Hello everyone and thank you for joining me for today's webinar and thank you CNCF for hosting it. My name is Travis Rogers. I'm a developer relations engineer over at Teleport where we provide identity native infrastructure access for engineers and machines. Now we're going to see a demo of how Teleport works with Kubernetes later, but that's not the main reason we're here today. The main reason we're here today is to discuss Kubernetes clusters and how to secure them. Now, if at any point during the presentation you have questions or at any point afterwards, my email is right here on the slide at travis.rogers at goteleport.com. I'd love to hear from you. Feel free to email me. But if you want to access the broader Teleport community, then check out our community Slack. You can get to that at goteleport.com slash Slack. We are an open source project, so the link to our GitHub is right here as well. And if you want to try it out, we have a labs page where we actually spin up the servers and teach you how to use it. That's at goteleport.com slash labs. And finally, you can find us on YouTube where we do tutorials, webinars, videos like this. So with all of that out of the way, let's get started with the webinar. Okay, so here's a diagram of how I think people learn Kubernetes. So they're at this starting point. Maybe their job is asking them to learn these skills, to manage their clusters for them. Maybe they're learning it on the side. It's like a hobby or an interest. But usually you start out here and you think, hey, I got this checklist, I got to check off to learn Kubernetes. But what really happens is you get pushed into this scribble fast. There's just so many things to learn with Kubernetes, so many moving parts. It's a pretty complex machine. So you get in there and you realize, hey, wait, I need to, I don't even know containerization, I got to learn that first. And then you get in there and there's so many little parts to it. It's just pretty complicated to learn Kubernetes exhaustively.  Great. At that point, you're able to get your cluster up and running. You're able to deploy a cluster. You're able to deploy an application without errors, because we all know the first time we try to do that, we get lots of errors, crash loop backoffs, things like that. So you can get the cluster up and running, you can deploy your application without errors. It's running out there in Kubernetes. And you can navigate the cluster. You can use kube-cuddle. You know about services and stateful sets and pods and all of that good stuff. But there's one main key that's left out here. And that is the fact that Kubernetes isn't safe by default. You've deployed your cluster, you have applications running in it, you can manage the cluster, but you didn't do anything to the cluster's configuration. And that configuration that was deployed untouched isn't safe by default. It has to be configured to better increase its security posture to make your cluster more secure. Now, let me show you something that reinforces that. So this is the 2022 state of Kubernetes security report by Red Hat. So Red Hat polled 300 DevOps engineers and security experts. And here was the result basically. Respondents worry the most about exposures due to misconfigurations in their container in Kubernetes environments. So almost half of all of these people polled worried about exposures due to misconfigurations in their container in Kubernetes environments. This was nearly three times the level of concern over attacks, which was 16%, and with vulnerabilities as the second leading cause of worry at 28%.  Now, if you're using managed Kubernetes like AKS or EKS, you get a lot of these security benefits. But if not, you just deploy your cluster, you're going to have to do things to make it more secure. And that's what this video is about. So we're going to look at five ways that you can secure your cluster. So let's secure Kubernetes. Okay, so the first security measure we're going to talk about in regards to your Kubernetes cluster is at CD security and secret management. So you probably already know, at CD is a highly available key value store for cluster data, including your secrets. So securing at CD is critical to a cluster security. If someone obtains read or write access to at CD, it's basically giving them root access to the cluster. So you're going to have to do your due diligence to secure this vital piece. Now, how do you do that? Well, we're going to give three ways today. First, you need to encrypt your at CD data at rest. Your default Kubernetes cluster does not do this. Your at CD data and your secrets are in plain text. So if an attacker were to get your at CD, they can just read your data as plain text. So the first thing you can do is encrypt that at CD data at rest. And I'm going to show you hands on how to do that today. So let's go to the Kubernetes documentation. There's a page called encrypting secret data at rest. And basically there's four steps. First, you need to create an encryption configuration object. So here's the encryption configuration object. You specify your resources. So here we have secrets and config maps. And then you specify your providers or your encryption type. So today we're going to be using AES CBC as seen down here in the tutorial. So that's the first step. Create this encryption configuration object. After doing that, you need to add three things to your API server manifest file. So let's walk through this. Let's create this encryption config file first. So I'm going to take this information and copy it. Now I'm using mini cube today is my Kubernetes cluster, you can use whatever variant you want. But what we want to do is we want to SSH into mini cube. So I'm going to do mini cube SSH, because we want to take this encrypt encryption configuration object created as a file on the control plane node. So I'm going to SSH into my mini cube server. And then I'm going to CD into Etsy, Kubernetes. And I'm just going to create a folder. So pseudo mcder. I'm going to create a folder called ENC. This is going to be my encryption folder. And I'm going to CD into that. Now I'm going to do a pseudo vim. And I'm going to create a new file called encryption configuration dot YAML. And inside of that file, I'm going to paste the contents we just copied from the Kubernetes documentation. So I'm going to go up here first, I'm going to erase this other resource. And I'm actually going to erase config maps too, because that's not really pertinent to what we're doing today. So we have resources secrets, and we have this provider a ESCBC, we have a key named key one, and a secret, we don't have a secret yet, we need to generate a secret. So to do that on the documentation, there's actually a command we can run. So let's go back there, run this command, this will generate us just a random string of numbers and letters. So I'm going to open a new window, and just paste that in, and copy this string of characters. And that's going to be my key. This key is what's going to encrypt my secrets. Come here and just paste that. And I'm going to save it in that location. So right here in this ENC folder, I have an encryption configuration file that much is done. So the next step is you want to add this encryption provider config flag on your cube API server manifest file. So you want to add this as a flag, and have it point to that encryption configuration object you just created. And then we need to add that folder is a volume and then mount it. So let's do that.  And within that there is a manifest file called cube API server. So let's do pseudo vm cube API server open that up. So the first thing we want to do is we want to add that encryption provider config flag. So let's do this in alphabetical order. Just going to put it right below this encryption. And what was an encryption provider config encryption provider config. So encryption provider config equals and then the path to our file. So Etsy, Kubernetes, ENC encryption configuration dot YAML. So it points to our file. That's the first thing. Second, you want to go down and I'm going to do a page down, down to the end and add a new volume. So let's do host path and our path is going to be Etsy, Kubernetes dot ENC. That's where our encryption configuration file is is in that folder. And we'll do type directory or create. And then as far as a name, we'll just put ENC. Now we need to scroll up to the volume mounts section so we can mount this. So let's go right below this and do mount path. And it's going to be the same location Etsy, Kubernetes, ENC name is going to be ENC and read only is true. And that's it. According to the documentation, those are the three things we need to do. And so let's go ahead and save that. And when we do that, it's going to recreate that API server pod. So I think when we exit, we're not going to be able to do anything yet. Okay, get pods. Yeah, we can't do anything yet. It might take a minute to get this back up and running. But when this comes back up, any secrets that you create from this point on will be encrypted. And we'll go and check that to make sure that it's working. Let's try it again. Okay, get pods. Okay, our API servers back up and running. So what's next in the documentation? How do we verify this? So verifying that data is encrypted, we first want to create a new secret. So we're going to create a new secret. And then we're going to read that secret out of Etsy D using Etsy D cuddle and see that it's encrypted. So let's create a new secret. So I'm going to run this command. And it's going to create a secret called secret one. Secret created. And then, like I said, we're going to read that secret out of Etsy D.  