existing policies better. And then the last two things here, we now have support for integer ranges and also some of the existing operators like greater than, less than et cetera, now support duration and Simver. Couple of these things aren't exactly in 1.6, but they bear flashing out or mentioning just because they're super powerful. So in looking at the range, I guess first. So in this policy, we want to be able to check that a host port, so if you define a pod and it has a host port in it, this range operator is a simple way for you to express a large range of ports. I mean, you could use it for any type of integer, but we've got 5,000 to 6,000. You can just simply write 5,000 dash, which is a range operator, 6,000. And any pod that fits this, again, this is a change path expression here, it'll just be blocked. And so if we take a look at example of a bad pod, this is using host port 53, that should be denied. And so if we apply the policy that just had a minute ago, which saying collect all of the containers, including ephemeral and init containers, look at the ports and look at the host ports. And if any of those are not in this range, deny it because this is a deny rule. So we're gonna ask basically 5,000 to 6,000 is our green range. Anything that falls outside of that is bad, so block it. And as you can see, our bad pod here specifies host port 53. DNS is generally not a great thing that you want users to expose on a host port. So let's see if we can apply a bad pod and skirt around that. And no, we can't. And by contrast, let's see what a good pod looks like. This specifies quad five, five, five, five for the host port. Can we apply this one? Yes, we can because this falls within the allow range. So that one is allowed. And on the greater than, so just quickly on these, we'll go and show demos, but on the duration comparison and the Simver comparison, Coverno now natively understands Simver. So you can have something, again, another James Pass expression, which is going into a pod is that's our kind. Gonna go look at the labeling version and gonna get the value of it. And we're gonna be able to compare that using the greater than and it's gonna natively understand is this greater than 1.4.0? Well, you don't have to write any complex, substitution logic or scripting logic. You can just ask, hey, is the version greater than 1.4.0? If it is, block it. If it's not, allow it. So Coverno understands that and the value and it also understands duration. So in this case, the use case for this one might be, if you, particularly in audit mode, if you wanna be able to be informed about pods that maybe have run out there for over a week or a month or something and the images are you wanna have refreshed over time and you wanna rebuild those pods, you can have a label or whatever the key is that expresses time and Coverno with those operators now understands time. So 12 hours, it'll understand that 12 hours is greater than 11 hours and you can express it in minutes as well. So a couple of new capabilities to the existing operators in addition to the new operators that make it possible to write new types of policies as well as existing policies be much smoother and even consolidation of rules because that's another thing that, you wanna be able to express your intent in the most efficient manner possible. And in some cases in the past, it might have taken several rules to do that, even though those rules have been expressed, fairly simply in that you're not programming what the rule is, you just simply writing your intent, but now you can collapse those into one rule oracle rules. Yeah, there's an audience question once again. Ask, any recommendations on patterns and best practices around organizing and structuring policies for large multi-tenant clusters? Yeah, that's a great question. We should have a section on the website that kind of talks about what the organizational strategies that may be useful to you, but in general, you know, a Coverno cluster policy, well, a Coverno policy regardless of whether it's a cluster policy, which is a cluster scope resource or a policy, which is a namespace scope resource, is really a container. The thing that matters are the rules. And so we see in some cases that some users like to simply write cluster policy, like one cluster policy that has all of the validate rules and maybe another cluster policy that has all of the mutate rules or depending on what they're trying to do, maybe there are a bunch of rules that they need to express for a specific type of resource, like for example, you have a bunch of policy that you wanna wrap around pods, but then you have another set of policy that you also wanna wrap around like services, for example. Well, you could create two cluster policies and have your pod policies, one your service policies and another. And a combination of that if you wanted to and also the same type of thing when it comes to a namespace. So you can have a set of cluster policies and also if you're delegating, especially multi-tenant environments where you are gonna delegate some of these functions to your namespace administrators or however you call that, you probably want them to be able to set some policies but they need to have the ability to find those. Well, you can define yours in a cluster policy, they can define theirs in a policy that you don't collide because one policy can't override another, they just simply extend whatever the conditions are. So there's a lot of ways to go about doing it but at the end of the day, Coverno aims to be flexible and also simple with that flexibility to give you whatever the control that you need for your environment and for your customers, your users, you should be able to do that. Perfect, and then there was another one as well from over a year. Can we also generate other resources and validation such as generating CVS or creating deploy for example? So a generate rule is a specific type of rule in Coverno and it's a different type from a validate policy. So a validate rule says, it's like basically a yes or no answer. Like here comes a resource, we wanna take a look at it, is it allowed yes or no? That's a validate rule. A generate rule is here comes a resource based on that and the criteria that's in the rule, what other resource should we create in response to that? So there are two separate rule types, they have to be expressed separately but that's the purpose of a generate rule is to generate a new resource but it still has to match the criteria in the rule. So if the criteria isn't met, it doesn't deny the resource, it just says, all right, the pattern isn't what I'm looking for to create that resource, so I'm not gonna do anything. Perfect. And okay, so we're a little behind here so I'm probably gonna have to skip over these because we wanna leave some more time for Q&A. So we talked about James Path and what James Path is, just a quick recap on that. It's a powerful JSON query language. If you're familiar with JQ, a JQ's filtering application, James Path is similar to that but it has a lot more things that are called filters that are built into it. And in this release, we've added a whole bunch more and so I did wanna show some of these that were highlighted here but since we're getting a little bit on time, I'll just mention that in addition to the existing filters and you can go to the James Path website and see all the ones that they have there which are super helpful. We've also created a whole bunch of new ones which allow you to do common operations like being able to divide and have Coverno understand what the resources are in Coverno these terms. That's one of the great