Thank you everybody for choosing to come to our session to close out your CF Summit 2018. You really appreciate it. I'm Angela Chen. I'm a software engineer at Pivotal and with me is Usha Ramachandran who is a product manager at Pivotal and today we'll be talking to you about CF networking, policy, service discovery and beyond. So before we begin, hopefully you've seen this because otherwise that probably means you haven't attended any sessions yet but in case you need another reminder where to go in case of a fire, here it is. And with that we'll get to the agenda. So first we're going to talk about container networking challenges we've faced in the past, sort of what container networking is and problems that we've more recently faced before introducing polyglot service discovery which is the latest epic of work that we've implemented. We'll do an architecture overview into how we've actually implemented this feature before doing a demo. We'll then talk about advanced features for service discovery, sort of what's next, before talking about other enhancements we've done in addition to polyglot service discovery. But before we get to any of these items, we just want to give a quick shout out to everybody on our team because without them we wouldn't be able to present any of the work that we're presenting on today except jokes on me because I'm no longer on the team. So I probably should call that out as well and that's why I have to wear this hat to try and claim some street cred. And with that we'll get started and Ushua will take it away. Thanks Angela. Seriously thank you all for staying back. We were just talking that this is the last session who's even going to be here so it's great to see a sizable audience here. So most of what we're going to cover here, at least in the beginning of the presentation, shouldn't be new to anyone. It's just a recap of some of the challenges that we faced with networking on Cloud Foundry and how we tackle them so far. So just to kind of set the foundation for what we're going to be talking about. So typical Cloud Foundry networking used to have every single app go through the go router if it wanted to talk to another app. And this is not only inefficient in that you have this additional hop to go all the way out of your PCF foundation all the way to your load balancer but it also poses a problem in terms of applying security policies in case you wanted to protect app B from other apps trying to access it. So those were two of the challenges that we initially faced with Cloud Foundry networking and we wanted an ideal state where apps could talk directly to each other. You could identify the source of app traffic so app B would know that app A is talking to it and you could also configure policies so that you knew exactly which apps were talking to each other. So hopefully none of this is new to anyone because we've had this for about a year now. CF networking release has been out since last year in August and what we did there is basically kept the existing use cases. So if you have ASGs, if you have traffic coming through the router, if you have traffic going out to services none of that changes. ASGs for those of you who are not familiar with them are application security groups which are ways to configure policy for traffic going from CF apps to external things. What we did do is actually embrace CNI which is the container networking interface which is a standard and what that enables us to do is allow third parties to come in and plug into Cloud Foundry. So an example of that is the recently released NSXT integration with Vividel Cloud Foundry that leverages this CNI plugability. The batteries included version of CNI though is a plugin called Silk hence the spider web on the hat and what we did with Silk was basically to put all containers on an overlay network which runs VXLAN and give every single container its own IP. The next thing we did was add policy. So you now have app-to-app dynamic policy. We have currently support through the CLI and the API to configure this policy but we have heard feedback from you all that it would be a lot better if this policy was in the app manifest. By a show of hands how many of you think that having policy in the app manifest is something that you all would like to see? Awesome. Thank you. The other aspect of policy is that it is self-service so you could as a space developer you can configure policies for your own apps only if your operator allows it though. So that was last year's news. When we spoke at CF Summit in Basel we had this slide about a track of work that we were going to take on and the question we asked then was container-to-container networking is great but if I have to bring my own service discovery then is it a burden on app developers and so typically for any application you need to know what to connect to and what port it's listening on and things like that and so we classified this into two different types of applications so microservice apps that need like some sort of load balancing and just connecting to any arbitrary backend and clustering apps that are more peer-to-peer apps and I'll talk about them a little bit further down but the basic problem that we set out to solve was that today or at that point users had to bring their own service discovery there was no service discovery for C2C on the platform. So we're really excited to have support now for polyglot service discovery on the platform. We have a new release called CFApp SD release and what this release does is it basically uses Bosch DNS under the hood and you can use Bosch DNS to look up the DNS name for your destination app. We also created a new domain so the app start internal domain is a hard-coded domain that is created by Cloud Controller once you have enabled this ops file and this can then be used by app developers to map routes to it. So as an app developer when you go in and you can configure a map route from for your app to this domain it automatically classifies that route as an internal route so this may be like brand new terminology for you also we call routes going through the router an external route and routes that use direct container to container communication as internal routes so any route that is mapped to the app start internal domain is going to be an internal route and when you do a look up for this route you basically get the actual container IP for that container that you're trying to connect to so on the container network and as I was going to do a demo showing you exactly how this works let's just go through a couple of use cases for these so let's take the first use case which is the most common use case that we see which is for secure microservices so you can have your front end microservice that actually has an external route but then everything else is basically an internal route that has c2c policy controlling what can talk to what and it's that traffic never leaves your foundation it basically stays within cloud foundry so that's what that looks like the second use case that we wanted to tackle was that similar to how developers are used to the current map route command which can map multiple applications to the same route we also wanted to provide that same experience for internal routes as well and so you can map a new version of your app to the same route validate that it works and then take the take the old app out of commission right so this is a very typical workflow for blue-green deploys on the platform today the third use case and this is one that we're eager to hear from the community if you have these use cases is for clustering apps so if you have apps that need peer-to-peer communication or apps that use TCP and UDP in order to communicate between each other and need to access individual instances you can use the index based routes so every app in addition to get getting that overall load balance route also gets a zero dot or a one dot route for each instance so these are typically apps like aka clusters or lang clusters or other types of peer-to-peer applications so those were just some high level use cases and a high level overview of how the how we envision service discovery to work Angela is going to walk us through a deep dive on the architecture and then show us a demo great thanks Usha so we'll do a deep dive into what changes were necessary to have service discovery be a part of the CF platform by looking at the use case of pushing a brand new application with an internal route map to it so a lot of this may seem familiar to you but we'll point out parts where we've introduced new functionality and we'll also highlight new components in green whereas existing components are in blue so let's consider the case you push an app with an internal route and this information is passed to Cappy Cappy passes the information not only about the application that you want to be created but also the internal route to Diego over a desired long running process Diego then decides where to schedule your application and communicates with the rep on that Diego cell in order to have the application actually created and the rep of course communicates back that we have this application created with the actual long running process that has information about the container IP that was assigned by container networking at this point we haven't touched the internal route yet so previously existing on every single Diego cell was a round emitter for external routes so routes to that would be sent to the go router or the TCP router and the route emitter previously would query the VBS for desired LRPs and actual LRPs to get information about host name and the cell IP and high number port and do a mapping of the two we've modified the route emitter to now also do the additional work of getting internal route information so the internal host name and mapping that instead of to sell IP to container IP the route emitter will now emit this internal route information to NATS which is a message bus on a different NATS message body so this way we keep the existing functionality for the go router and TCP router only know about external routes because they're listening for a specific message header whereas internal routes are being emitted on a specific internal routes NATS message and we've introduced a new component called the service discovery controller which subscribes to NATS listening on that message header so it's only getting information about internal routes and doesn't know anything about external routes for either the go router or TCP router so then when you have an app that wants to communicate with another application on the platform the app will ask to connect to let's say app a dot apps dot internal this request will be resolved by Bosch DNS because you're trying to reach something with an app's dot internal domain Bosch DNS has now been configured to know to call out to the Bosch DNS adapter which is a new component that runs on every single Diego cell the Bosch DNS adapter acts as a conduit between Bosch DNS and the service discovery controller so it takes the information provided by Bosch DNA Bosch DNS namely the host name and calls out to the service discovery controller to get back the correct container IP and it does so using the Envoy v1 API the reasoning for this we'll get to a little bit later in the presentation as Usha looks at what's next for us in terms of advanced service discovery features and then of course after the service discovery controller passes back the container IP this gets propagated back until the app will then try to connect to this destination with said IP it's important to note here that the application will still only be able to successfully connect to the destination app if policy has been configured as well so we're not equating discoverability to being able to successfully connect and so that's something that we're still abiding by our previous contract that you need to create policy in order to have apps be able to talk to one another so now that we've done sort of a little bit of a deep dive let's do a quick demo so how do I get to the other so yeah I'm so bad at anything