I'm going to add a cube exact to it so that I exact into that Etsy D server and spit out that secret. And then I'm going to do the hex dump. So it's the same as this. I'm just adding a couple commands to it. And then I'm separating the hex dump part of the command. So it's going to go like this. So I'm going to paste in this command. And it's going to spit it out as a file called secret. And then I can do a hex dump. So cat secret hex dump dash C hit return. And you'll see that we have the AES CBC encryption here. So when it says key one, it's going to be encrypted. So as long as you have the AES CBC here showing, you know that your data, your secrets, are encrypted. And this is going to encrypt all of the secrets going forward from this point. Now, if you want to go back and encrypt all the previous secrets that you had before this, just follow the documentation down where it says decrypting all data, you're going to move this identity value, and you're going to run this command and that encrypts all of your old secrets. So that's encrypting your Etsy D data at rest. That's the first thing you can do. But there are a couple of problems with this, the way we did it. So the first problem is going to be that the encryption key on the server is in plain text. So if somebody gets on your control plane node, they can just check out that encryption configuration file and there's the key and that key unlocks everything. It's in plain text. The second problem is that you face manual key rotation, which can be pretty cumbersome. And third, this encryption type is actually not recommended. The one that they show on their website, the one that we just followed. So if you go here and go back up to this provider chart, you'll see that there's a number of providers. So we use this AES CBC provider. The strength for that is weak. It's not recommended due to CBC's vulnerability to padding oracle attacks. So what else do we use? Well, we could use secret box, which is strong, but it's a newer standard and may not be considered acceptable in environments that require high levels of review. There's an AES GCM that is not recommended for use, except when an automated key rotation scheme is implemented. And then there's identity, which is no encryption. So what do they recommend? They recommend the KMS provider here, the recommended choice for using a third party tool for key management. And the key to this KMS provider or key management service is that you can manage your encryption key outside of your cluster. So think AWS KMS, Google Cloud KMS, or HashiCorp Vault. There's some great documentation for these providers out there, and that is the recommended way to go. That is the strongest and has the most benefits. Now let's move on to number two. So the number two way of securing your etcd or secrets is to restrict access to your etcd. And that involves isolating your etcd server. So the only thing that should talk to etcd is the API server. What you can do is stick a firewall between the two just to ensure that only API server traffic can get to etcd and nothing else. And then finally, the third step is to ensure that the API server is using TLS. All right, so the second way you can better secure a default Kubernetes cluster is by using network policies. By default, Kubernetes allows all pod to pod traffic inbound and outbound. So see here in this diagram, we have a namespace, all pods can talk to other pods freely. But if an attacker were to gain access to one of those pods, they would be able to freely move to other pods. So this is a problem. We don't want this traffic to be wide open, and it is by default in Kubernetes. So what's the solution to this? Well, the solution is network policies. Network policies restrict unnecessary namespace to pod to pod access on the network or transport OSI layers. So a better way to handle this with network policies is to first set an all out deny policy. So instead of allowing all pod to pod traffic, allow no pod to pod traffic in a namespace. And what's neat about network policies is they are additive. So once you deny all this traffic, you can then add on traffic rules as needed. So set an all out deny policy, and then add allows as needed. Here's an example. Let's say you have a front end application in react. You have a back end application or pod in dot net, and you have a database, a MySQL database in another pod. By default, these three pods can all talk to each other in a namespace. And we're assuming here that they're all in the same namespace. But ideally, the front end shouldn't be able to talk to the database and the database shouldn't be able to talk to the front end. But the front end should only be able to talk to the back end and then the back end to only talk to the database. So how would you apply network policies in this scenario? Well, first we would set again this all out deny policy. So set this network policy to this namespace and none of these pods can talk to each other. And from there, we can add allows as needed. So if we add another network policy to allow traffic from the back end to the database, we get this. So this network policy is applied to pods with this label. It's ingress, and it matches the labels with back end at port 3306. So this network policy allows our back end to talk to the database. It allows ingress into the database. We would also want to create one from the front end to the back end. And by doing so, we restrict this wide open access between pods to allow only the access that's needed. So this is network policies. And if you need this kind of protection, not at the network or transport layers, but at the application layer, then you can look into a service mesh solution like Istio, which allows networking policies at the application layer. All right, number three on our list and similar to the previous is pod to pod communication. By default, Kubernetes allows pod to pod traffic unencrypted. So previously, we saw that Kubernetes allows free flowing networking. Well, here we see that that traffic is unencrypted by default. And we definitely want to encrypt our data. So right here in the diagram without TLS, we go pod to pod in plain text for any attacker to pick up with TLS, we go pod to pod with encrypted traffic. So what's the solution to this? Well, the easiest solution is to introduce either Istio or linker D to your cluster, because both enforce mutual TLS between meshed pods. And that's enabled on both by default. So by introducing either one of these solutions, you get mutual TLS within meshed pods. In the case of Istio, Istio deploys an envoy proxy to each application container that will enforce TLS encryption within the service mesh. So here's the Istio mesh within that within each application container. There's an envoy proxy that enforces TLS encryption. And if you go with Istio, make sure you set the M TLS mode to strict and not permissive strict enforces TLS only permissive allows TLS and plain text. Number four, let's look at secure access. So any user that presents a valid certificate is considered authenticated. With that in mind, we want to disable anonymous auth, and we do that in the cube API server manifest like the one we visited earlier, we do that by adding this anonymous auth equals false flag that will disable anonymous auth. Now if anonymous auth must be used, like in your circumstances or with your company, you need anonymous auth for some reason, our back should greatly limit what these users can do. So use our back to greatly limit anonymous users as a whole. Number two, you want to disable the insecure port. So the API server actually has a secure and an insecure port, you want to go in and disable that insecure port. Why? Because this insecure port bypasses authorization and authentication checks.  Number three, you want a well maintained RBAC. This is not something you set and forget. This is something that is well defined and well maintained regularly. So that's a well maintained RBAC. And then finally, you want to introduce some kind of corporate solution management. So admin should consider managing normal user accounts with corporate solutions like Active Directory, Okta, et cetera, via OIDC. Now an open source application like teleport provides secure access to Kubernetes clusters by way of short lived cube config files and certificates via single sign on. And I want to demo that for you today. I want to show you how secure and easy it is to access all of your Kubernetes clusters via teleport, the open source version of teleport. So I'm going to open up my teleport cluster UI. And I'm actually going to log in passwordless. So I can choose passwordless. And then I'm going to use a passkey that's stored on my phone. If you're not familiar with past keys, they're a new and secure replacement for passwords. Teleport supports it. And I think more and more applications will as the year goes on. So I'm going to scan this with my phone and sign in with my passkey. Okay, so this is the UI of my teleport cluster. I'm signed in as teleport admin. That's a user. If I go to Kubernetes, I see that I have no Kubernetes clusters to access via teleport. So we need to add one. What's neat about this is that if you go to team, you can create users and you can assign them roles here in teleport. So you can enroll all of your Kubernetes clusters here that you can access. And you can use our back to control who has access to what. And we'll see that in just a minute. So to add a Kubernetes cluster, just go to Kubernetes, add Kubernetes next. And there's this wizard that walks you through it. So I'm going to copy this. This will add the teleport agent chart to your charts repository. Let me go to my terminal and put this in. Again, I'm running