things about Coverno is since it doesn't require you to program, we try and build in as much of the logic as possible. So you can divide one resource like 100 MIDI bytes by another resource, 50 MIDI bytes and Coverno just does the math behind the scenes and also the unit conversion. So that's similar with all of these others. Time sense, the ability to look at a timestamp and an object and compare that to now or something else and make decisions on that without you having to write a bunch of logic, we've already done that. Path canonicalize, the ability for you to look at a path that's specified in like a host path and have that normalized. So there's just like one forward slash in between each path separation. So don't have the time to go into these but urge you to go and look at when it becomes available with documentation, try these out but these are all new James Path filters that are coming in Coverno 1.6 that are not found in the upstream James Path library. Also for each enhancement. So I'm just gonna talk to these real quick because we're running out of time for each is an ability in Coverno that we have to allow you to loop over objects that are in an array. And one of the things that is coming in 1.6 is the ability to use JSON 6902 patches to be able to loop through objects in a forward loop and do things like remove. So strategic merge gives you the ability to do like a customized style patch but with JSON style patches you can do things like specific removes. And so that's now supported. There's an element index variable which allows you to refer to what the specific index is that's being operated on. This kind of goes hand in hand with that JSON 6902 patch element scope. The ability for you to take a look at what the high level object or the field is in a certain resource. And if you need to operate outside of that you can set this element scope field and that allows you to basically pick and refer to any other field that may be in that resource. Also context loops. Shitting showed this a little bit in some of her sample policies but context can now be provided inside of a loop. So the use case that she showed was looking at variables from an image from an upstream OCI register you wanna look at metadata on an image. You can put that as a context inside of the loop and just iterate over those things. Policies and the the popularity sample policy. So for those that didn't know Coverno has over a hundred sample policies that you can download and use right now. And they're of all sorts of resources of all sorts of across all of the Coverno rule types and many of them are even outside of the Kubernetes core resource type. So we've got some there from traffic, some from I think we've got some from Valeros or from Start Manager. So there's over a hundred of policies there out there that you can either download and use right now or at the very least they're great for teaching and giving you some concrete examples of how to build the policy that you want. And if you don't find the one that you're looking for you can probably easily customize one that's there. And if all of that fails, you can open up either a request or come to our Slack channel and tell us about what you're trying to solve and we'd be interested to figure out how to do that. But there are even more coming in 1.6 with over 20. And then lastly on this, the Kubernetes pod secure standards. This is a set of standards that explain what types of controls should be in an environment. Coverno has built these quite a while ago but we've now refreshed these with the capabilities that are in 1.6 and also that align with what the PSS is upstream. So 18 or 19 new policies, over a thousand test resources for just these pod security standard policies. Unfortunately, you don't have time to show how these can be tested in the CLI but these are made available. And they also cover the ephemeral containers which is now turned on by default in 1.23. And also one last note to mention that for those of you that have worked with Coverno policies specifically validate policies, if you have a deny rule, the auto-gen controller, the nice capability in Coverno that allows us to take the rule that you write pod and have that automatically translated for other pod level controllers like deployments, stateful sets, cron jobs, well that now works for the deny rules as well. So that's another example of us doing more of the work on your behalf and you being able to simplify your rules to just get what you want automatically. So just to quickly wrap up here, really the summary of this release is adding more features that solve more use cases through policy. But Coverno's motto is we wanna do things easy, we wanna do things intelligently and we wanna eliminate the burden of you having to express policy. Just get on with the job, make it easy. We're trying to do more and more of that in 1.6. There's no programming required anywhere. It's very quick to get up and running. And as time goes on, we try and look at use cases, solve more of those problems and build more capabilities into Coverno that allow you to do more stuff in less amount of time. But also the other two themes of this release are less resource usage. We know that clusters are becoming larger before people are using it. There's more stuffing thrown at them. So we wanna reduce the resource usage to make it less memory intensive and also more robust for your production use cases. Should be able to trust this. This is an element of security. So we're trying to put a lot of work into figuring out how we can make it more resilient, how we can make it more robust in the case of these types of failures and other events that occur. And so there's a lot of work that's been put through in that regard. So yeah, that's really the summary of what we have for you. And if there's any time left, be glad to take some Q and A here. Yeah, we have about one minute. So we can run through a quick question or so. So essentially this is the last call for questions from the audience. So if you have anything just ask now quickly and we can get to it. And there was one question that got answered with a quick note, but just if you wanna explore further, there was a question from Amir, are generated resources also validated? Are generated reshifting? Do you wanna take that one? I think you're in mute, maybe. Okay, just, yeah, it's just in mute. Yeah, you can verify the Q and A generated resource by adding another valid policy to your cluster. And there you can select on that specific resource using the label because Q and A add labels to its generated resource and use that to validate whatever configurations you want. Perfect. Now we are not getting questions, but we are getting compliments. So great job. Beautiful video, beautiful priorities for the team. So great job from everyone today. So if there isn't any last questions and we are perfectly on time here as well, we did answer a lot of Q and A throughout the webinar as well. So there was a lot of great interaction. Thank you so much everyone for that. But yeah, let's start wrapping things up. So thanks everyone for joining the latest episode of Cloud Native Live. It was great to have Verna here to talk about us, about their latest and greatest US things. So we, I really have to say that so much interaction from the audience, amazing to see that. Thank you so much for all of the great questions. And as always, we bring you latest Cloud Native Code every Wednesday so you can tune in every week or further as well. We have a great session next week as well. So thank you for joining us today and see you next time. Thank you Annie and Tyler. Thank you.