okay cool okay so for the sake of time we've already set up a CF Oregon space that has three apps on it we have a front end and two back ends if we look here we see that the front end has an external route front end you shan't go see to see cf app.com whereas back in A and back in B both have only internal routes so routes with apps.internal again so back in A and back in B which both serve different pictures of cats aren't publicly accessible and so in addition if we look at CF network policies to see the policies that are listed we see that the front end has been set to be able to communicate with back in A but there is no policy for the front end to talk to back in B so if we if we go back and we go to the front end which is the wrong thing and we this is so bad I'm so bad with all of this yeah so the front end basically is just a way to access the back end so you can type in the back end HTTP URL and see whether and see whether or not you're able to connect so in the case if we want to type in back in A.apps.internal on port 2007 we see that we get a picture of a cat because we've configured a policy however if we try to connect to back in B we'll see that we have no idea what we're doing because we have been configured a policy and the connection has been refused so if we go back to the terminal and we add a network policy between the front end and back in B on port 2007 if we try to refresh we get a different picture of a cat because it's a different back end but that's not all so hold on to your clapping for just one second if we look back again we see that both back in A and back in B in addition to being mapped to their own specific internal route have both also been mapped to back end.apps.internal so if we go back to the front end and we say back end.apps.internal we'll see that as we refresh we get some basic load balancing between the two of course it doesn't always go but yeah and now you can clap and so this this shows sort of just the basics of service discovery and what you can do with it on the platform now. Thanks Angela that's the best three-point story ever the cats and dogs demo. Now that you've seen the basic service discovery in action let's move on to what's next for us. Similar to what we spoke about in Basil we were really trying to see like what are some of the things that folks are expecting for C2C to work and now that we have basic service discovery some of the questions we're getting is what about retries what about load balancing what about different types of load balancing algorithms what about mutual TLS and many different things that app developers have come to rely on for their client side libraries to provide so what we're finding now is that we need to provide these these kinds of advanced features on the platform and due to that we are moving towards supporting a service mesh so the basic idea here is that for all these common client side capabilities that you would otherwise have to bring a language specific library into your environment a side car that's that's basically attached to every container would transparently just provide these capabilities so things like you know automatically doing retries or health checks being able to do more like weighted routing many different types of capabilities so as part of that like the side cars are all managed by a control plane so that's just a high level overview of what a service mesh could provide to you and I'm going to get into next the service mesh that we're integrating with how many of you here are familiar with the Istio okay about half the room so that's awesome so we only we're not going to go into the details of the Istio architecture here but we Cloud Foundry is integrating with Istio both both on the routing control plane as well as for the east-west control plane and the container networking team is working on adding some of the east-west capabilities using Envoy in the data path and being controlled by pilots so if you remember the architecture diagram that Angela shared with you all we had this plan when we started writing polyglot service discovery which is why we chose to use the Envoy APIs to talk with our service discovery controller so the basic idea here is that we would use Istio Pilot as the control plane that would basically set up all the policy for connecting your apps to each other of course this is an iterative process so we'll start with providing some simple additions like adding things like health checks and retries which seem to be pretty much table stakes if you all have any features that you know are must have for for you all then please feel free to reach out to us and let us know so that we you know what to prioritize so that's kind of where we're heading it's still early days we will be setting out a feature proposal pretty soon at the moment our team is working on trying to understand more about this and also fleshing out a feature proposal but this is just just a schematic of what this might look like and the components that you see are basically the same on the cell there's an Envoy now in every app container and and the difference is that the control plane is now going to be pilot instead of the service discovery controller as I mentioned this is all stuff that we are currently working on so it is subject to change and hopefully at the next summit we can you know stand up here again and and you know give you a little more fleshed out version of this cool so I'm going to hand it back to Angela to talk about the other enhancements that we made great so as this talk promised we've talked about policy talked about service discovery let's talk about beyond other things we've worked on since the last time we spoke to you that have improved CF networking on the platform so the first thing that we want to highlight is the creation of a new release called silk release so if you've looked at either our github or been to any of our presentations in the past this diagram may be familiar with you it's pretty big don't get stuck in the weeds what I really want you to focus on here are the colors so everything in blue are components that we don't know we don't really care about for the topic of silk release everything in green here are the core components of CF networking release so things that should always be in your CF deployment and the components in red are the swappable bits so as Usha mentioned before we abide by the container networking interface which allows you to swap out the red components for another CNI solution such as flannel calico so on and so forth and so we've decided in order to better support third party integrations to split CF networking release into two parts CF networking release now contains only the green core components that any third party plugin would need to integrate with whereas silk release is now all of the red components here everything that's swappable this shouldn't make an impact to the operator we're updating CF deployment accordingly and so the chain the operator and app dev shouldn't see any changes this is really to support our third party friends out there the second thing that we've worked on is supporting multiple interfaces so in the past we assumed that all container to container networking traffic should go over the default interface which is usually eth0 in this case however we heard use cases come in that you could have scenarios where you have multiple interfaces so in addition to an eth0 let's say you have another interface eth1 and people wanted the ability to choose which interface their container networking traffic would actually go over rather than having us pick the default interface additionally operators wanted to be able to choose if they had multiple interfaces which interfaces had application security groups applied to them and so we've now introduced support for operators to do exactly that by either specifying a Bosch network name or the specific interface name so that this scenario is now enabled that you can have container to container networking traffic go over eth1 instead of the default interface of eth0 in this case and the last thing that our team is working on and continues to work on is cni chaining support so again cni the container networking interface recently added support to be able to chain your cni plugins so let's say you have a main plugin that sets up all of your networking for your container and then you have a secondary plugin that you want to provide some additional feature like let's say bandwidth shaping for your networking traffic in that case you may want to chain your plugins instead of adding bandwidth shaping into your existing main plugin so if we look at this sort of layer plugin cake diagram we see here that in terms of container creation and networking Diego will call it to garden run c garden run c calls out to the garden external networker and the garden external networker the core component that we own will then call out using the cni api to our cf wrapper cni plugin and that again calls out over the cni api to the silk cni plugin so there's many layers in this picture but by adding cni chaining support you can now envision a world where we have silk cni plugin return the result to the cf wrapper cni plugin cf wrapper cni plugin returns the result to the garden external networker and the garden external networker then passes that result to an additional plugin so let's say again a plugin that deals with bandwidth shaping that can then just implement that little feature and so that's reusable and doesn't have to be added to every single cni plugin out there you could even imagine a world although no promises here where instead of having the cf wrapper cni plugin call out to the silk cni plugin these plugins could be chained at the garden external networker layer as well so really taking advantage of new features in the cni specification and with that those are just a couple of the additional things that we've been working on beyond just polyglot service discovery and I'll let Usha wrap us up thanks thanks Angela so just a quick recap of what we discussed today we do have polyglot service discovery out there and we're really looking for feedback so give it a try and let us know what you think it is running on pws right now and it looks great so far and we'll be promoting this to being generally available once once we see it running for some time we also spoke about today splitting up cf networking release into the core and swappable parts we will be cutting a cf networking release to auto pretty soon to make that clear that there are some manifest properties that are no longer going to be present we also added support for multiple interfaces for some cf operators and then finally there's a lot of exciting stuff to look forward to as we start to add some more advanced client side features to polyglot service discovery I'm going to leave you with some links so we have a feature narrative we also have a blog post detailing a lot of what we covered here and then the demo that Angela shared there's a GitHub page that you know you can feel free to take a look at it write your own demos and let us know what you think about it we would love it if you stop by container networking on cloud primary slack let us know what you think if you have questions comments anything but thank you all I think we might have maybe two minutes for questions if anyone has questions if not thank you all for staying for this last session so the question was could you reuse the same plugin or I guess the question is could is the question should you can you use the silk cni plugin for cfcr or can you share the same plugin yeah so the question was first can cfcr use silk as a cni plugin and the second question was could you have silk running in both cf and cfcr sort of as a shared networking experience so for the first question you could theoretically use silk cni plugin as the cni plugin for cfcr we actually about a year ago on the team at the time played around with it got it working with a few couple tweaks so that's definitely an option in terms of if you could have the same sort of shared networking across cloud foundry and I guess cfcr they would need to share a common they would need to share a common control plane component which I think isn't easily set up at this time yeah I think so the answer to your question is yes it's possible but it does need some work to get it done any other questions so the multiple interfaces support was added for a very specific open source community member who who typically runs their networks with a multiple interfaces so one is a management interface and one is sort of the data interface and so they wanted us to support that use case so that's the typical use case to run it if you have an environment where things are kind of segregated in that manner yeah so typically your vm interface for management would go to a different physical nick and your vm interface for data would go to a different physical nick so so the thing that we added support for was was simply choosing which interface to use and we rely on the Bosch network's support for actually configuring the interface so our our kind of involvement with that ends at the Bosch network layer were there other questions yes yes they should be uploaded to this sketch they will be soon yeah that is correct they're they're erect so the question was for Bosch DNS are you all just publishing a records the question was would we do SRV records with ports as well we did consider SRV records but we we we did not choose to go that route because not all clients support them yes we do plan to support ports but we'll support them by through the use of the service mesh so as we start leveraging Istio and pilot we'll start exposing ports through that the other questions I think we're done thanks again guys