a mini cube cluster. All right. So my helm repo is added. And step two, generate a command to automatically configure and install the teleport agent namespace. So teleport service namespace, I'm just going to put teleport is going to be on my namespace. The name of my cluster is going to be a mini cube cluster. And click on generate command. What this does is it generates a command for you to enroll your Kubernetes cluster with teleport. So the first thing it does, it creates this prod cluster values file with some information. And then there's a helm install based on the information of that file. So let's do this separately. Let's capture this first part and create that. All right. So we have now have the prod cluster values file. And then we do this helm install. Now I'm going to add a label to my cluster. So I'm going to open up VS code, go to new file, text files find, paste this in. And then I just want to add to this command a set labels ENV equals dev. So I want this cluster to have a label with ENV equals dev. It is an environment dev cluster, not a prod cluster. That's all I'm doing here. So copy this command, go to my terminal and paste that in hit return. And our teleport agent has been deployed. Let me clear the terminal here. And while the container spinning up, this wizard takes you through another couple of steps of setting up access and testing the connection. I'm not going to do this because I don't have any roles configured yet. So I'm just going to exit out of this once this is done. So I'm not really concerned about this timer that detects the teleport service. All right, if I check my pods now K get pods. You'll see that my teleport agent is running. So if I go back out to teleport and click on Kubernetes, I should have my cluster listed. That's how you enroll a Kubernetes cluster to teleport. So from here, I can connect to the cluster. And you do so by clicking connect and following these instructions. So number one, log into teleport. So teleport comes with a couple of CLIs. There's the TCTL CLI, T cuddle, which is the administrative CLI. And then there's this TSH CLI, which we can use to log in and log out and things like that. So the first thing we need to do is log into teleport via the command line, because that's where we're going to be using cube cuddle. So I'm going to paste that command in here. I'm actually going to erase this last part. And here I have the proxy flag for my proxy, which is teleport tr dot asteroid dot earth. I have my off and my user of teleport dash admin. So this will log me in. Enter my password, my password and then tap any security key. I'm using my Yubi key. So tap that for second factor. And there we go. I'm now logged in to teleport via my teleport user, teleport admin for 12 hours. And this is configurable, but valid for 12 hours. I have a 12 hour certificate. So I've logged in. What do I do next? Well, next is an optional command you can run to set a different cube cuddle configuration. We're going to use the global. So we're going to skip to step two, which is select the Kubernetes cluster. Now let me show you this. If I do a cube cuddle config view, you'll see that my current context is mini cube. We don't want that. We don't want to access mini cube directly because, you know, that's on my local computer. We want to access this Kubernetes cluster through the secure functionality of teleport. So that's what this command is going to do. This is going to issue us a short lived certificate. So TSH cube login, mini cube cluster. So let's run this command. Let me clear this run this command logged into Kubernetes cluster, mini cube cluster, try cube cuddle version to test the connection. Let's try that out. Cube cuddle version. All right, everything's working. Now if we do cube cuddle config view, you'll see that my current context is now teleport tr dot asteroid dot earth slash mini cube slash cluster. So it looks like we're using teleport. And the last command is to connect to the Kubernetes cluster. So we just need to run cube cuddle get pods. So clear this again, cube cuddle get pods. What do you think is going to happen? Well, this user cannot access Kubernetes unable to list resource pods. This user cannot request Kubernetes access has no assigned groups or users. Why is that? Because our teleport admin doesn't have any roles. It has no privileges to access this Kubernetes cluster. Even though this Kubernetes cluster is enrolled with teleport, we still have RBAC in place to control who has access to what. So let's do this. Let's go back to team and roles. Let's create a role for Kubernetes admins. So create a new role. I'm going to call it here Kubernetes admins. And this is a default template. So I can erase everything below this, because I don't want any other privileges with this role. And I'm actually going to erase this Kubernetes users because I don't need that at the moment. And under Kubernetes groups, I'm going to put system masters. And this is never recommended. This gives you admin access to the cluster based on a system master's default role that Kubernetes has. But just for demonstration and this Kubernetes admins group, let's do that. Click save changes. And then let's go to users and my teleport admin user, let's edit and add that role to that user. So Kubernetes admins and save. Now our teleport admin user has a role for Kubernetes admin access. So let's go back to our terminal. Let's do TSH logout because we need to get a new certificate that role is in the certificate. Let's do TSH login again for teleport admin and login. All right, great. And you'll see now that a Kubernetes cluster says mini cube cluster in our Kubernetes groups for this user is system masters. So at any point you can do TSH status to see your status. And now that we have that system masters group, we should be able to do K get pods. And it do it successfully because we now have the privileges to do so. There we go. We can do K get services and whatever else. So that is the role we're going to give to teleport admin. But what if we have other users come on the scene? Like let's imagine that we have this role, we have these users come in that you just want to give them read access. They should only be able to read the pods of a Kubernetes cluster. So let's create a new role. Let's call it developer read. And again, let's erase all this stuff. We don't need it. And for Kubernetes groups, I'm going to erase the users also for Kubernetes groups. Let's imagine there's a group called developer read. This is a developer read only group. So let's save this. And what we're going to do is we're going to create some roles in Kubernetes. So this is not teleport. This is Kubernetes related. And I have some examples that we're going to use. So we're going to create a role in Kubernetes called dev read. Resources will be pods and pods slash log. And the verbs will be get list watch. So a read only role. Then we're going to create a role binding called dev read binding that binds this role, this dev read role to a group called developer read. So let's go ahead and do that. And actually, I have both of these roles already on my system. So let me just apply that. So cube cuddle create dash f dev read role. I think it's called dev read role. Let's create that role. All right. And then we create the role binding. And again, this is not teleport. This is just Kubernetes. This is creating a group in Kubernetes called dev read that only has read access to pods. So now in teleport, this role that we created edit gives access to a Kubernetes group called developer read, which is the the group that we just created in Kubernetes. So what I can do now is I can create a new user. Let's go to users create new user. Let's call him Bob. And let's select a role. Let's select the developer read role. So Bob is a new developer on our team. And all he needs in Kubernetes is to read pod information. So let's save that. And here's a link and an invite link that I would send to Bob. So I'm going to send this link to Bob. He's going to click on it and set himself up. So get started, Bob, let's create a password for Bob and click next. And we're going to use a hardware key. Try another way in a USB security key, which is my UB key and registration successful. Great. So here's Bob. Bob has no access to servers applications. He does have access to this mini cube cluster because we gave him access. So let's go and log in as Bob. Let's do a TSH log out and do a TSH login as not to teleport admin, but as Bob. And let's see what Bob can do. So Bob's logging in. Bob should only be able to read from Kubernetes. So K get pods. Let's see how it goes. No resources found in default namespace. Great. What about K get services? Bob can't do that because he is in the read only group. Forbidden, user Bob cannot list resource services in the namespace default. So this goes to show you that you can have lots of developers and whoever's on your team. And you can give them different access to this Kubernetes cluster securely through short lived cube config files. So teleport admin has admin access to the cluster. Bob only has access to that developer read group. Now one more thing I want to show you, let me log out as Bob and log back in as teleport admin. Other sign in options, password list. So try another way. Again, I'm going to do my pass key. And now if we go back to team and roles, if you look at this role developer read and go to edit, there's a section called Kubernetes labels that has these two stars. This means that basically you can access any cluster given that you have the right group or the right other access. But this labels gives you access to clusters with any label. Well, remember we added here