So let me erase this from the whiteboard and summarize what we just did, if I may. So what I'm after here is Marx and the way he thinks his theory. Well, the first thing I talked about, Marx and the way he thinks about society, that his class theory of society was caused by the economic events. That had a shaping influence on Marx. But also, this last one I talked about, and also politics. He was a refugee. That shaped the way he understood society. But also culture. That is, I just told you, Marx studied the Greek philosophers. He studied British political economy, French socialists, and so much more. All those different ideas, the economics of Smith and Ricardo, the struggle of the ancient philosophers with the notions of causation, the socialists of the time, all shaped Marx's ideas. And of course, besides economics and political and cultural events, he was also shaped by nature. I mean, you can't leave that out. How much here he had, his height, his frame, his brain, also was a function of biology and chemistry, like the rest of us. These are different kinds of causations, different kinds of determinations. So political events helped to determine him, shape him, economic helped to shape him, and the result of all of this, if I keep on doing this, is of course Marx. So the dot exists as a site of causations, of determinations, emanating from, literally, everything in society, political, economic, culture, and of course, nature too. So we can say that Marx, in the way he thought, is, now I'm going to use the word, over-determined, by literally an infinity of different political, economic, and cultural events that are occurring. The word over-determination, the prefix on it over, is kind of a, this is what I'm guessing, is kind of a poetic way of getting across to individuals that the existence of anything, in this case, the man, and the way he thinks, or you and me, the existence of anything is complexly shaped by so much, and that over is a way of trying to capture the idea that there's so much outside of us that shapes us over-determined. So, first idea, I'm going to repeat this now. Over-determination means that any particular entity, no matter what it is, and I'm using the example here of the person and the way he thinks, the way he sees, his behavior, is complexly shaped by all these other events, all these other, I'm going to call them, processes, political, economic, cultural, and natural, step one, step two. The way a person thinks and the way a person acts also shapes everything that is shaping that person. So Marxian theory, Marx and his theory, complexly shape, you know, the economy, and politics, and culture, and nature, and it looks messy and it should be getting messy. What we're arguing here is that a person, and the way he thinks and the way he sees, is not only shaped by society, but also is a partial shaping of the society which is shaping that person. And that's getting closer to this notion of the dialectic, is that everything is both a cause and effect. Marx and his thinking is an effect of everything, but it's also a cause of that which is effecting, shaping Marx and his thinking. So nothing in the world, according to this theory, is only a cause or only effect. Everything is both cause and effect. And that's the lesson of this dialectic. Why this is going to be very important in terms of the next thing that we're going to talk about is that when we discuss epistemology, this theory of knowledge that I mentioned to you in the introductory lectures, there we're going to discuss the connection between two kinds of entities. The way a person thinks, and all the political, economic, cultural, and of course natural experiences that the person has. And in terms of what we just did, if we deploy this notion of over-determination, we're going to argue there that the way a person thinks complexly shapes his or her experiences and his or her experiences complexly shape the way a person thinks. Sounds logical. Rationalism and empiricism, the two great epistemologies, traditional epistemologies, I should say, have a very different notion of causation. Empiruses are going to claim that our experiences shape the way we think, but there's no feedback from thinking to our experiences. So in the last instance, experiences will be the foundation for truth. Rationalists are going to argue something very, very different from that. They're going to differ with the empiricists. They're going to argue that reason shapes our experiences. They're going to argue that reason is the foundation of truth. Notice something, that rationalism and empiricism come up with, albeit, two different standards of truth. Empiricism, experience, rationalism, reason or logic, but they have in common that they're both offering two ways to get truth, two ways to kind of validate what is true and what is not true. Marx is presenting a critique of them and an alternative which is saying there's no way to do that. Why? Because the two standards that have been presented, experience on one part, their empiricism, rationalism on the other part, I'm sorry, reason by the rationalists on the other hand, they're not standards. They're not because they're not independent of one another. That is, thought and experience complexly shape one another, over-determine one another, which is consistent with this kind of logic. So on the next lecture, we're going to begin to present that idea and why it's an important idea.