Alright guys today we got this a large 12 inch heart piece. I'm gonna create something really awesome on here and spin it It's gonna look great. So let's get into it All right first color is gonna be navy blue. I'm telling you this is a little different and It could look really really cool. So just wait just wait. All right, there it is now. Let's spin it here. We go baby Ready ready ready ready? Here's the results. Oh Yeah, let's go, baby That that's pretty dope. I like that


My phone's dying. It's on 3%. I'm plugging in, but it's going to be a lot of hum and noise. So turn your stuff down. Motion detected at the front door. Okay. My charge is good. Yeah. Yeah. 75% still charging. 75%. So it should be good to go. Just me guys. I'm going to try to plug this in for a few minutes. Hopefully it won't start making that weird noise. I don't know. I'm going to unplug my phone. Okay guys. So well thanks for, thank everyone for joining me tonight. I know it was a long stream, but just wanted to get some wildlife and I didn't know all this was going to happen. Still interesting. At least we saw a couple pausing. Weather permitting. I'll put it out again tomorrow night and we'll see what happens. So I know it was interesting. You got a bear. We caught a bear. Shea bear. But like the loud bangs, that doesn't make sense. We couldn't hear him like in the house and that was close enough. We could hear it, but we didn't and there's a 10 second delay. So like what I'm saying right now, you guys won't hear until 10 seconds from now. So we didn't hear it only through the live stream. That's real weird because it was close because there are bedroom windows right over there. That's our bedroom window. So we should have heard it and we didn't. We should have heard it and then about 10 seconds later heard it through the live stream and we only heard it through the live stream. That's weird because we never hear bangs out here. Once in a while, if the neighbor over there, if he's up, he might make a little noise and we can hear him and he's a little shed back there and that's, I don't get it. That's behind our shed and this was close and the only thing that's metal out here, her tracker is not metal. My tracker is metal and the shed's metal. Nothing seems to be out of place or a mess. So tomorrow night maybe we'll just we'll see what we can hear and see. When I just came out, I heard something over there and then weeds and something back there. So the coons might have been getting ready to come out, but my battery is on 14%. I don't like to plug it in because every once in a while it'll start that buzzing noise. I don't know why it does that, but so anyway guys, there you go. Thanks for joining me. Appreciate it, everyone. Hope you enjoy the rest of your night. Have a good day tomorrow and we'll see you soon. So yeah, yeah, it wasn't, it wasn't happy. So I don't, I don't know. So shea bear has met the main legend gone for now. Nobody's not here. Okay, no night guys. Again, thanks for joining me. Appreciate it and weather permitting. I'll be having this set out here again tomorrow. So we'll see you guys later. Bye bye and take care.


Welcome, everybody, to the next talk. We're going to be continuing on in the education theme and talking, Cass is going to be talking about lessons learned in education during the COVID craziness. So take it away. Thank you so much. Hey, everyone. So my name is Cass Wilkinson-Soldania. I'm a data science educator at the Children's Hospital of Philadelphia. I use they, them pronouns. And I'm really excited to talk to you today about kind of data learning strategy in complex institutions like many of us work in. And you also hear some specific call outs and also thematic rips from other things that we've heard over the course of the last two days. So this is me. Hi, and this is my cat, Jane, just looking cute. So by training, I am a data librarian and I'm also a mixed methods researcher. So my work kind of blurs together the world's social science, data science, and education. I work with learners who find their way to data science. And sometimes their path to data science is very clear. It's very enthusiastic. Maybe they have their time marked off to work towards this goal. They might have a background to something similar to data science. But honestly, for the vast majority of us, we kind of come into data science maybe a little bit sideways, maybe tentatively. We might wander in a little skeptically or nervously. Maybe we follow a trusted friend or colleague into a particular set of methods. But at some point, we make this hop and we let ourselves be vulnerable. So here at CHOP, I work at the Children's Hospital of Philadelphia, we call it CHOP. I work with this wonderful, diverse group of research data managers, clinicians, analysts, engineers, people who would like to deepen their toolbox of data and open science. And so our program is called ARCIS. And it's part of the Department of Biomedical and Health Informatics. It's an initiative to, as you says here, link clinical and research data to accelerate science. So we're educators, this unit within ARCIS. And our goal is to really support training, guidance, resources around data. And our mandate is this idea almost of culture change, of really trying to help people share their data and feel comfortable. And I really identified earlier what we heard about this idea of the goal of sharing and how that can play out in institutions where there might be interest, but some kind of cultural, logistic, privacy resistance to that. So that's kind of a bit of what we do. And so while we do certainly work with folks who are deep into their machine learning practice and journeys, a lot of times we're working with people who are making some type of hop. I would argue that all of us are making some kind of hop into either the first or the next step in data learning. So for folks who have made it here to this ARC conference, whenever you're watching this, you've likely begun to see that when you have an experience like this, with code like this, it's difficult. It's, of course, but this is also the context where we sort of have learned that this is when we reach out to people. And in fact, whether it's a Google search or a form post or a Slack or talking to somebody in person, these are actually some of the moments where I would argue that we feel the most connected as communities is when we kind of can reach out and say, hey, I have this question. I have this approach. So we're very practiced in dealing with this kind of moment. But for newcomers, this can be very deflating. So I think it's always important to come back to and remember, even now, I like this. This is just flight out console output. Or rather, this is from our console. You can see the output, and you can kind of feel it, right? Still those error messages. And we also are folks who, when we hear that new method, it just gets us excited, right? So I was really excited earlier when we heard about Tranley's tree heater package. My media thought was, oh, I was stuck for so long on this one part of a product in grad school. This would have been perfect. So my mental model was like, oh, interpretable machine learning visualized in a way that you can explain and tease out. Like this fits right into that. But again, for folks without that mental model, it might be harder to integrate some of this information. So as an educator, my task is often to help people, basically, get to the point where they can bridge some of these moments of not knowing and feeling vulnerable to some kind of actual community building around that. So this is myself, when I was working on using the learner package for a project with my colleagues here. And I needed to find a way to test code that could run in both Python and R, where it would run in both, but the result would be different. I knew. I had the strategic cheat sheet of being an educator, of course, but I knew that this was the perfect time to reach out to the Slack community, which I'll talk about in a moment, and get some great, you know, this was a really fun way to reach out. I loved, I think I got to know Paul a little better through this and other folks here at CHOP. And that was a really nice thing. So I'm going to really focus from the rest of my time here on these two questions. So how do we help a learner's leap into data science lead to persistence and belonging? And then also, how do we sustain learning growth in careers? And I'm specific about those things, not just learning, but learning growth in careers within complex institutions. So I'm going to kind of give you some reflections from our experience. And hopefully, it might give you some new ways to think about some of these concepts that probably are important to you in different ways. So one is communities of practice, which we hear about a lot, and is very important. And I will, for a moment, bring us back. I wrote this, and I was like, oh no, bringing us back to February 2020 is kind of tragic, right? That missing in-person instruction is hard. But so this was part of our mode over the winter, kind of a sense of what it meant to be doing data education, data learning within our particular part of the universe of data work of research. So our little ecosystem at CHOP is basically this kind of overlapping communities of practice. And so this was part of ARCIS data education. One of the things that I have done is sort of develop and lead workshops. Like this is a machine learning workshop that will be lighting collaboration with this great group called MetaChop that is kind of cross-institutional. And some of the things that I will draw attention to here is being able to get people together in a room. I love the technique of having small groups. So I think that in Stephens 101, in the 101 session we had on Thursday, there was a similar concept of small affinity groups. I think that kind of thing is really important. I also love giving people coffee and food. So that's something we did here. But this is one modality that we had. And when we work, we also find ways to cross remote and work within other groups. So you see here some of my Slack notifications around my department, DBHI, and then also the CHOPR and the Python user groups. These are amazing, really wonderful groups. A lot of folks here are parts of those groups you've heard from from CHOP. And so they're really gathering points in a context where people can focus intensively on a language and learn kind of what other folks are doing within the hospital with those languages. So this is, you probably are familiar with these different, having a very full Slack slate, right? It's a really wonderful thing. And to give you a sense of what the world looked like in the winter, our cadence was there would probably be maybe about one or two bigger events a month that are in person and then some regular series using R, using statistics. So that was kind of the cadence across these different groups. And so I wanna just draw your attention to when we're talking about communities of practice. So from the literature, there's teaching tech together is a great book by one of the founders of the Carpentries. I really recommend taking a look at. And so to use practice are people bound together by interests and an activity such as knitting or particle physics. And one really key piece here that I think I always wanna highlight is this idea of legitimate peripheral participation. So this is this idea that you can be part of this community, can become part of this community, not just by sprinting in and being like, ah, yes, I too can do exactly what this person up here is doing, I am the same. Because honestly that can be very difficult and demotivating. Instead, these communities tend to work really well when they can help people who are maybe tentatively walking into this space meaningfully participate.  