this ENV, if we go back to Kubernetes, we added this ENV DEV label. So let's say that this developer read, we only wanted them to access prod clusters. We could come in here and do ENV prod. And then I can maybe change the name to developer read prod. But what this is going to do is this is going to take Bob and not allow him access to that cluster because that's a dev cluster. He only now has access to prod clusters. So there's a lot of ways you can limit access for your users. Now the final thing I want to look at in this demo is audit logs. So if you go to activity and go to audit log, we can see everything that everybody did. And more importantly, all the kubectl commands ran. Now remember, Bob has access to the developer read group. So everybody using that developer read group, the logs are not really going to help us a lot. We're going to see that somebody use developer read developer read different people. Well, this audit log is going to show us which user did what with lots of info. So right here at Kubernetes request, user Bob received a 200 from get pods. So this tells us that Bob ran the kubectl get pods command to this Kubernetes cluster, mini cube cluster. Imagine if you had 15 clusters in 50 users, you would be able to see the audit logs for every individual person here. If you need details on it, there it is more information here in the details button. We see here that Bob got a 403 when he tried to get services. So that audit log is very, very, very helpful for teams. So here's a diagram of what we just saw. So the users are going to do this TSH login to log into the teleport cluster. From there, from their machine, they can run kubectl get pods or whatever commands to the Kubernetes cluster. At no point do they access the cluster directly. They only talk to this teleport proxy. The Kubernetes cluster runs this teleport agent and has an encrypted tunnel back to the teleport proxy. And you can even put a firewall there for more protection. So that's the section on secure access and the demo of teleport. Let's move on to number five. Fifth and final on the list is pod security. So here's a bit of a backstory. A few years back, I got put on a team and none of us really knew a lot about Kubernetes or containerization. And we were asked to containerize a lot of apps, create helm charts for those apps and deploy them into Kubernetes. So going back to that first diagram, we started that journey of learning Kubernetes and containerization and we thought we knew a lot. So we got these applications containerized, we figured out helm charts, we created helm charts and we deployed them to Kubernetes. But we were application developers. Once that application was running, we, you know, high five, checked it off the list, we're good to go. We didn't think much about pod security because we didn't know a lot about it. But pod security is very important. If you're pulling images, docker images or helm repos from third party websites, they possibly could introduce problems like root access or some misconfigurations that weaken your cluster security. And the reason I gave that example is because there are a lot of talented application developers that containerize applications, they throw them into Kubernetes and they're good to go. They don't know a lot about maintaining Kubernetes and Kubernetes security. They're not really supposed to their application developers, but you need somebody on your team to overlook that security. So when it comes to YAML configurations that are introduced to the environment or containers that come into the environment, they need to be audited. Now you can do this manually by having someone or team do that, or you can look into vulnerability scanners as listed here. You got cube striker, cube score, cube lender, vulnerability scanners that will look for potential holes in your YAML and your containers and try to find that problem before they come into the ecosystem. You can also utilize security contexts. As you can see here, there's a security context on this pod with run as non-root as true. And what this does, if you have this setting, the cubelet will refuse to start any image that defaults to the root user. So hopefully when you containerize your application, you set a user ID and a group ID, but sometimes if you're not careful, those containers will come over with root access. And by setting this security context setting, it will refuse to start the image that defaults to the root user. That's another protection. And there are more security contexts, things you can look into. You can see it here on the API page. So again, make sure your YAML and your containers are audited when they come into the ecosystem, either manually or with vulnerability scanners, and then use tools like the security context to make sure none of your pods are running as root. And with number five being done, that leads us to our conclusion. So again, five things to check on your default cluster is number one, your etcd security or secrets management. Number two, network policies, use network policies. Number three, pod to pod communication. Make sure that's being encrypted. Number four, secure access. And number five, pod level security. And with that, thanks a lot for joining me in this webinar today. I hope you learned a lot.


Wow, this is a pretty good room. I'll post a picture later, but actually in the green room they had this incredible array of musicians and performers and things that have been in this very room on this very stage, so it's a huge honor to be here. You got a little bit of introduction, but my name is Matt Mullenwick. You can find me, my main blog at MA.TT, my photo blog at matt.blog, and if you want to tweet me things, these events, at Photomat on the important and other major platforms. Being in Europe, this is actually the first time, as you know, this is, I think, six-word camp Europe, sorry, and every previous time I've done primarily a town hall Q&A or an interview style, but there's so much going on this year that we have a bit of a presentation. I just have a lot to share with y'all. And being in Europe, I wanted to highlight one thing in particular. The eagle-eyed among you will have noticed that there is a new link in the footer of the WordPress.org and Foundation websites. That is a link to something called public code. There we go. Anyone heard of this before? I have a couple. I want everyone to be aware of it because this is something I've been pushing for in the US, at the local state and federal level, and this is the European version. Basically what it's saying is that when public taxpayer money is used to buy software or create software, shouldn't that belong to us? Right? Also, when you think of the amount of money that goes into open source development now and the scope of what that's been able to affect with WordPress, certainly. If you imagine even just a small fraction of the national budgets going into open source software being directed there, I think we could have a Cambrian explosion of open source solutions. In addition to all the other reasons that y'all know why open source is great, if two cities in different parts of the world or different parts of Europe are doing the same thing, there's no reason they should create two completely separate solutions for things. Allowing them to share their code and maybe search and replace Paris with Belgrade but use the same software would be really handy. Check this out. It's now being linked. I think this is very, very important for the world today. Second thing I wanted to announce for y'all is as you know in the US versus in Europe we change location every two years. So I am very proud to announce that the host for WorkCamp Europe in 2019 and 2020 will be the lovely city of St. Louis. This follows Nashville and that I've never been to St. Louis. So I'm looking forward to checking it out and learning and exploring a new part of the country that I haven't been to and of course hope to see many of you there if you're able to make it over to the US. Okay, let's get over to CORE. There have been since the WorkCamp US in December six CORE releases. So things have been going along. I wanted to update you on the four major focus areas as well since that's how we've been orienting development. If you remember the beginning of 2017 we shifted from being kind of a release lead model to kind of a focus area model. First of these is customization. Exciting things going on here as we figured out a way to basically turn widgets into Gutenberg blocks, sidebars into post contents and have done some mock-ups and some explorations for selecting page layouts. As you know the editor part of Gutenberg is going to be phase one. Phase two is customization and moving to editing the entire website. So that has already kicked off under progress and there's some exciting things coming. The WordPress CLI. Who uses WP CLI here? Just out of curiosity. Nice, yeah. So very excited that this became a core kind of officially adopted project. It had two major releases and version 2.0 which changes some of the packaging to be easier for distribution and dependencies is coming out in July. So keep an eye out for that. The REST API, in addition to a little bit of security work, it's spanned it a lot because as you know Gutenberg is built entirely on the REST API so every part of it is working. So we did some work around search and auto saves to make sure basically it spanned the APIs to support our first party usage. The nice thing about this is that when we're able to use them ourselves it also means that other third parties are probably likely able to use them better as well. And then finally I want to talk about the mobile apps a little