Parents have a significant influence on their children's physical activity levels and screen time habits. Encouragement and support from parents can help increase children's physical activity while reducing parents' own screen time can reduce children's screen time. Additionally, improving parenting practices, parental self-efficacy or changing parenting styles could be effective strategies for increasing physical activity and decreasing screen time This article was authored by Huolanshu, Li Mingwen and Chris Whistle


I think we have everyone so hi my name is Thomas Murphy and this is the first slide on the Google Slides so you can tell I put a lot of time into making the front page for this. A little bit of context about who I am my name is Thomas Murphy I gave a talk last year about Marvel and about how I quit my job and I'm making a game using Blender so context me I'm from Brooklyn I live with my life my wife Marielle Frank there she is she's awesome I have two cats ham and fish and now I have a dog named Daisy I like to add that stuff just because and I'm making a game in the Blender game engine cue the collective eye roll I'm sure everyone's gonna be thrilled to hear that that's 2.79 and not even be so I get I put a lot of stuff up on Twitter and I share everything that I'm doing and I get this comment a lot I actually I got it just before this talk started so the game the game engine's dead right it's dead right it's dead so what does that mean exactly does that mean that it's no longer working or it's no longer functioning it's no longer supported and that the developers the Blender developers have chosen not to support it for pretty good reasons it's kind of complicated to maintain there's not too many users all the a lot of users there's quite a few but you know it hasn't really gained a lot of momentum and there's a lot of other open source projects that are doing a very good job at it as well so it's it's not entirely necessary to everyone let's welcome Finn here he comes I'm calling him out so anyway the the point is it's not a unified workflow but it's there's other game engines that are doing it better but I still want to make a game entirely in Blender and I'm gonna get into those reasons so I've been given all the usual warnings you're wasting your potential if you stick with the Blender game engine a lot of times I hear FOMO a lot of people that want to get into games they think I need to get a job doing games and needs to be tied to a pipeline I need to be making money doing it so a lot of schools will say you need to use Unity or Unreal or you know insert blank here and that's because you feel you won't be validated that's another one that I really like and wouldn't you rather work with something that will give you a job skill and my personal favorite that I get quite often through DM on Twitter is lol dude you okay because a lot of people think that I'm having difficulty moving on from 2.79 I am so this is a bit of a confessional but also I love 2.8 and I actually use a lot of the tools and I'll get into that as well but first let's talk about the options there's better options these are some of the commercial options that we're all aware of they're all really cool yay they're fun some of them have better terms of service or EU LA agreements that you have to sign or agree to when you install the software but I don't want to use these I want it to be an open game there's also open-source engines and I don't want to discount the wonderful work that these do so there's spring engine Panda and Godot which are also wonderful open-source game tools but there is a level of opacity between using these tools and blender you need to import and export the options and typically when you deliver these to a customer or a user they're packed together so I'm gonna get into that later but so I'm going back and forth a lot so why should you listen to me or why are you here some of you are my friends which is great but also I come from the industry so I know a lot you can see up there and you should definitely all listen to me because I know more than you know he isn't aware of these things I didn't even fully put that in there but I'm a power user in blender and I'm very familiar with the landscape of media and the effect that it has on people and there's there's a there's something not quite right with the games industry right now so I want to make an open game and I want to use it in blender so that's kind of a half-truth and the reason is you can't open and edit the files in blender right now you can't simply in a game you can't get the files open them up and then look at them and edit things so I'm very familiar with controlling a narrative and I'm sort of trying to control the narrative in this slide but I messed up so presentation skills a hundred I definitely know what I'm doing so I'm not really a role model if you want to get a jobs in the game industry but I am making this game anyway and it's I guess you could say it's more for ethical reasons than it is necessarily for tying it to money but because I want to make an open game so I just wanted to get that other way to answer the question of what's wrong with me and why am I doing this and there you go so that's your answer and so I set to work working on a game in the blender game engine I've been working on it for over three years and rather than talk more about it I want to show the trailer because I'm a little proud of it and it's got a lot of work in it and it may not stand up to the industry you know all the shaders and all that cool stuff but I'd like to show it so I'm gonna play it oh right also game industry stopped being so suspicious right now they're the big games companies are a bit of a dumpster fire in terms of their PR and this is partially why I think because they're not making open games and there's lots of micro transactions I'll get into that moving on the trailer the press if you're playing this message there might still be time out of these wolves for the sunsets there is someone or something evil here to this world if you stay in these woods after dark choose how you leave it yeah that's that's the little trailer that I put together for it so what's really impressive and I'm really proud of is that that's an open world in the blender game engine and it's a lot of work even though it may not seem up to standards of some of the bigger games out there but yeah that's pretty much it and I want to say personal thank you to all the patreons or patrons I guess you call them patrons that support me in this project because it's an open game so I'm pretty sure that this when I release it I'm not going to be making millions but these fine people all support me and you can too if you want and I'm giving out a free poster if anyone wants so there's a there's a there's a personal plug right there but that's why I created this little title card for the company that I'm making so there it is that's the uh the intro so when you start the game you'll see that logo and it's all about making a game where everyone shares and it's a game that comes out and everyone will be able to open the files and see how they're made and all of these fine artists programmers musicians and animators have actually contributed to the game I was told it's important to make the note that I have paid all of these people to work on this so this is not some sort of free project but something I've really put a lot of myself and my money behind so there's also another way of saying thank you I make in a little animated creature tulpa for every you everyone that's helped at the game some of them are not finished yet because it takes a little bit of time to make them but sort of to digitally immortalize people that support and create content for the game they get their own little personal animal and they're all over the world so the lead programmer of here tim krelin is a tiger and lorianis is a she's from arizona and she's a scorpion it's fun having fun so I also want to say a special thank