And I think that this is a really helpful reminder for how it feels when we're new to these communities that we really love and care about is that giving people about to meaningfully participate. The other piece is something that I really appreciate from the Arcus Education team, kind of the mission statement, we really focused in on this model of learner instructor. And so from a mission statement, we try to focus on creating opportunities for community members to develop as learner instructors who learn, teach, coach and mentor their colleagues and community. So we understand that pretty much all of us have experience with being the learner and being the instructor. And we kind of rejected the idea that there should be any divides at all. This is another way that we kind of think in about, you know, we have these extant communities, these different communities of practice, but just as we wanna make sure that newcomers can come and not feel like this is cool, but this isn't me, at the same time, we can kind of grow and think about our communities as being spaces where everyone, no matter where you're at, can lead and teach others. Everyone has something to share. So that's an important kind of idea for us. And so of course, the next half of this, I'll talk a bit about what it was like, you know, once COVID had hit.  So a lot of the research institutes went remote. You know, there's a lot of distinction.  Now this created a really important impact where people were basically, who might have had projects on site or research that was not essential, but very important, were basically sidelined for a while because they couldn't get into their physical resources or experiments. And so there was a real surge of people who were all of a sudden in this kind of precarious position of not really knowing how to spend this time. And so our fearless leader, who you'll hear from next, Joy Payton, had the great idea to raise her hand and be like, well, why don't we, why don't we do some education? Why don't we hold this webinar series? We'll call it lab down skill up. So we'll basically create a rapid, wide-scale data science training program. And let's just start it in, I can't remember if it was one day or two days later. And so we basically agreed to teach three webinars a day. And this is what our spring and summer looked like. It was wild. We taught over 130 sessions. And when I say we taught, I actually mean going back to the learner instructors that we facilitated, you know, this process where 31 of our, ourselves and our colleagues, largely technical folks who may or may not have had backgrounds as educators, were the ones up there leading these sessions. And we also really committed to this regular cadence. You can see about halfway through, we really, we took a break for a couple of weeks and slowed down and we went a little bit more reasonably Monday to Thursday, two times a day. But we also, you know, we noticed that people were indeed coming a lot and coming back because there was this element of familiarity and structure and this personal element that people really connected to. So we were doing stuff. And I think that the critical moment came for us a couple of weeks then when people were coming and having this seemingly positive experience. And also we realized this is a huge opportunity to understand what people are going through now, but in general, what is the state of data learning and data needs at our institution? Like how do we go from this massive activity to learning about what it's like to learn here? So we said, let's slow down, take a couple of weeks and let's ask people, you know, let's conduct some research. So, and this is kind of what one unit looked like. Jake Riley was leading a session here on intermediate data visualization. We created content that we can use later. And these are some of the statistics about, you know, attending and I will just keep going and talk a little bit about evaluation for the remainder here. So the key pieces here, we use mixed methods research. We were able, I'm realizing I want to make sure to have time for everything. So we basically had surveys, we had user interviews. We ended up looking at who was there and we noticed that it wasn't just data analysts or it wasn't just, you know, one role. It was actually this really interesting mix of people who had already identified that they had basically data in their role. They were analysts. So also people who were sitting as managers, as coordinators, as administrators. So we were reaching people who, we didn't necessarily have the PIs in the room. We had a lot of people who were starting their careers at CHOP or figuring out how they fit into things and that became really, really important. So as we looked at this, we learned that people really responded to the welcoming atmosphere here. So this was really something people, more than anything else, they responded to the instructors as people up there, you know. And that was really neat to see that people wanted this sort of experience. They want, there was this emotional element that was really important at the time. We also learned that people really wanted more guidance and sequencing, which was a very key actionable insight. When we think about kind of tactics, we realized that we needed to give more description, more context so people could move through this. So we had this emotional element in terms of being a reliable community space, but we also wanted to make sure to structure the content so it was accessible. So these are things we're learning from surveys. But maybe one of the newer things that we realized was that the social context here was absolutely key because what was happening was that people were not just taking information as end users but trying to figure out within their units, within their part of this institution, kind of what it meant to learn and grow. And so we had people, and it wasn't always the same answer. You know, we had folks from program managers talking about the need to create trainings for groups of people. It wasn't enough just to assume people had the buddy, right? So we couldn't just assume that people already just know a person. We need to be explicit about creating these opportunities. But then we also had folks who were ready to go, perhaps interested in joining these bigger groups like some of the user groups, and they knew that these were positive experiences, but they were just intimidated by that and they felt much more comfortable by having that buddy. So if you have the buddy, it's great, but if you don't have the buddy, what do you do? How do you make this all work? We also found out that a lot of people really needed to convince their supervisors of value. And so I love this idea here, which is that somebody in an interview said that, the boss said that if I had the magic button, that would be great. And so I made the magic button. So in this case, something like dashboard reporting was key to convincing the value here of what's going on. So what I wanna just leave you with here is this idea that when we think about communities of practice, where you think about this actually goes really well with the NSR idea of going from the flat communities and non-hierarchical to actually understanding the hierarchies or I'll even just say the networks across communities. Because when we think about supporting people, we might wanna also imagine the idea of a network. And this kind of sets our future research agenda. This is something we're working towards. Is that we want to think about how it's influence plays out within a network. So this is a network visualization with nodes that are connected here.  This is something from Washington University. But we can also think here about, if we wanna grow communities, how are those communities actually structured? You know, it was a network graph, a useful metaphor here. So we think about how to support people, how to help them step up and how to create materials so that for like the nodes within the network, so that we can actually help people get protected time. We can help people who don't know the person reach out to you and especially the folks who might not, you know, share some of the same normative identities, the same access, the same power within an institution. You know, folks who are coming into a research context and they're ready to learn, but they just don't have that access yet. We can help create that by being strategic about what we learn about communities. So this is really a, I would love to see more of this type of work. And I'm a mixed methods person, so I will always love the idea of the network. That's something that just calls out to me. But I think it provides a nice layer of complication because we work in really complex institutions. So how can we kind of think about going from communities here to these great opportunities like webinars and events to really advocating for people's growth and movement within these networks? So I got a little rushed there. I apologize there, but I am really excited to share this because I believe a lot in strategy. This is how I'm growing a lot personally within my work and data is finding ways to celebrate vulnerability, kind of having mental models that work for understanding influence. And then creating these meshes of communities of practice. And then finally, never forgetting about what it's like to be a newcomer and making sure that there are meaningful ways to you participate as newcomers. So those are some of the ideas. I would love to hear any questions. And here's my cat and I reunited in the end, so. So I think we've got time for one brief question. And the top one was, how do you keep people engaged when you're doing these presentations virtually? Oh, it's a wonderful question. I think going back to our instructor kind of toolkit is meaningful participation, not putting people on the spot to have to share their video necessarily. But I think, because we're all kind of fatigued, right? Except me, hi. But I think really having meaningful ways to ask people questions in the chat. I love having people predict. That's one of my favorite tools here. Being like, why might something break the kind of Socratic method? And just making sure that there's meaning that people feel really included in meaningful ways. And you can even be strategic and be like the beginning at the middle of the end. I wanna make sure to have asked enough questions that people can jump into. I love chat for that personally. Yeah. Yeah, this has been really great. Got some good ideas here to think about some of those too. And we're gonna then, I think switch to the next session. Perfect. Sorry, thank you everyone. Yeah.