bit. That team's making a huge investment into right to left support and accessibility including supporting native OS things like voiceover and some of the other things that Android and iOS provide. They made it so when you make a post you don't have to wait and watch it, it uploads in the background. I just want to highlight that 1.3 million posts and 3.7 million photos have been posted via the mobile apps in just the past month. So they're starting to become a very major part of how people interact with WordPress. The accessibility front as well, I think it's worth noting because I consider based on all the assistive technologies available on PCs, Macs, iOS and Android these to actually be the most accessible ways to interact with WordPress today and I think that will continue in the future. It's just the tools are better around making things accessible via these apps than the tools like Jaws and other things that are kind of trying to hack into web browsers. I know you all want to hear about Gutenberg, right? Just to review a little bit, we've accomplished a lot with Gutenberg thus far. The major features that are in it so far are we have a block-based writing experience with over 20 blocks built in. Gutenberg is fully adaptive, meaning that when you're looking at it on a small screen, a medium screen, a large screen, a huge screen, the design and functionality adapts to be fluid and easy to use on any of those. There is, there we go, optimized for direct manipulation of content. So we're bringing it closer to where what you're editing looks a lot more like what you're seeing on the front page. We have a block API with support for static and dynamic blocks. This is one of my favorite, the universal API, which is copy and paste. Who's ever tried to copy and paste things into the WordPress editor or any other place else and it just goes kind of sideways? Gutenberg already has support for fully supported copy and paste from Google Docs, Apple Pages, everyone's favorite Microsoft Word, Office 365, Evernote, Legacy WordPress, random web pages, and then finally something I know will be very popular with this audience is Markdown. That's actually what you're seeing in this little gift there is a copy and paste from a Markdown source, whether that's a note editor or wherever you want, you paste it into Gutenberg, it translates it just instantly into Gutenberg blocks. It's very, very slick. If you haven't tried this yet, highly recommend trying it. It's one of my favorite hidden features alongside, I'll tell you all my other favorite hidden feature, which is that when you copy and paste a URL onto some text, it auto-links it. It saves a ton of time. There's templates with predefined blocks. So this is starting to go into where you can see hints of where we're gonna end up with full site customization with this, which basically allows you to create for your users or for yourself kind of pre-built layouts where you can say, okay, a title goes here, an image goes here, some text goes here, a map goes here. That can be reused over and over again or assigned to entire pages. They're shared blocks, so if you do want to reuse things across the entire site, that can be a shared unified resource. So when you edit it once, it shows up everywhere. And finally, very excited about that we have nested blocks and child blocks. So these are blocks within blocks, like it's turtles and blocks all the way down. And child blocks, which only work if the parent block is there, perhaps like your children. Media drag and drop, extensions, where you can add extra things to the sidebar. We have this beautiful Hello Bell grade extension here. Overall, there's been 30 Gutenberg releases since we started and 12 just at WorkCamp US in December. As you can see, this is kind of running through all the different releases. There have been over 1,700 issues opened and 1,100 closed in the Gutenberg project thus far. And from the development point of view, I'm very proud of it. We have open development, design lab testing, iterative releases, presentations across pretty much every WorkCamp now, including here. It's developed with wide awareness. Support and awareness from every single page builder out there, you know the names. We already have people extending Gutenberg through plugins that are starting to get some good pickup in the directory. And major sites, so agencies and others have been building and launching things with Gutenberg because to be honest, it works. It's not perfect yet. We're not ready to release it yet, but for the things it does, it does them well. And you can actually just tons of site using this in production already. There are now 14,000 sites actively using Gutenberg. So this isn't just installed, this is actually active. And just released this week are tools for enterprises. It's one called Gutenberg Ramp, which is a new plugin from VIP, which basically allows you to turn Gutenberg on for certain post IDs, page IDs, or content types. So that way you can start to phase in. So you have a really complex sort of set up of WordPress and maybe certain post types of things have extra customizations. You can start to turn Gutenberg R for parts of it, not for others, to get to the point where you have everything on and fully done. But the question I'm gonna preempt so you don't need to ask it, is what's coming next in the world of Gutenbergification? Which is just kind of fun to say. Sounds almost like a German word, right? Here's the roadmap. So these are things happening in June, which means they are highly eminent. First we're gonna freeze new features coming into Gutenberg. We've reached a point where there is a functionality that matches and in fact a many area exceeds what we accomplished with the legacy editor. We're gonna encourage host agencies and teachers to start opting in folks that they have influence over to start using Gutenberg. Very much especially if it's someone who you're working with closely so that you can start to gather feedback from third-party users of it, people who aren't involved with the development every day and pass that back of course to developers. This is to compliment the user testing, sense of user testing that we've already been doing. One of the hosts that's gonna be sort of contributing to this is WordPress.com. So there's several hundred thousand, the high hundreds of thousands folks on WordPress.com that actually use the WP Admin interface primarily. So we're gonna be offering them a call to action and an opt-in so that you can start using it very soon. One of the key metrics we'll be tracking there are the number of sites and number of posts that are using this. And then finally the mobile apps which I like said, which I said are getting more and more popular. Right now if you move between editing things in the mobile apps in Gutenberg it breaks in a pretty spectacular fashion. So within the next few weeks that will be all fixed up across both iOS and Android. Coming up in July, there's gonna be a 4.9 point something release that has a strong invitation in the dashboard. The first time we've done this to either install Gutenberg or the classic editor plugin. So basically we'll be encouraging people to get on the train early or if when 5.0 comes out your site's not gonna be ready for it, install the classic editor plugin for those who don't know. Basically locks in your site to use how the WordPress WYSIWYG editor works today. So it kinda opts you out of Gutenberg. We're of course gonna be tracking the use of both of those. We're gonna switch to opt-in for wp-admin on .com to be opt-out and then tracking who opts out and trying to gather as much data from them as why because there's gonna be a lot of information there especially from people who might be using third-party plugins WordPress.com. Be a heavy, heavy triage in bug gardening getting all the blockers to zero.  The customization leads to start the work for what we wanna launch hopefully this year which is more of the full site editing experience of Gutenberg. So in August and beyond, we'll have all critical issues resolved. It'll be integrated with the Calypso interface on WordPress.com which is where the majority of people use it. I wanna have 100,000 sites, 250,000 posts that have been made. So 100,000 sites active with Gutenberg. So over 10x where it is today or about 10x where it is today. And with a quarter million posts, I think we'll be able to say that a lot of the bugs will be worked out. We're gonna merge into core and then a five-point-out release cycle. So beta releases, translations. And then finally we are planning this work undergoing, it's not ready yet, but there'll be full mobile versions of Gutenberg by the end of the year in the iOS and Android app. So by August it won't break when you move between them. And of course Gutenberg is done in a way that makes the content in the market backwards compatible. But we're actually gonna have the blocks supported in the mobile apps so that as you drag and drop blocks, move them around, have different sort of fun things you can do that'll all be there. We could have a five-point-out as soon as August. Some of these things that I put up there I'm very, very sure about. The big thing that we're not sure about is as we will vastly increase kind of the aperture, the usage of Gutenberg across hopefully over 100,000 sites, what's gonna come in and the nondeterministic nature of fixing bugs means that I don't know exactly of the issues that get raised, whether they're gonna be small tweaks or whether they might be sort of huge things that are gonna require a few weeks of development. That is why I can't promise you a date. But we've done a lot of testing thus far. So the nature of