you to tim krelin the programmer who is very familiar with the blender api and gave me a real boost so I'm going to give him four mr. goobies and you can give him a follow on twitter or youtube he's great so the game how did I make the game it's a horror game and it's intentionally a horror game because you can't use too many light sources in the blender game engine you can only use like five or six so I was like okay we're gonna work in darkness sounds good other things that you have to work with uh well here this is an this is an open world this is cool so what this is using is using matrix transforms in the blender game engine and in order to make this I had to develop a special add-on that works independently also you'll be able to see the add-on if you have the game and it works with no lag which is very important so the next step here was to create the same thing but now add objects to the game so the blender game engine has another limitation you cannot add more than a few objects there's the more objects you have the slower things operate so here we're using multiple transforms again but they're all being massively shared so if there's a single user block that means that this tree is being repeatedly shared but with different scaling rotation and transforms so this is a kind of clever way and a lot of game engines do this but when I did it in the blender game engine it allows me to own it and I'd be proud of how I created it and there's full transparency you can see everything you can just open this up and play with it yourself finally this is it working with level of detail and parallax terrain block it's kind of dark right now not too many lights in this game but it's running at 60 frames per second so it's pretty fantastic the next thing I want to do was I didn't see too many compelling there's a lot of games on the blender game engine that you know they seem kind of dated but you can't make very current looking characters so I reached out to three random people on twitter and Lewis Wambel on instagram and asked them to just design a vampire just come on make one like a scary monster so these are the ones they came back with the two bookends the ones I made and the ones in the middle are made entirely by artists so I've been very agnostic in this project where I don't steer people I just it's literally feral it's like harding cats you just say make one and then I polled people and it seems that the one on the far right was the most popular so we went with that so I made a mood board that's this using some celebrities back there I don't want to call whoever that is but and then these are all just examples of texture and nasferatu and characters that would kind of you know make you think that this is what the monster would look like so I worked with Gabi Haga who's one of my one of the contributors to the game and this is she wanted to model the vampire she said she can do it and I said I believe you let's go so she did so this is actually our back and forth so she's from Mexico and you can see that she the breast starts out a little too perky and we worked backwards from there and we just had feedback so over a period of four weeks we worked on a character model you can see I'm very harsh with my criticism oh my god this is amazing oh my god this is amazing cool so you can see I really like to kick over people's sand castles here's the hand that we worked on and I said you know it's great could we put claws on it and we did so that's the rigged hand on the right over there it's a little bit of a creepy shot we worked on the face and this is when she began texturing it with substance so substance is a really wonderful tool and it's excellent but it's not open source so more on that in a minute I did a overlay on top of the face to see if it looked sufficiently spooky so I just put some blood on it and I was like yeah it looks like a spooky monster okay cool nice so I made two shaders this is the this is all in the blender game engine so this is the top layer shader and the lower shader and then there's just the mesh breakdown so you can see what it looks like and this is all this is just a screen recording so all of these are screen recordings in the blender game engine they look they look passively good I kind of like them we also did some extra work on the head to get a few more details to make it look scarier I guess and then it was a matter of making the character interactive interactive and appear and unbelievable and look good so on the left that's actually in the open world even though it's all pitch black in the background not too many lights in the blender game engine and here you can see there's head tracking so this is the testing environment for the vampire and to see if we can get her to function so this is is working and this is the player control system that tim krelin worked on as well this is her first walk in the open world and lastly you saw hair on the monster so you can't do particles in hair so I similar to unity I kind of hacked the the nodes in the blender game engine and subtracting the the y vector from the UVs of these planes and passing a cloud texture along it you get to add that back to the UVs and then that creates displacement or distortion that makes it look like hair is waving so you get some waving hair and that's how it's achieved in the blender game engine these are typical tricks that sometimes come into play also in unity and unreal they're just they're kind of locked into the engine and when a player plays it they don't have access to all these things and you can't see it so this is the final product again just her hanging out in the dark you can also see in the background that's that's missed that's a missed pass but also it's using a similar trick where it's foggy mist but it's animated but it's all tied to the same animation driver so as the the wind speed picks up so will her hair so it's kind of fun like that you can see how it works and of course oh my gosh the bugs there's so many bugs in blender game engine it's because you know it it's not fully supported and there's there's a lot of gaps so the up blender game engine is a really good answer to that and I tried using it quite a few times but there was actually quite a few gaps in it but these are two of my favorite bugs which are the jitterbug so I found out in an open world the further you get from the origin and this is the same in a lot of games you start going crazy you start just going nuts and I thought that was a really good fear mechanic it's a feature or a bug you can decide but um it's it's super weird um and I didn't know what it was happening for the longest time because you just if you're if you're approaching this as an art as an art project you don't really understand the underpinnings of game engines and all that kind of stuff so I kind of learned it organically after I finished the solve the um the jitterbug it created a new bug I call it the launch bug so when you're set back to player origin because the physics are always active without suspending dynamics you'll simply be launched for the crime of walking through the game so here's the player getting launched into space also could be fun I guess it could be like a feature of the game um again you can I'm certain that with your build of the game you could make these these bugs happen easily and that kind of leads me to the assets of the game because that's one of the biggest parts of the video game and the main reason I did it in the blender game engine I want people to be able to open it and also all most games they have um their content locked down even open source games if you want to use content that was made by somebody else and sold on like turbo squid or blender market or a stock photo these are all you can't redistribute them that means that every item in this game was made either by me or someone I paid to make it because I couldn't purchase a stock photo just a simple tree photo even because that if I launch this game and release it that's me