hey what's up you guys welcome back to my channel if you're new here hi hello I'm Lydia and if you are new here make sure you hit the subscribe button join the growing family by aiming to reach 10k by the end of the year I know we can do it if we work together now today I'm going to be sharing my experience of abuse in psychiatric wards so go into it with that in mind if it's gonna trigger you please click off this video now I've had a lot of experiences in psychiatric wards over the last six years so the first thing I want to talk about is actually not a psychiatric ward but an A&E department AIM'd me with lorazepam and then 10 minutes later they came and injected me with haloperidol I wasn't kicking off or anything I just didn't want to stay in bed so that was the first time of being over-medicated now over-medicating is done as a way of controlling patients and just so dating them so they're easy to care for this was done to me in a more recent admission when I was on a section three at the prioring I was over-medicated then and I don't know why and it just happened so much in psychiatric ward so many people commented on my last video where I talked about abuse over-medicating people and they said they've been over-medicated too the first real bit of abuse that I experienced was restraint are you getting my set on my head thrown back on the floor by one person no alarms pulled nothing just whacked me actually took clicks behind my legs and I just went backwards and I smacked my head off the floor so when it comes to abuse in psych ward restraint is and always done properly and it does result in abuse I can safely say that has happened to me oh I can't do this so I've witnessed abuse I've been through abuse if I lean into one side so I've got a really bad migraine right now and it's literally killing me I want to make this video as a psychiatric patient I have experienced abuse that people in general hospitals don't experience now I have had my fair share of abuse in any but that's not what I'm talking about today psychiatric hospitals are there to protect people from themselves from others detained under the mental health act informal whatever it may be we don't this place of care now I've had my head slammed on the floor I've been kicked I've been sedated I've had bruises I sprained my wrist I've been through a lot a lot of it happened in my year-long admission and why I will say that admission changed my life I also want to point out that it also traumatized me in ways I can't explain so for context I was admitted on section two I was then transferred to a section three my section three was renewed I was in hospital for two years not two years I was in hospital for a year now personally I think I was in too long you have a handle use the handle and close it carefully simply this event for me was when I have three staff members grab hold of my arm and I didn't pin me down with my head three members staff doing a two-member staff job bit overkill an example of where I got assaulted in hospital was I didn't want to go any lunch but my weight was dropping to get me out of bed the support of the support worker grabbed my cup of water and threw it over me that's assault it's just the little things here and there getting pinned down then dragged back onto a wall even though you're on leave getting told I was suspended in your leave because you haven't eaten I wasn't in limited for an eating disorder I was admitted because I tried to kill myself and came very close the amount of abuse that goes on behind closed doors is unreal people getting restrained unnecessarily knows the escalation techniques used the emotional abuse I've been told oh you're never gonna get ready or revolving doorpatient yeah I was for a while 2020 2021 yeah I was a revolving doorpatient because I needed help and support that I couldn't get in the community which is why I kept getting admitted or dissection me to move area to a place I'd never lived before to be listened to now when I was admitted for the year I don't actually remember having a mental health act assessment I remember it appealed and my appeal failed if you want me to make a video on what my appeal was then let me know in the comments down below but all in all I was well and being told all your revolving doorpatient oh you're never gonna get better or you don't try you're not working hard enough on yourself all those things add up and it's it's fucking emotional abuse now I don't want people to go for the studio and think psychiatric hospitals are all bad they're not the best but in comparison to a lot around the world such as America the UK do have it better and it comes to psych wards and our psych wards aren't scary as a whole people tend to keep to themselves and awards nobody make friends I don't know now when it comes to psych wards they are unfortunately staffed by people who don't truly care there are some stuff I was that are amazing and love their job and love helping people and they're the kind of people you should work in psychiatric wards but you also get the agency staff who are there because they got phone call and they've got the staff members that are just there because they could take advantage of vulnerable people I genuinely think psych wards needs to be more selective when staffing these psychiatric units the abuse I've been from a psychiatric wards is unstable I can't go into every detail of all because I'd have to press charges against some people but honestly some staff in there are dangerous what I wish for people is that these places were safe one example of time I was abused so before my camera very really got full off thanks for that camera joy is a filming in 4k it eats up memory like it's nothing but we're talking talk about something deep now this story is quite a difficult one to talk about so I mentioned earlier about having a couple water for anything which is this is that story so I was lying in bed I called for lunch I said I'm not going staff member walks in yes you are for his quarrel for me I get up and push the staff member out my room and then I get thrown on the floor kicked on like the side I dare where they broke a room he then proceeded to shove me back and shove me and shove me and shove me so I just had my gun up off the floor in the end I just went in my room and locked the door which he had to get his keys out to get back in the room and I said leave me the fuck alone and by then of the staff had come out see what was going on he got suspended we then had a meeting where he had to clear the air so me in this room a mediator I can't remember her name and the male staff member that assaulted me I was a Lydia do you feel comfortable going back to work mean no so he was made to work on a different ward which poor fucking people I mean that's a one don't throw cops a bottle of people to don't kick them in the sided three don't shove them back it never that was right at the beginning of my year-long admission so say it made me fearful it was an statement because I'd never experienced anything like that on an NHS ward I do have two complaints against two different psych ward on the NHS that's all I've got for this video be careful wherever you end up thank you for watching and if you're new subscribe like I said at the beginning of the video thank you for watching and I'll see you guys in my next video peace


Alright, thanks ladies and gentlemen for coming again for another conference in relation to this matter. There's a number of reasons I just asked you to come back today. First up is to basically formally release the victim's name and provide you with a photograph. The victim's name is surname Luthoboro, L-U-T-H-E-R-B-O-R-R-O-W, Christian name is Colin Edgar. Colin Edgar Luthoboro, 36 years, and as I say we have a photograph here which we can provide to you afterwards and we can do that electronically if needed. The other reason for this morning is to clear up some of the understandings of what appeared to have occurred in the media overnight and just to get it on the record that the investigation to date has not found any evidence whatsoever that the victim is involved in luring underage children into prostitution or pornography. There's been no evidence whatsoever to suggest that the victim is a pedophile or that he's been involved in any sex offences. The family are quite distraught about what's been reported overnight and I reiterate that the investigation has found no evidence whatsoever to suggest this. The other reasons for the conference today is to again just ask for public assistance. The investigation will suggest that the victim is a fairly reclusive sort of person, a bit of a loner, lived at home. We would be asking, now that the photographs are available, we would be asking any member of the public who knows the victim. The victim and his mother have only lived on the Gold Coast since last August and we would be asking any member of the public who knows the victim at all had any dealings within whatsoever to contact police or crime stoppers. This will assist us in building up a bit of a picture of his background, a bit of a picture of his life and particularly since he's gone to the Gold Coast. We're also interested in hearing from any member of the public who traveled Hooker Boulevard between the Gold Coast Highway and Bermuda Street at any time between 2am and 2.30am on the morning of Wednesday the 20th of July. So that's whether or not they saw anything suspicious. Just anybody that travelled that road between those times, we'd like them to come forward to police also. Where was the victim's problem? He came, what, since before the Gold Coast? He came from down south in New South Wales. Where? In Yambani. Yes. Look, I don't think it really matters what he was talking about, it was all minor matters. He's got virtually no criminal history in Queensland and he has some minor criminal history in New South Wales going back over five hundred years. Is it sex crime and it's not even a crime in the world? There is no evidence whatsoever to suggest that he's committed any, he has committed any sexual offences. So