bugs that we find, if there's no black swans in there, of bugs, I do think that five-point-out is gonna be ready within a relatively short timeframe. And that's all I got. So thank you very much. This is the. We do have time for questions. If you're up for it. Excellent. We've got a mic over here. We've got a mic on this side. Please queue up and come bring your questions from Matt. So I think if you, yeah, if you walk over, there's one there. And you gotta stand up. We don't have a mic runner today. So you'll see one on this side of the room and one on this side of the room. Please come on down. I hope after all that, y'all are excited about Gutenberg coming as I am. I was wondering is WordPress is getting acquired by Google as what happened with GitHub and Microsoft and what the ads full tracking company like Google is doing at this event because I also heard today that only deep the bugger for Gutenberg is going to be Google Chrome. And the second question is WordPress.org is not open-source anymore. Yesterday on contributors day, I wanted to commit solid MVC standard supporting camel case at plug-in names. And by the WordPress meta team lead, I was told that this part of WordPress.org is closed at source and will never be open-source. And will not be able to commit suggestions like camel casing, thank you. Wow, okay, don't go away because I'm gonna ask you something about your first question because I didn't fully understand it. So nothing on WordPress.org has ever gone from open to closed. It started off as fully closed and then we've been opening it up as we kind of go through and clean up code, remove passwords, get rid of all the Illuminati conspiracy stuff. And that's why, I don't know about this particular area. You said there was something about camel case and... Yes camel case is not supported and the solid MVC, PSR4 out the loader standard says that we should support camel case at plug-in names. And this is not supported, I suggested it and I was rejected because this is closed at source and I cannot commit a suggestion to this part. It's like I was like fully rejected because I cannot suggest. Well, I think, I don't know whether that suggestion was rejected because they disagreed with camel case as I do. I don't know if they felt like that. They love it, they love it. But we said it's not a priority and I cannot put into a priority list because I cannot suggest. Like you cannot suggest and you cannot get a vote on this. Ah, well drop it in the meta bug tracker anyway even though the code isn't directly example there's no reason not to have it in the meta tracker and there can be discussed, debated and you know the code will happen if it's agreed on. On the first part I didn't get there's something around tracking in Google that I didn't understand. Yes, the Google company is tracking everybody like now this time in Serbia. I was not even able to, yes in Serbia I was not able to log in to my Gmail without look. I was asked to log in to Google website. So this is a new thing. Google is pushing me like Facebook to read the messages on Gmail. So that's a bad thing and I was wondering it will happen the same as what happened with the GitHub. I trust it in GitHub and they are sold to Microsoft. What will happen with the WordPress? It will be sold to Google or not? Yeah. That's an amazing way to thank our sponsors. Yeah, there's a lot embedded in there. So where to start? Well the good news is that Google can't buy WordPress like about GitHub because WordPress is not a company or a thing that can be bought. It is, you know, there's WordPress.org, there's the WordPress Foundation, there's all the code that's open. I don't think the code behind GitHub is open. I don't think it's open. I don't think it's open. I don't think it's open. I don't think it's open. I don't think it's open. I don't think it's open. I don't think it's open. So even if let's say, let's not say Google, let's say some sort of evil corporation, somehow bought something, I don't know, automatic, something that is buyable. You know, anyone here in this room could download WordPress and rename it Not Evil Co-Press and move on. And in fact, that's how WordPress itself started. It was a fork of an existing open source project called B2 Cafe Log. That forked because it had been abandoned, not because there was any sort of philosophical difference. But that's one of the great beauties of open source, is that when you build something on an open source foundation, it can never really be pulled out from you because the sort of fundamental rights embedded into the open source license, the GPL that we all hold near and dear, prevent that. So regardless of whatever corporate machinations or tracking or whatever goes on, open source code belongs to you as much as it belongs to me or anyone else here in this room and you have control over it. So thank you very much for your questions. Before Josefa Hopson, I'd love to just put it out there to our live streamers. If you have questions from abroad, please send them to us over Twitter or we can probably get one or two in. Awesome. Should they use the hashtag for that? They should probably use the hashtag for that. WCEU. Very cool. My name is Josefa and I actually have a question about Gutenberg. It sounds like you've made a whole lot of progress and have a lot of features in it. Is there a particular feature that you are excited about or one that you wish were in there that's not in there yet? I kind of gave it away already, which is the copy and paste. It is I find myself enjoying different writing environments for almost different states of mind or different tasks. So sometimes I'm coming from simple notes where I'm writing more plain text or sometimes I'm writing markdown. I use kind of every place. There's Scrivener, there's like all sorts of different places where I enjoy writing sometimes, even Google Docs. And so the experience now of bringing those over into Gutenberg without really needing any sort of API integrations, WordPress.com has a Google Docs integration, but honestly it's a little clunky to move between things. And so it's one of my favorite things. Do you have any favorites? The Don Quijote feature? Templates. And why do you like templates? Yeah, templates are great. Matias just said how it kick-starts things for users. So basically you don't just give someone a blank canvas. It turns what might be just a purely blank canvas, which can be very challenging, to almost more like a color by numbers. You can express a lot of creativity within certain lines and create something really great, which is one of the things WordPress has always been fantastic at. So, all right, thank you very much. So the left, and it looks like there's no one. Oh, there is someone on the right. You just popped up there. Yeah, I waited. Pop-up question. I just want to hear your opinion about the future of combining the web circuits technology with web apps and the way to use, I'm gonna invent a term, multi-hybrid app and web app that is functioning as a complete app for the app store and for the Android store and also managed in the same platform and on your site on the WordPress. Yeah, it's a good question. We're going in that idea theoretically trying to develop something. So we're trying to hear your opinion about the future of this development. I mean, there's very exciting technologies coming out of two big corporations, one of which is the sponsor of WorkCamp Europe. Thank you, Google. Facebook has React Native, which is more and more Gutenberg is completely built on React. As you know, there was a question about us switching licenses and moving away from it. They changed the license of React to be GPL compatible and remove the patents clause and we decided to stick with it. It's been really great. And there's some other things and tooling built around that that we might be able to leverage a lot more in the future. I've definitely seen some really cool experiments going on with React Native. And it's, of course, what powers, for example, the Calypso desktop app. The other thing coming from Google, which is very, very exciting since they also contribute to the largest open source browser, which is Chrome, progressive web apps. So there's lots of technologies around there that I think could drastically speed up how WP admin works in a way that makes it a much more applied experience without it actually needing to be completely rewritten from the ground up. So I feel like there is an opportunity to get sort of almost like a JavaScript app-like performance increases from WP admin in a mostly backwards compatible way with progressive web app technology. So that's very, very exciting. It's also open standards that are being supported by many places. So I feel like there was a time there when it looked pretty dark to be honest for the web, particularly around performance. Things were just going slower. And of course we know users start to tend, they tend their users to search things that are faster. So they end up things are winning. But between AMP, progressive web apps, and just all the improvements and optimizations that we're making, including things coming under the hood like PHP 7, basically doubling performance of WordPress overnight. It saved me more than 70% on the servers expenses. I don't know why any host is not moving everyone to PHP 7 because they'll save hundreds of millions of dollars. Like it's ridiculous how much faster it is. So these things are making it so we can have a really competitive experience. And I'm excited about the future of the web. I have a dream of managing a website and an app, a cross app, hybrid app on the same platform. Could it be possible? There's gonna be, I don't