redistributing those assets and that's a violation of the legal agreement when you purchase stock asset so it has to be kind of packaged into the software that you're using so this is an example of the tarot card deck so this is all high poly the grim reaper here he's reaching for the card deck and the conceit of the game is that you will get to face any monster you want in the game and he picks the monster from this card deck so he's high poly and all made in blender and also this is high poly and when it came time to deploy this for real time I simply bake the high poly model in the same file down to a low low poly mesh so that's the tarot card deck so it's very malleable workflow and it's entirely unified which is it's a very unique and it's only something that my game has another example and this is um this is again available in most game engines you can change object color and use vertex painting but this is directly available in blender the tool you'd be creating with ostensibly anyway so why not just keep it in blender here it is so this is me toggling the level of details on and off and also you can see the colors are fluctuating that's just the object color so based on the object color based on where you are in the game these milk crates will change color so they can be reused in the same environment without using any extra memory and it's dynamic so it's pretty cool it's a very fun workflow so again another example here is if you get really close to some of these assets you can see how they're made and they're really detailed and complicated and usually this takes a lot of time and investment so people that make independent games an individual doesn't have time to do all this so i did the crazy thing and just went ahead and took the time to do it so this is the vehicle in the game that the players will be able to drive another fun thing is the animation is built directly as well so you can see the file working file here and then the actual gameplay footage right over here and how it marries up so one of the more fun things for me is always if you ever see a game you get to see how it works behind the scenes and how it's broken a lot of people like that and games are sort of not having that anymore you can't they're getting harder to break but it's really fun to see how it's created and you could edit the animation and then save the file and then make that part of the permanent experience on your desktop so here here she is spawning from a basement so these are portals so the monster will spawn from various places in the game and this is just an example of her spawning in the game again this is also in the open world but you're downstairs so it's not as impressive this is another challenge that the blender game engine has and this also doesn't exist for most games which is the player needs to be mounted onto objects so usually with mesh deformed objects in the blender game engine they cannot be synced with solid objects that are parented to it so if there's a cube parented to an armature in the blender game engine it'll appear out of sync with the armature modifier so to get around that i worked within the constraints of the game engine which is to create two separate armatures and then mount them to each other so the armature of the arms match with the armature of the door which is also a mesh modifier so that's actually her performance but you can limit it these these these only update when you animate it it's kind of weird so here's another example the arms are interacting with the window which also has an armature that's what the black line is right at the top up there so and you can now transfer these mounting points from the player interacting with things to get caught by the vampire so there's an example whoops you got you that's the vampire that's how she gets you so um and this is the mounting system basically yeah another interaction system is when physics-based objects that don't need armatures can be interacted with this is some gameplay inside of the house and you can pick up any item thrust it toss it around to distract the monster or to use them the item so this is the inventory and the items that the player can pick up it's pretty dull i guess i'm gonna just join this but you can see the interactivity i threw some garlic on the couch that's that's cool yep you can do that so again there's just an insane amount of items in this game lots and lots of unique items from blender in the blender game engine right down there in the left corner it's called the blender riser and most of these items were either made by other artists or myself um down the bottom left hand corner you can actually see the cards that will morph in and out and these are using environmental effects tricks that are also available in the blender game engine so or unique assets like this this is just a single asset and what i committed myself to doing was the most boring assets so i went to other artists and said you wanted to make something cool and they were like yes of course so gabby haiget did the vampire um so i said um on twitter got to room in bellow he got to make the weapons which is something that a lot of people tend to like to make in 3d and no one really wants to make a microwave so this is a hotel microwave that i made is really boring and then but you know these are the things that need to get made but are very often purchased and therefore very difficult to distribute in an open game um and of course this will yield very fun results so here's actually the player and you can open the file and just kind of do weird stuff so this is just to show the versatility of the workflow and how i can open things up and look inside and you know it's creepy she might not be a vampire um moving on just another asset so you may notice that this one has texture painting on it um and i'm going to get to that in just a minute and again this is a bed made by gabby haiget so you can hide under the covers that's fun and uh here's other tricks that you can utilize so in the blender game engine this chair is bilaterally symmetrical it's the same on the left and the same on the right so i can use two uv maps with saving texture space so there's a small there's a small texture of just normals that defines the geometry and how the light bounces off and then the lighting the ambient occlusion map so these are really fun tricks that i can get away with in the blender game engine here's a few other items made by lori anis um the front door of the house um that can be massively reused throughout the level and here's some neat um flame effects it's to the simple billboard that tracks the player and um all made there's the high poly model and the low poly model next to it in the game engine there's environmental effects like fire and being burnt away and this kind of i guess glowy light you call it these are similar tricks in all game engines of course a procedural sky this was baked to a skybox but also this procedural um there's also procedural noise in this game engine as well which is actually pretty neat and not a very well known feature also procedural water so the water itself is using parallax mapping for the uh the ground and then there's distortion and here's a better shot of that so you can and simon toms helped me make this but you can simply edit this live so if you had a copy of the game you could open the file up and then play with this which is kind of fun it was just another noise shader here's a parallax shader so you can get really cool detail results so again this is me working within the constraints of the blender game engine to sort of get away with making a more visually compelling game so this is parallax there's there appears to be depth but it's a simple plane again here's more parallax the wicker the wicker pattern on the basket is just a simple low poly basket but it appears to have lots of detail because i'm taking advantage of the powerful shaders in the blender game engine this is venetian cane i guess and on some of the wicker pattern