we're now going to piece together what direction even this man is walking or where he potentially is going to come from? One of the difficulties we're having at the moment is filling in that gap from the time that he left home, which was around about the nine o'clock mark, until he was located on Hooker Boulevard. So we are looking for assistance to try to fill that gap in at this point in time. So we're not exactly sure what he did during those number of hours. Which sublet did he come from? So it was supposed to be someone that he was... Not far away. What did he do for a while? He was unemployed. Can you say it's sort of a proof? Is it unusual for him to be out on February or whatever this sort of fun moment? No, not exceptionally unusual, no. He was just a quiet sort of person. But he did get out without. Did he tell you when he left home that there was a community commotion? No. Was he on foot? He was left on foot. That was about nine o'clock? Yes. What about suggestions of an execution style film? Well that's something again that the media has brought up. There is again no evidence to suggest that this was an execution style film. That brings up all sorts of vision. Again, the media reported yesterday that he was shot three times in the back. I told you yesterday morning that was wrong. He was not shot three times in the back. When was he shot? He incurred one and shot three times. But there were multiple cases? There was more than one case located. No, no. They were bullet cartridges, ejected cartridges. Is that sort of leading to where the shooting was? Like they were being shot at the road? No, we don't believe so. But again, we're in a situation where we can't fill in his movements in those number of hours immediately prior to the incident occurring. So we're not exactly sure what occurred. We have had some information come in from the public which tends to suggest to us that he was not walking down the road. But we don't know that for sure. That's why we are still seeking any information from any member of the public who was on the road during that period between 2 a.m. and 2.30 a.m. Anybody that was on the road, whether they were driving, whether they were walking, whether they were riding bikes, or whatever. So to help us build up that picture of movement along that road. So anything to do with the motion of the road? Well, anybody that was on the road, driving along the road, walking along the road, or riding along the road, between those hours we would like to speak to. And that will just allow us to work out the positions of different people. Some people have already come forward of having been on the road. And they've told us about other cars being on the road. So we wouldn't like those people to come forward as well. Are you learning more from the fact that he may have been on the road? Well, we're not speculating on anything at the moment. We're keeping all options open at the moment. But again, we would appeal to anybody that was on Booker Boulevard between 2 a.m. and 2.30 a.m. between the Gold Coast Highway and Bermuda Street to contact the Police or Crime Stoppers. We understand it early days. Can you tell us anything about what the model has been involving or getting involved in this situation? No. You know, there are certain parts of the operational aspects that we don't want to discuss. But as I say, there is nothing at the moment that is standing out significantly. We've got a number of avenues of inquiry that we're following, but we don't have any solid leads. So again, we're considering all options. Has he robbed at all? Has probably not been watched or seen at all. No indication of that, no. But you're still, you sound like a body just around and think it sounds like he's been robbed or something like that. Well, we would hope that the investigation may determine what happened. Are you looking at suggestions like the signal that can be heard from the surface paradox of the area? We're looking at all possibilities. We're looking at all possibilities at this stage. As I say, there's a number of hours there in the lead-up to his body being located that we want to fill in. And we're quite convinced, quite confident that there's people out there who would know who may be able to provide that information to us. Equally, we believe there are people out there that just knew the victim. As I say, he's only lived here since August of last year. We want to try to build up that picture and we would ask anybody who even knows the victim to contact the police so that we can have a talk with him. There's been no connection to OMCGs come to light as a part of this investigation. Drugs. There's been nothing to suggest that drugs may have been involved in the homicide at this point in time. Do you know what? We have arbalistics people working on that but that's something that we wouldn't want to release any more. The family describes him as obviously a good bloke, a loner, a very private person. You can categorically, just to make it tripletly, categorically, any of them whatsoever for any sex violence. There is no evidence whatsoever to suggest that the victim was involved in any sexual offences that he was a pedophile or that he was involved in learning children, underage children, in pornography or prostitution. Has the crime scene been rich for you? The crime scene on this occasion is a little bit different to normal being out on the road but as normal our friends and specialists have done a thorough job and we weigh some results in that. Any use for others to use the diver? Police divers are being utilised as a matter of course to search the water livers. What's the potential weapon? It's a weapon for anything involved. Where that gun is safe? Nothing, we're just doing that as a written thing, rather to indicate that something's happening there. Correct. Where that gun is safe? No, I'm sure they'll find the water livers there. The victim does have a family, the majority of his family is in New South Wales. Yes. This doesn't seem like we've got a whole big gap. Is it happening or is it... What are the gaps? Well, as I explained, we do have a number of avenues of inquiry that we are following but we don't have any solid leads at this point. We still have a number of gaps, particularly in relation to his movements as I said, but that reason we're appealing to the public, to any member of the public, to the victim, to come forward and contact the press. Yesterday you were saying innocent goalkeepers shouldn't be concerned with the deaths that are occurring between two groups or a domestic situation. Is that changing our response? No. Well, we don't know what the situation is in relation to this incident at this time. The situation hasn't changed in relation to all the previous incidents. This one has yet to be determined. Maybe he's obviously involved in something for this to happen to him, but you can't... You've got some idea, but you can't tell us or you don't really want to tell us. We don't know what has occurred immediately prior to his death and that's why we are trying to fill in that gap from the time he left home until the time he was located. Again, I would appeal to any member of the public who even knows the victim to contact the police. It wasn't unusual. Yeah, I would appeal to any person who has enjoyed the experience. What do you stream? Suggestion is that there was an argument with the forehand and some people said that they had heard an argument for the perpetrator. Is that what you were hearing? Well, we're getting versions, obviously, from a number of people in the area and some people have come forward as was depicted on the media last night and said that they did hear the pair heard raised voices. OK. Thanks very much. The photo is current as such. We've had a bit of difficulty getting a photograph. This photograph


The U.S. decision angered Russia. The defensive nature of weapons handed over to Kiev by Washington has not been at issue long since Russian Ambassador in the U.S. Anatoly Atonov said. The decision of the U.S. administration to transfer Bradley fighting vehicles to Ukraine is a confirmation that our interlocutors in the United States have not even tried to listen to our numerous calls to take into account possible consequences of such a dangerous course by Washington, the ambassador noted, cited by the press service of the Russian diplomatic mission. It is finally becoming clear to the whole international community that in 2014 the U.S. unleashed a real proxy war against Russia by supporting Nazi criminals in Kiev. Any talk about a defensive nature of weapons supplied to Ukraine has long become absurd, the Russian diplomat said. Even more remarkably, the administration revealed the above-mentioned decision after a phone conversation between U.S. President Joe Biden and German Chancellor Olaf Scholz. Atonov stressed. The international community must not ignore the facts that Angela Merkel and François Hollande confessed the Minsk agreement served to give time to Kiev to enhance its military capabilities. In view of close ties between Washington and Berlin, it becomes clear that the West under U.S. leadership simply deceived our country and started to purposefully weaken Russia much earlier than February the 24th, 2022, he added. All the latest actions of the United States, including the decision to allocate a new military aid package for Kiev, comprising Bradley fighting vehicles, directly indicate that Washington has no desire for the political settlement in Ukraine. Atonov said. Nobody should still have doubts who bears responsibility for prolonging this conflict. All the actions by the administration indicate a lack of any desire for a political settlement, the ambassador said, cited by the diplomatic mission. Even the unilaterally declared ceasefire by the Russian Federation along the entire line of contact in Ukraine during Orthodox Christmas was labelled as an attempt to find some oxygen. All this means that Washington is committed to fighting with us. To the last Ukrainian, while the destiny of people of Ukraine means nothing to the U.S. Atonov added.