think it's possible today to be honest. Today not. There's, for example, as we do Gutenberg on mobile, we're gonna want blocks that are registered by plugins that work both on the web and within the apps. It's not clear how or if that will be able to work today, but we'll use WordPress's influence and our best of our knowledge and coding abilities to try to get something there where we can actually have some commonality. So being able to have plugins for the app that's using on your phone, again, that's not something that you really see with other apps. Okay, thanks. No problem. How about over here? My question is about the timing for 5.0. At least in Europe, August is typically a very slow month for our companies. Plenty of time to upgrade. So it would be kind of difficult to actually get the decision makers in the companies to set up an appointment, discuss, you know, upgrade plans and so on and so forth. Wouldn't that risk of giving skewed statistics about how many people would actually switch to the Gutenberg versus classic editor because many people would just play it safe, have a nice summer, and deal with it after it? I think a summer with Gutenberg is way better than a summer without it. I don't know what y'all's idea of vacation is, but I'm supposed that could be something. There's a lot, rest of the world. There's a whole Southern Hemisphere that'll be in the winter during August. And there's America where we never take vacation. This place is all over. And so, I guess we'll keep an eye for that, affecting the numbers, but like I said, I don't actually think it's the worst thing in the world if you install a classic editor for August. Came back in September and, you know, did a tanned installation of the latest Gutenberg in 5.0. I think that would be totally okay. So, I'm not trying to rush y'all. It's just we want to get the improvements out there as soon as possible because, and one of the points I tried to make in that previous slide, which I think I didn't really articulate fully, which is that even though 5.0 is coming out, hopefully in August, that there's gonna be hundreds and hundreds of thousands of sites using Gutenberg actively before then. So if you're a plugin developer, a theme developer, and you have things that aren't yet compatible with Gutenberg, get on that right away. That should be basically your highest priority because you're gonna start to see the early adopters of Gutenberg plugin are gonna be kind of the best and brightest customers, maybe the ones spending the most money with you. So you want to make sure that that is kind of fully up to date as we move into that. Cool, thank you. I've got a question from our livestream, if you will, Matt. Sure. This is coming from Aaron Jorbin, who asks, how long do you expect the Gutenberg API to be frozen before the final release and is a stable API necessary to build developer trust? I expect the API July-ish. So when we do that, when we start to branch off the customizer, one of the things that allows to build some of the customization stuff is a stable API in Gutenberg. So maybe a little after the feature freeze, but way before the release. Oh, thank you, Aaron. We miss your bow tie here and we can't be here. Yeah, let's go over here. All right, hi, Matt. Greetings from Munich. I wanted to ask about GitHub, which is probably evil now. I think most of the last features, big features like the REST API, WCLI, and now Gutenberg were developed on GitHub with the issue tracker and pull requests and stuff like that. So when do you plan to abandon Trekk? Yeah, thank you. Wow, we have a range here. We have Microsoft is evil, we need a move, we have Microsoft is good, the switch to GitHub. You know, I actually don't have any issues of being in the companies that have been mentioned thus far. I think things are often a lot more nuanced. In terms of GitHub, I think it's been a really fantastic place and one of the advantages of keeping Gutenberg a plugin as long as possible, like I'm in no hurry to do the core merge, is that kind of the things on it have allowed for a really rapid pace of iteration. I mean, the features I just talked about is kind of equivalent to what we did like the past five or six years in core. We've really been able to move really fast with this. That's not only because of GitHub though. It's a function of the technologies we're building on, doing something from scratch, the fact that it's a plugin so we wanna release frequently and get feedback. People working on it, the amazing contributions that have come from people in this room and not in this room. I'm also interested, you know, it's public that I'm on the board of GitLab, which is an open source, not just competitor to GitHub but that does a lot of other things including DevOps integrations. So we're keeping an eye on that. I would say that we're evaluating tools. Track has stagnated a bit, but there's lots of others in the marketplace. I think Gitia is another one. If anyone's come across that, it's used by Go, or it's written in Go, used by the Free Software Foundation of Europe and others that I think are worth evaluating. But I put all that in the bucket of meta work, like things that we don't really need to make to ship Gutenberg and things that aren't necessarily gonna help our users. You know, into getting this out as soon as possible and not even gonna help like plugin developers and other people who are already developing on their sort of place of choice. So it's on the list, just further towards the bottom. Thank you. No problem. Matt, I'm one of the co-organizers of the Cape Town WordPress Meetup and one of the questions that I get asked the most by attendees is what was the problem that you were wanting to solve with Gutenberg? 12. Almost everything that we showed there is something that's showed up in user testing or in personal frustrations of developers and folks in this room. So I mean, the beauty of Gutenberg is, no, okay, here's the problem. That the foundation of WordPress that has now served us well for 15 years will not last the next 15 years. I don't think there's anyone that disagrees with that. But when WordPress started, there was barely any JavaScript in the entire application. In fact, I think we called it DHTML. I don't remember as back in those days. Gutenberg not only provides a modern interface that leapfrogs the best of what all the modern web builders and website creators are doing out there. It provides a development framework and foundation that I think will become the basis for everything we do on WordPress. If you notice, Gutenberg is JavaScript talking to APIs. You all might remember in 2015, I stood in front of you at WordCamp US and said, learn JavaScript deeply. Who's been doing that? A few people. All right, I'll repeat it. Please learn JavaScript deeply. JavaScript is the future of WordPress development, particularly on WP Admin and Pluginsite. And so Gutenberg brings in a way to do that, as we've shown, that we can move really fast. So that's the fundamental problem. We're solving lots of user issues along the way. And if you watch the team post some of these videos, where they do user tests to the P2s and things, they're really fascinating in eye-opening. Or if you don't wanna watch one of those, just sit someone who's never used WordPress before or someone who is very familiar with WordPress and ask them to do something like create two columns. Right? Ouch. If you don't know HTML and a bit of CSS, you're stuck. That is so basic. Much less being able to customize your site the way that people imagine, outside of taking a theme but then going beyond that. And so our mission of WordPress is to democratize publishing. That's a problem I've been working on for 15 years. I hope to work on the rest of my life. Gutenberg opens this up to an entirely new audience and continues along this mission. All right, over here. Mr. Moldova, hi from Amsterdam, Sebastian. I have two short questions about world domination. Number one is what can we do according to you as a community to get Gutenberg adopted by every, yeah, rememberable CMS in the world? That's number one. And number two, how can we after that get all the people to WordPress? So first we switch to other CMSs to Gutenberg and then we switch on the WordPress. Okay, that's sneaky. It's like the Trojan horse. In a way. Other CMSs adopting Gutenberg is up to them but it's been cool to see some explorations there thus far. I've just seen discussions. I don't know if it's gone beyond that but I know the Drupal community has taken a look at Gutenberg. Also there's others that are building their own things inspired by Gutenberg which I think is pretty cool as well because for a long time I've felt like this kind of block based approach is the best way to edit the web because it really takes advantage of the web as a native medium of something that can bring in elements from many different places and we've been stuck for far too long in this kind of document based editing. So I think the best thing we could do to other people adopted is just make it as awesome as possible. WordPress's market share is already pretty commanding within the open source CMS space or the CMS space in general. So they're watching everything we do already. To make this transition be successful which is kind of the other part of your question is gonna be the best reason to get more people adopting Gutenberg which we made open source because we wanted one to adopt it. Meetups, word camps, friends and family whoever you can show Gutenberg and as I said I believe it's ready to start installing the Gutenberg plugin for them. Walking them through it. Showing them some of the cool features that I just showed you up