so that shows up too cool and here's the open world being used with all the parallax and all the neat stuff so this is running at 60 frames per second on my 1080 so it may it may drag on other systems but there it is here's another example of a high res texture being reused over and over again to create more detail so you can share massively textures throughout the game this is some gameplay footage of the grim reaper um dealing some cards so you can see this is an actual isolated scene in the game that also takes place in the open world and he shuffles the cards he deals the cards you pick your fate yeah there you go that's how it works so it's it's kind of like it's very neat to be able to see this and game big games don't have this they there's a there's this there's this wall between you and the interaction you'd have to there's usually an aggressive microtransaction kind of thing that would happen you'd have to purchase this or something like that but you can just jump in here and change things around you could change the picture of the monster to I don't know a picture of a cat speaking of monsters introducing Mr. Goopy so this is a door but also it's showcasing the AI stand-in so it's kind of scary to work on a game all by yourself so I made Mr. Goopy here and to test the AI in a in a horror game at night in the dark actually is pretty scary believe it or not he's kind of starts to wear you down so I made him to test this AI here's the AI functioning it's using an A star path finding algorithm it's the the standard path finding that comes in the blender game engine actually it's just right there so you can actually edit it and here you can see he's he's coming for you so the last time he sees you is the it's the little green ball if you get out of that sphere of his line of sight for more than five seconds he'll investigate and then go back to searching other points of interest so he kind of relentlessly got me there so that's kind of on a loop there but that's Mr. Goopy and he's been very helpful he's my friend because it's lonely working on a game all by yourself in a room just on alone also I've been able to exploit vehicle physics so I also inadvertently made a really kind of fun off-road game too so there you can drive a car away which is kind of the the conceit of the game again which is also wish fulfillment if you want to change any file you can if you'd like to get in a car and drive off into the interstate you can also do that so you can just get on the road and drive miles away and you can do that that's fun you can just get out of the car here's an example of me attempting and failing to distract the vampire so this is the AI testing bed with the vampire I took her textures off because he's less scary that way but I'm basically failing to distract her right now so bringing it all together this is a shot of the game this is what this is representative of the final footage there she is looking for you and I'm just gonna jump in this closet here so this very small section takes tons and tons of work and it's not like a lot of the stuff that we at blender usually tend to see which is like you're usually working with just whatever is in the frame of the camera and you got all your compositing it looks great but to make a whole game especially exclusively on the blender game engine it's very difficult and kind of mind-numbing and this is the result of years of work just to get this functioning so it's actually there's a forest outside take my word for it but it's it's a lot more work than I initially initially thought it would be but it's just on a loop now so I'm gonna change the slide so what's the plan like it's because I got making an open game that seems nuts and you're just gonna give it all away and then people can open it up and do stuff with it yep pretty much that's it that's the plan so how's it work well you could maybe buy it for me I'm probably going to put it on itch.io or gumroad and then you'll have access to the file so it'll go to your hard drive and then you can open it with blender you can also open these files with blender 2.8 no guarantee whether that will then work again with blender 2.7 because it's a different system but if you support me on patreon here you'll have the knowledge of knowing that I will be in a dark corner somewhere continually working on the game how's that work it's weird right it's because this is also kind of software as a service I know that's in the news these days or some people that are aware of games are aware of that but mine's a little different so in this example here you're walking through the open world and it's very sparse and that's because they're all massively shared assets I will be working remotely constantly just updating the information of the levels so the next time you visit this same place it could appear flush like this and that's because I'm constantly publishing and republishing using my add-on updated information so basically the game can grow and grow and get better and better and you'll be able to see its progress and track its progress while I work on it and also eventually it'll hopefully come to a state where it'll appear indistinguishable from a triple A game that's kind of the goal it's it's really ambitious and kind of might be the hill I die on but you guys can become my patrons and watch me die on that hill so here's an example of me just warping around the entire environment checking things out really quick and uh just jump over here a massive amount of assets so there's tons of them in there you may also wonder why how I could do all this even in three years there's a lot of them and while I did get a lot of help I also cheated so if anyone knows lubos project armory and armor paint I am using armor paint and that's a really good tool that I let recommend a lot of people use so armory is also a game engine and that promises a future life for my game on other devices which will be deployed to mobile mac every device basically android ios all that stuff and here's just a really quick example of being able to use armor paint which is just like substance designer except the the features are very threadbare and some of the the normal features aren't there like baking for normals are currently not available and this is just a video of me quickly going through and filling in those gaps and then I take it back into blender and I bake the normals back in blender so I'm using this now and if you are interested in learning how to do substance designer and get better I recommend you use substance paint because it will grow with you and as you learn these new features you'll have a tool that supports you and there's no expensive creative cloud membership also so definitely use armor paint I'm using it and I'm making huge gains in progress and it's much faster so here's two items that were made in substance by gabby haiga they're wonderful and here's armor paint these are also made in armor paint and this is a knife made in armor paint and here's a couch made in armor paint so normally something texturing something like in blender could take a day or two days this took me about an hour just whip it out and just model it up really quick so you can get a lot done really quickly with substance and also armor paint and here's an example of the whole scene with everything made in armor paint except for this which is obviously the comparison as is made in substance so you can see that things look of equal quality pretty much and that's great so for the future this is a very frightening version of the game this is me in the process right now of porting parts of the game over to armory so it'll be available for every system like ios and everything and it'll obviously be able to have more lights too which is great but right now it currently exists in the blender game engine as an open game also here's another example of procedural water that exists right out of the box in armor armory so i suggest getting to use armory is like a really good idea also in