Hi there! Welcome everyone to the webinar today. I am Chintan Thakkar, the founder at company called SARS and we build the on-road ingress controller API gateway. In this talk, we'll go over how to have end-to-end encryption using the on-road ingress controller and the link-ready service mesh. So this is sort of a workshop. You can follow through it and even go through the steps while you achieve the same things that we do in this webinar. If you have questions, feel free to join the Slack channel or if you want to try out the enterprise features for the on-road controller, you can drop us a note using the form on the website. This is about me. You can also follow us on Twitter. We also have an open-source version of our software apart from a community and enterprise version to check out the open-source. You can use this address on GitHub. At the high level, we are going to talk about these cloud-native solutions. Figure out the different components involved to take a high-level view of where the solution fits. What are the different components? So at a high level, the application networking and security involves the container networking interface. These are these are softwares like Cilium or Calico or Flannel, which essentially provides the network plumbing between the ports. That's the container networking interface. Then there is how does your traffic enter the cluster. That's where the on-road controller comes in. One example of that is the on-road one step. And then we have service meshes like Linkerd and Istio which essentially help with not only traffic management but MTLS observability and a lot of operational concerns are met. So we'll quickly talk about all these things and then finally we'll go over a demo. So this is a graphical representation of the major components in Kubernetes application delivery and security. So of course you have the cluster and you have the CNI. The CNI wires of all the ports and the services performs the network plumbing and a lot of times they also do security functions like network segmentation at layer 3. Of course you have the service mesh inside the cluster which performs MTLS and traffic management and the ingress controller is essentially the piece how your traffic gets inside the cluster. So on-road one step is an ingress controller API gateway. It is built on on-wide proxy and essentially helps out with not such south traffic security and management. It's extremely simple. Typically the policy and connectivity that you want to specify for a service can be done using one step. That's the idea behind it and it's declarative so you can just declare the things you want. Execute one command and it'll provide the necessary policy and on-road one step is completely Kubernetes native. It runs as a container and it can be used to run as an ingress controller service. How is it different? It is built on on-wide proxy of course. It's again on-wide proxy the CNCF graduated project. It works for both Kubernetes and non-Kubernetes. On-road also can function as a shim outside of Kubernetes when you run it in standalone mode. Say for instance in a Docker container if you just wanted to run on-road and on-wide you get simple REST or GraphQL based APIs to configure on-road. It is purely declarative. There is no YAML involved when you are setting it up. You can just select a set of service and L7 policies. Specify those policies, run one command and it's all good to go. You can then tweak it by editing different config objects and then you know tune it more to your needs. There are three versions of course the US as the community and enterprise and you can check out the complete list of features and get on-road.io slash features. Linkerd is again a CNCF graduated project. It's a service mesh ultra light weight and it's an extremely popular service mesh which has over 200 contributors and I think if I'm not wrong over 10k stars. Why do we need a service mesh and why end to an encryption? So with microservices the surface area for attack increases to establish you know like a secure environment to run your microservices. There is the zero trust paradigm which has never trust always verify. So you essentially verify every single request coming inside your cluster and when the services stop for each other they also verify every request and the verification comes in forms of authentication and authorization. So of course you need your identity set up for each of the workloads that you can use to perform the enforcement. So the zero trust principles for traffic entering the cluster can be can be essentially done at the ingress. This is where on-road comes in and enforcing zero trust principles inside the cluster would be a component like a service mesh which performs some orth C or 10 for inter service communication or the east-west traffic. So this pictorially represents how the end-to-end encryption looks like. So of course when the traffic enters the cluster you have TLS from the user to on-road. This is the downstream leg and then once the traffic hits the ingress controller it's all encrypted as it is meshed with MTLS. This example specifically talks about linker D and on-road. So now that was just a quick overview. We'll go over a quick demo and this involves installing the linker D service mesh. We have a Kubernetes cluster. There is linker D installed on top of it. There is an example workload in form of Emoji Auto. That's an example workload and then we will mesh that example workload in the linker D mesh. So essentially insert a proxy with the workload. So and then the other aspect is we'll install on-road. We'll mesh on-road with linker D. We'll externally expose the application to the client and then we'll secure that communication using a certificate an AP certificate that will generate a sign and install in one step again. So that's a high-level introduction about on-road one step and linker D and what we'll be covering in the demo. So the demo steps are also present on the website. There is a high-level article that talks about it. So you can just navigate to the website and in the blog section you can go to end-to-end encryption using on-road and linker D and that will essentially walk you through the same things. So we have a cluster right now. So let's just quickly check that. So we have a cluster and we also have linker D installed. So that's linker D installation. So we have also connected to the Boojant cloud. Boojant is a company that created linker D. So we are also connected to the cloud just to verify the MTLS. So right now here is the connection and we can see that there's one active cluster with a couple of nodes. There's a few workloads. So we'll use this to verify our MTLS. So moving ahead, let's go ahead and install the Emoji workload. So that's the command that installs the workload. And then of course we have, I think we have these. So we have the Jetstack cert manager which we'll be using to install the ACME cert and we also have the on-road API gateway, Helm charts which we'll be using to install on-road and the service policy essentially. How to expose the service, how to secure the service. So let's just go ahead and install on-road. So here it's going to create an instance of on-road ingress controller API gateway and let's quickly look at that. So it's still getting an external IP. In the meanwhile, let's go ahead and set on-road up for running with linker D. So when you are integrating an ingress controller with linker D, there are a couple of suggested practices. One is around adding a header to provide hints to linker D. The other one is around delegating the endpoint selection for routing to linker D. So there is one flag setting in on-road which takes care of all of this and it can be further customized if you like but essentially there are a couple of requirements when you're trying to run an ingress controller with linker D and with on-road one step we have made it extremely simple where you just set one flag and everything just works. So let's just set this one global config and that's it. So that's all you need and now on-road is ready to work with linker D. Now you can take a look at this more on the website to see what are the other customizations available but essentially you've already enabled the linker D enabled setting to set up the ingress controller and if you want you can disable the header addition and the endpoint selection delegation you could disable any of these if you like but by default it's all enabled. Now we earlier created the Emoji Voto workload now we are just going to mesh it so just going back to this what we are talking about now is we got a workload setup say Emoji Voto workload now we are going to mesh it as we are going to add the linker D proxy to it and that's the command to do that so what it does is it adds an annotation to the deployment and that inserts the linker D proxy and then we do the same thing for on-road. So what we are doing here is we are injecting the linker D proxy for both the workloads the Emoji Voto workload our test workload and the on-road workload. So now let's quickly look at the cloud and how it looks right so we see that Emoji Voto is now seen by the and then here it's here we can see Emoji Voto Emoji Voto is meshed and we also see that on-road is meshed the dark circle here with our solid dot in there shows that it is meshed we can also verify this by looking at the pods I think there's a command here yeah so here what we see is we have the on-road pod which is running the on-road image and redis and of course on-way proxy but at the same time it is running the linker D proxy as well in the same pod so what it is showing is that we have successfully meshed the on-road pod so now let's quickly look at yeah we now have an external IP so what I'm going to do for this demo is create a DNS entry for this external IP and let's call it on-road linker D meshed demo and then we're just going to set it to the external IP and let's just quickly ping this and see if it is set up wait for some time to set that it's set up but in the meanwhile let's go ahead and expose this service externally so the way to do that is just use one command from the chart and what we are doing here is we are saying program the ingress in such a way that I can talk to the emoji auto service over that DNS name and we are specifying a couple of properties about the service what's the name of the service what prefix to reach it on what port the service is accessible on so let's square and run that command so so this shows me that the service the ingress is getting program and it right now installed a couple of filters which I can quickly look at if I like so that tells me that oh I have a lua filter setup which is going to add a lua filter says hello header and then there is also the rate limit layer seven rate limits setup which which again you can take a look at over here so you're saying for the htdv protocol limited to five requests per second so this all got set up automatically let's ping the domain name and now let's try to call right so we are able to see a 200 and of course we are all also able to see the lua filter says hello let's try and navigate to the service from the ui so here we are so let's just then let's look at the let's look at the workloads and we see that unroot is meshed right and then we let's look at the topology so now this shows me that on root is meshed and we are able to pass traffic to unroot and it is mtls to the web service and the other aspects since we had meshed the emoji to workload and that also shows up here and now let's just go ahead and add an ssl cert we have the we have the unroot setup and let's just install the certificate on it so here we just changed the name and everything else is the same and we enable tls to true we set up our email to a valid email for us and then let's go ahead and request a certificate using acme from let's encrypt then again this will go ahead and talk to the acme server to get a certificate verify a certificate and then the certificate will get installed on the app so let's quickly look at what's going on with the cert so it is not ready yet there you are it's ready so let's go ahead and fire a curl request and we're able to see that there is n20ls here and we see the tls handshake and we see that the cn is set to the domain name that we specified and let's look at the cloud and see so I think here you can look at this and go let's look at application tls and linkerd tls and there you are the application tls showed up that's the linkerd tls so going back to this the cert that we installed that covered the tls from the user to unroot and we were able to mesh unroot and the emoji voto workload which was the mesh mtls aspect so that's how we achieved the end to an encryption using the linkerd service mesh and unroot so that concludes the demo if you have questions feel free to drop us a note through the website and thank you for joining us have a great day bye


Can you give us some more examples of, you know, how do we attract new talent and how the heck do we keep the great talent that we already have? I'm going to do that kind of backward and start with the how do we keep the talent that we already have because that's a great way to get new talent. The talent that we already have, we're finding that there's a lot of traction and conversation surrounding state interviews right now. And it's an opportunity for an organization with existing high caliber talent and well functioning teams to really mind what it looks like from the individual's point of view to weigh your options. What is it about the current organization that they really love? And if they had a super great offer from somebody else, what would it be possible to counter with to keep them there? Getting that knowledge and kind of storing it away to utilize it and act on it in different ways, not just individual specific is a gold mine. So when you're talking about, you know, getting to know your people and relationship development, that's a really great activity to be able to undertake. Now, along with that, people come to work and this is an opportunity for them to release one less variable in their life. What I mean by that is we are all challenged right now with so many things that are out of our control. We don't really know when we can go to a giant concert next. We don't know when we can see our family next or if we make plans now, if we can have it happen in the fall. Like there are so many things we don't know we're still dealing with, you know, children and school and grocery delivery and all that. Yeah, great point. So people can look at their work environment without having a lot of things that are out of their control like if they know what success looks like if they know what the quarterly goals are they know that annual goals are if they know what the processes are. When I say go to work every day or, you know, work from remote every day when I say go to work I mean put your mind there and accomplish the tasks that tick off that checklist that say I've performed what's been required of me or asked of me or maybe even more. I was successful today.