here. Finding out your favorite parts of it just like I got that question. Figure out what's your favorite part of it because that enthusiasm is infectious and that's how WordPress itself spread largely. There really wasn't any significant advertising in the WordPress space till last year so everything prior to that was basically a word of mouth. It was people like you here in this room telling your friends, family, clients, developers anyone who will listen whether they want to hear it or not about how cool this WordPress thing is. So use Gutenberg ramp, use the Gutenberg plugin try to get as many people running it as possible. Like you said as a community we have this goal of 100,000 sites, 250,000 posts. The sooner we get there the sooner we'll identify all the things that'll make the next version of Gutenberg better. You had a part two, right? Yeah, how do we make sure that the people go to WordPress after? Oh. But switch to Gutenberg. To me fundamentally I want people on an open source CMS. So if they're on open source to me that makes the web a better place and so if they're adopting any of the open source us or the compatriots I think that is good for the web and good for the world. To dot the WordPress in general one thing I think we can start to do more of is think about the entire user experience around WordPress not just the things that happen when you log into WP Admin. Think about all the steps that might lead people there from the moment they might Google a term to signing up with wherever they're gonna host it. The onboarding process, the unboxing process of WordPress is something that we often forget about because we all did it three, five, 10, some 15 years ago. It's been that long since we were a brand new user and so putting ourselves in the shoes of those new users which again might be Google around might be seeing lots of ads on the TV for Wix and Squarespace to really understand why WordPress is different, why it's gonna be around longer than any of those other ones and then how I can solve their needs which is probably not, they didn't wake up in the morning saying I wanna see a mess. They probably said I want people to be able to find me online. I want people to make reservations for my restaurants. I wanna tell people or show people my work, my photography, my creativity. I wanna write and reach an audience. These are all WordPress is a means to an end there and so we need to show everyone how it can help them accomplish those things. Exciting, thanks, I had, thank you. Thank you. All right, we've got four or five minutes left. More like, yeah, four, four. I think we probably do one or two more questions and then I've got one for you. A closer or one more? Same one for last, no, it's not necessarily a closer but I'd like to get one in. Okay, okay, now let's go there and then there as the last two. Hey, Matt.  So my new question is what is 6.0 gonna be focused on? Well, I guess if we get back on our three releases a year 6.0 comes out in, yeah, like 2021, 2022. So 2021, hmm, I don't know, to be honest, my hope is that 6.0, Gutenberg lining up at 5.0 is a little bit of an accident. Like it's, and it's a little bit frustrating. Like if it were 5.1 or 5.3, like that would be a little easier in terms of getting things out beforehand. As you know, we're putting some enhancements in 4.9 just to kind of close the gap between when Gutenberg's ready and this 5.0 number. But, you know, the changes that'll come in 5.1, 5.2 are gonna be just as significant as Gutenberg because we'll be moving outside of just the editor and the page, page and post editing to really allow people to customize their entire site using Gutenberg blocks. We're gonna take things that have been in WordPress for 12, 13 years, like widgets and eliminate them, menus. These are all gonna flatten and all be different types of blocks that you can use anywhere in a post page or throughout the site layout. I consider this as significant as the original introduction of themes, which came in WordPress 1.5, I think. You know, the idea that there's now a new way to build and design something, that people are gonna bring that creativity to changing. When you can move around everything on the page, that's a different way of building a theme and I'm really curious what kind of creativity and approach people are gonna bring to it. So, I would say that the release is to watch out for 5.1, 5.2 and 5.3 because they're gonna be just as significant as 5.0 for what's coming. It's the next phases of Gutenberg. Hello, I'm Morton. So, the latest version of WordPress rolled out the GDPR compliance features. I thought we were gonna make it the whole time. Which... Which, just the team that worked on this should get all the applause they can get for actually getting that rolled out. I think you might know where this is headed. So, we as a community had to make WordPress work with this new legislation. And it's one of many legislations that are happening around the world. We were not part of that conversation. Yesterday there were meetings at Downing Street that had people in it that were representatives of people in the web community but we were not represented. There are meetings in Washington, there's meetings in Germany, there are meetings in France, there are meetings everywhere where we, 30% of the web, were not represented in any way. Now, we had a conversation about this six months ago and I asked how do we make a structure to communicate our intent to the people who make decisions and you said, just do it. Can I have a different, more structured answer I was prepared for this and I've been informed by my legal counsel and lawyers that I need you to accept this cookie before I can answer this question. Okay, now that you've accepted the cookie, we can get on. I knew Judy Farrell was gonna come up. I would say it's not entirely fair to say that we're not represented at all. What I, folks that advocate for the open web and for WordPress are in some of these meetings and they are meeting with folks from Brussels, with folks in D.C., all over the world and doing the best to make the case for the open web. What I will agree should be happening more is some documentation of that. However, that can be difficult because sometimes these are closed door meetings. Sometimes they're kind of off, it's kind of background meetings where legislators are saying, hey, what do you think of, we're considering X, Y, Z or X, Y, Z is gonna happen. So, do know that there is some work happening. In terms of official WordPress representation at these things, I don't have that much of a better answer for you. To be honest, I've been focused really hard on Gutenberg and I have had the luxury of almost completely ignoring everything with the letters G, D, P and R and N. So, I apologize, I know that's not the most popular answer in Europe. Let me know what happened, what you tried in the past six months, meet up afterwards and what didn't work, why it hasn't happened over the last six months. There's sort of a, I think even more powerful than having people at the meetings is having a policy that's published on our website that we say what we actually want. I think that's the hard part. I mean, part of why we don't have the person at the meeting is because I don't know what the WordPress community wants that person to represent. And so, let's work on the policy and then either that can affect us, impact it without there being a meeting or we can have someone that goes and, you know, wears a WordPress shirt and yells about the open web of these things. Cool, thank you very much. I'll allow it. Hope you enjoy the cookie. I knew I should let Morton go last because that was epic. But let me squeeze one last one in. We'll close with the Gutenberg question. I was curious, because you talked about getting feedback from agencies, from teachers and having us be a part of that area of process, getting actual use cases into this process to make sure we're not missing anything, there's nothing else to be done. I'm wondering if you have in mind some kind of a formalized process around that besides just raising tickets, conversations, meetings, a web form, I don't know, something. We have some testing plans, right? Maybe you passed our mic to Tammy. This is Tammy Lister. You want to introduce yourself real quick? Hi. Stand up. So at the moment we have a feedback form and we will, as we get more people that we want to kind of get feedback for, we can expand that to have lots of multiple different ways that you can give feedback. At the moment we have the support forums, we also have Slack, we also have the feedback form, but then we can kind of expand that. So there will be ways and there will be obvious ways that you can get feedback. What's probably the best place for people to go to see that, like make slash Gutenberg, make editor? So yeah, we've just changed the, what was flow to core test channel so that we're gonna try and rejuvenate that channel a lot. So core test is probably the best place to go for that, but there is the feedback form also if you have the Gutenberg plug-in today. And how about this is like a request. Do you think since we're entering this phase now at .org slash Gutenberg, we could put a little link to that for people who want to do testing? Absolutely. Awesome. That'll be awesome. So we'll have like a little feedback form and a link to this Slack channel right there. And you will be interacting with real live Gutenberg developers and designers and contributors and everything, seeing things get made. Well, that's all the time we have. I really, really appreciate it. Thank you. Serbia, thank you Belgrade. Thank you Europe. Thanks Matt. We love it. We love it.