interest of time i think i'm done or i don't know if i am i don't know what's time is it uh 1631 i think tom ton had the wisdom of making this talk like the last talk in the salon and in the interest of giving up the um the narrative uh i'm also leaving time if anyone has any questions or if anyone wants to yell at me and tell me i'm very very wrong any questions yes i'm not doing it i'm doing it in um the question was um why am i not doing it in godot instead of and using armory and that's because again um i i want the files that are in the game to also be available to artists so people that are interested in playing games can then also edit those one of the more odious things about the gaming industry um is that there's microtransactions where a simple action a creative action is limited from the user and you will be charged five dollars to change the color of hat i feel like that's that's very limiting and kind of you know it tends to prey on people impressional children um like gambling mechanics and all that kind of stuff i don't want to date this talk by calling out individual companies but just google it you'll you'll find stuff it's fun so that's why i'm doing it um even though it may not be the greatest business model any other questions okay it's getting on here okay thank you guys very much


So Till, what do you have for us today? So we have developed a new tool to help and support the health worker in the primary health care facility to better manage the acute illnesses in children. Such as what acute illnesses? So the acute illnesses that we cover are more or less all the more frequent infectious diseases that could happen in children. And so the one that will bring cough, fever, diarrhea. And so we help the clinician take care of the patient more than the disease actually. How do you do that? So we design a clinical pathway so it means that we have created a full algorithm that states step by step all the process that the clinician should take in order to appropriately identify the disease and give the appropriate treatment. This has never been done before? This was never been done in MSF. We were providing some guidelines that are more broadly presenting. If you reach this diagnosis, then you should give the treatment. But it was not clearly defining how you reach the diagnosis. So this is what we bring in you. We have developed, I mean, the idea was based also on what was done by WTO in this integrated management of childhood illness that already had developed some syndromic algorithm. But actually their guidelines were very ambiguous and it was not driving neither the clinician to the diagnosis. And a lot of disease we are not addressing in this algorithm. So I can see on the table you've got the algorithm which is written down on a paper format. Exactly. Because we wanted to really stress all the steps that should be taken especially also to identify which patients are severe which one should be referred to the hospital but then also to go according to the child presentation into specific guidelines or recommendations we ended up having a very complex protocols and pathways. Being a doctor is not easy. No, being a doctor is not easy. So how do you make it easier for the doctor? And how do we make it easier for the doctor was by programming now all this content into an Android application that helps the clinician navigate through all the process of the consultation. So all the content here has been created into this electronic algorithm and now the clinician will take all the steps and answer all the questions to the tablet and it helps him to reach the appropriate diagnosis. So here there is a lot of checklist like making sure that there is no severe signs no dangerous signs and if there are not then we continue and we need to register the patient. Maybe just I should mention at that point that this is not a patient file we have just designed what we call a clinical decision support system it helps the clinician treating the patient the day he comes but we haven't developed something that would allow the clinician to get this information once the child comes back. It's not an electronic medical record health information system it's simply a condition to own. But still we need to identify the patient because what we wanted possible was that when the child comes if there is a lab test to be done or if there is a more severe case coming this consultation should be posed and the clinician should be able to take another patient while waiting for the patient to come back to the lab or to take someone more severe. Dr Bognavi. Clotilde this looks excellent and can you tell us when you've used it what would have been the outcomes what's different I noticed from your poster here that there's something about antibiotic prescriptions which is obviously very important can you tell me a little bit about that? Yes one of our big objectives was to reduce the huge over prescription of drugs that happen in our context we should remember that in the primary healthcare settings or facility we work with there is a lack of qualified health worker I mean it's nurses it's sometimes community health worker that handle the consultation they have received limited training they often receive limited supervision and they work in an environment where the child mortality due to infectious disease is very high and because they have no access to appropriate diagnostic tools nor skills they often tend to prescribe an antibiotic to be on the safe side and it results in a lot of unnecessary antibiotic prescriptions and then driving antibiotic resistance so one of our objective was to help them identify the patient who need but also the patient who will not benefit from antibiotic and so this tool has been implemented now since end of 2016 in three health facilities in Central African Republic and what we saw is that we managed to reduce by two to help the proportion of consultation where an antibiotic was prescribed and if I can ask the devil if I had the difficult question then is that safe I mean have you seen more children have worse outcomes because they aren't getting treatment or because you're enabling people who aren't nurses or doctors to treat these children so has there been any adverse outcomes so currently we haven't in this project we haven't measured the clinical outcome of the patient and actually what we can say is that also when we were providing our clinical guidelines our green guide we never looked at the outcome of for the patient on the treatment that we are giving what we know because it has been measured in other settings is that giving inappropriately antibiotics do not prevent antibiotic infections and do not bring better outcome so but this is something that we are still considering trying to perform appropriate research so that we can measure this clinical outcome and show that our procedure are safe I mean for an MSF context this sounds fantastic you're expanding access you're bringing treatment closer to the people and you're doing it in what seems to be a very safe way without an overuse of antibiotics would that be a safe summary? It is a safe summary and I think what maybe I would like to add at the end is that when we looked at how it was implemented in Central African Republic we implemented it in three health facility that were already it saw its government health facility that were already supported by MSF since two years so the clinician had received some training by MSF nurses expatriate nurses that bring some clinical training and supervision but until we brought the tablets the supervisor felt that this training were not really getting translated into the consultation process and so this now the good result that we have with the use of the tool is not only the tool itself it's also combined with the training but you just see that it is a put on I mean it's potentialized like it's synergized it's just amazing how this tool can bring a difference in the consultation process now. Great, good luck, thanks very much.