Welcome to the second and final review of Bud Light Seltzer. Hey there, NJRoot22.com here with another booze review, I guess you can call it. We used to do cheap wine and then we got into the seltzers. We've been into the seltzers for a couple of years now. About six months ago or seven months ago I did a review about the Bud Light Seltzer. I basically said I was going to try it again. My first time doing it or tasting it, it's exactly the same now. It's a decent tasting seltzer. It's pretty high in alcohol. You got a decent buzz. One gram of added sugar. About, they say less than one gram on it. Added sugar, less than one gram. It's probably 0.99 added sugars. And I have to tell you that little amount of added sugar, cane sugar, it doesn't matter where it comes from, it's sugar. It changes the way you drink it. I normally drink Smirnov spiked sparkling seltzer. I can control my consumption with this stuff here, this Bud Light Seltzer. I do not. I'm not completely out of control. I don't drink the whole, I don't drink the whole 24 cans of it. Without a doubt that little bit of sugar changes. And of course they also list natural flavors on there, which God knows they might put MSG in there. They're not by law required to say that. So I, this is a pretty affordable thing. And I guess if I really wanted to get smashed, I would pick this because I can't even voluntarily get smashed with the other approved seltzers. I think this just makes me drink a little bit more than I want to. And there's one thing though, actually, that's not so bad about this, is that I probably go to sleep a little bit sooner and sleep, I guess longer. So I don't know if the quality of sleep is any good or not. If you ever just want to get knocked out and go to sleep, this is not a bad idea. I don't like drinking more than I normally would. So we're not going to buy this again, unless it's an absolute emergency and they don't have anything in the store that's going to close in three minutes. I'll pick it up. It's not the end of the world. It's not 50 grams of carbs like most other drinks. But that's it. If you liked the video, hit the subscribe buttons and all these other things. Check out our channel. I think we have 400 videos now. It's ridiculous. I have under 100 subscribers. I'd like to get up to 1,000 before I have to say goodbye to daylight. Anyway, that's it. Take care.


Okay, sorry. And as we say in the last few days that when he looks at John Kyle right now, he's seen a more complete, even better hitter than 41 MVP in 2017. From your perspective, what are you seeing about the way that his swing is coming right now and everything like that right now? He's healthy right now and then he's just been putting in the work. I noticed when he really put in some work on the office side of things, he used the machine a lot more this time than he's ever had in his career, he said. So he's starting to learn the pictures in the American League and he's in a good place and I'm right there with Blooney. I think he's in a really good place and hopefully he can pick up where he left off at in the postseason. And secondly, you guys together at a very emotional press conference last year when you guys were talking about when the League of Solvers injected Robinson Day, how impressed are you by the way? I mean it's obviously not a player who speaking out like that comes very naturally, but how impressed are you by the way he's been able to do it over the last year? He's been great. I mean that's just who he is. He's quiet, but he does talk to people and it came from a good place and he's been through some things in his life and he's able to share it with everybody. So I'm happy that he was able to come out and speak about what was going on. We go next to James Wagner. James go ahead and unmute. Hey Marcus, good to see you. Just just now you played it the entire season without in-game video, like live video. What did you miss about that? Did you feel a difference? And are you, I don't know what you're describing, excited, happy to have it back in some form, you know, going forward? Yeah I'm excited. I'm excited to have it because it's a little tool that we use during the game. Again we can talk to guys about what we see during that bat. Like it's a lot easier if you you can have the computer room and video room and to break a swing down. But I'm glad we have it back and the players are excited about it, but we just got to check it out because it's going to be in a dugout, so we'll see. Is it the same what we have, but it is something that we can use and it's a tool that we really need. Did it change how you were coaching guys in game and you think it was like hurting guys in a way? Not hurting guys, some guys use it. James and I just, I just, I mean all throughout the league, I mean I heard it from other hitting coaches and other players were talking about it, but it was just, hand we were dealt, but we'll get past it and hopefully we'll use what they give us this year. We'll go to Kristi Akert next. Kristi, unmute please. Hey Marcus, I was talking to the Cubs hitting coach, Anthony Ipochi, and he said the video, not having the video last year, surprised him how much it affected guys. Not because they're looking for pitches, but because it affected their routines. Did you notice that as well? I mean like I just said, like it's a tool that everybody uses. We use it in the morning time when we get there. In game we use it, but it is a tool and like every hitter, every guy is different, but some guys really, really depend on watching their swing and watching their mechanics to make sure they're in the right place. So it did affect some guys and but you know like I've said like we can't do anything about it and just got to make sure we're prepared. I'm thinking if you're prepared then it's one less thing that we have to worry about. And just on another topic, you know Gary talked a lot about what you guys did for him after the season reworking his swing. What were the major changes and what do you see from him as a friend? We worked on some lower half stuff, making sure that he's on time. Last year his time was off quite a bit and he just never could regain that stroke that that we know that he has and we broke it down during the winter and he's in a good place right now. I like where he's at. I bounce back and forth across the street to Heinz and here at GMS, but he looks good and I'm ready for him to see it in the game. Thank you. You're welcome. We go to Pete Caldera next. Pete go ahead. Mark is just following up on on that question with Gary Sanchez. Did you find the struggles with catching up with the fastball to be among the more surprising developments last year in his act or the timing issue you just speaking about? Yes, if you're not on time it breaks your whole swing year. All your mechanics break down. That's why he couldn't catch up to the fastball and that's the first thing we dove into. Like I go and check to see what he's hitting off the fastball and it wasn't up the part of where he's usually at. But he's in a good place right now and he hit a homer today in BP. I mean live BP out for like a 95 mile per hour fastball up in the zone and I like where he's at. He's been really putting in the work on both sides of the baseball and he's ready to go. Thank you. We go next to Lindsay Adler. Go ahead Lindsay. Hey, Marcus. With, you know, being at home seeing their gas station everything, we've talked a lot about, you know, teaching technologies. I'm serious. We don't hear it as much with hitting, except for things like wearable tech, fast sensors, which like they get a little bit more complicated with the CDA. Could you just sort of like give an assessment of where technology is at for things for the city and sort of how you are trying to use that with your players? I mean I think the Yankees have given us plenty. I mean we have a lot. I mean we don't have a gas station but we do have some tech underneath that we use and our players are getting used to it and the game is growing and we have to grow with the game and and we're using it when we have to. We don't use it every single day but it's there if the player is needed and myself and PJ, we know how to use it and we just got to be prepared because you get players from other organizations and they come in and they if they have it, I mean if they've used it before, we just got to make sure we're ready and I think the Yankees are right up there with everybody getting us what we need. I'm curious, do you think that you would use technology when you were in your playing career and what might have you tried, what might you have tried to use it to improve in your game? I mean if anything was going to help you, yes I would have used it. I would have tried if it would have helped me. I would have had to get used to it but there's just tools in the toolbox that they're trying to help us be the best player that we can, best players that, I mean our players would be the best guys that they could possibly be and of course I would have tried, I mean if it was going to help my career I was going to try. We go next to Sweeney Murdy, Sweeney. Marcus I'm about to file a copy right for the power station so if you'd like to file it then you can talk. All right, the new ball, have you talked about it much and if it has the desired results do you see any potential changes in philosophy for hitters and how they might go about doing things? No, we're not changing our philosophy Sweeney. We're going to control the strike zone and we're going to try to kick up some dust when the ball is in our damage zone. We used some of the balls yesterday and I didn't really tell the difference. We got some powerful guys man and I just I don't want our guys thinking about the baseball other than hitting it. So I don't think it's going to be a big difference but we're going to keep our philosophy as our philosophy. We're not getting away from that.


This article reviews the development of pH-responsive theranostic nanoplatforms for cancer diagnosis and treatment. It discusses the design and application of these platforms, as well as their potential challenges and future prospects. This article was authored by Shuli, Renyu, Gokien Guan and others.