Hello, welcome to Cloud Native Live, where we dive into the code behind Cloud Native. I'm Whitney Lee. This is my very first time hosting today. Thank you for being here. I'm a developer advocate at VMware. Every week, we bring a new set of presenters to showcase how to work with Cloud Native Technologies. They will build things, they will break things, and they will answer your questions. Join us every Wednesday at this time at 11 a.m. Eastern. This week, we have Chip Zoller and Jim Baguardia here to talk with us about what's new in Kaverno. Jim and Jim, please take it away. Hi. Thank you, Whitney. Thanks for having us on. Today, we would like to share with everybody the news that Kaverno 1.10 was just released. We'd like to give everybody an overview of the features and changes that were in this release and also do some demos so that you can really understand how this stuff works and how you can use it. So, if we're seeing the blog that I've pulled up, like the walk through the blog post and talk through some of these features. So, here is our blog post on the Kaverno 1.10 release, and there are a ton of stuff to cover in this. So, I want to start at the top, and there are links that will be provided there for all of these resources. So, first of all, several of the new features in Kaverno 1.10, and let me just start off by saying that this was a really huge release. We've been working on this release for a number of different months. I think we had almost 500 PRs that were merged for this release that included a bunch of new features, a bunch of enhancements to existing features, your normal plethora of fixes and everything in between that encompassed not only obviously the maintainers, but many contributors across the community. So, if you were one of those who participated in this, and that could have been saying that you had a problem on Slack or opening an issue or obviously a PR, thank you. We love community. Kaverno is very popular within the community and it wouldn't be that way without all of you who are participating. And at the very least, just providing feedback. So, if you did contribute in some way to this release, thank you very much. You helped put this where it is. With that said, let's walk through some of these key features and then getting to some of the other things of Kaverno 1.10. So, one of the main things that we did in Kaverno 1.10 was we wanted to address some of the scalability challenges. And the way that we did that was by breaking Kaverno up into its constituent controllers. So, for a while, Kaverno has had a bunch of different capabilities. Kaverno can do all sorts of cool things like validate resources, mutate them, generate resources, clean them up, have policy exceptions, generate reports that are accessible in the cluster. All of this stuff obviously takes resources. And in some cases, you wanna be able to fine tune the resources that you're allocating on a per component basis. But with all of the things that were lumped in together, you know, as Kaverno grew, we realized that we needed to be a little bit more scalable. We needed to allow people to both turn on and off components and also allow them to scale just the component that they need without necessarily giving resources to everything else. So, the first thing that we did in Kaverno 1.10 was decompose Kaverno into these separate controllers. And this is what it now looks like, the physical diagram of a Kaverno 1.10 installation. We've got a cleanup deployment. We've got an admission controller deployment, our reports deployment and a background controller deployment. All of these are optional, except the admission controller because that's the heart and soul of Kaverno. So you can flip any of these others off if you want to. That also means that you can scale them out horizontally. Each of these accommodates horizontal scale. And you can also vertically scale them. So you can add additional resources to these components if you want to. If you do check out the blog page, take a look at the high availability page that we link in there because scale is handled a little bit differently depending on what these controllers are. But this should be a really welcome change because as I mentioned, it'll allow you to get only the components that you want and it'll allow you to scale them for your needs. So if you need, for example, more resources in the reports controller and less resources in the admission controller, you can totally do that. So that was one of the first changes that we made in 1.10. And as a result of that, and we'll talk about this in a little bit more detail, but we had to totally change some things because we're going from one to, well, three others, but four total. So there were some under the covers changes that we had to make because of this. But those are the components of Kaverno and that they're now broken out in 1.10. The next thing that we did in 1.10, which has been a longstanding release by our longstanding request is to allow you to make calls to other services in the cluster. And technically, this could even be calls outside of the cluster if you really wanted to. Kaverno has a lot of capabilities to already fetch resources from the Kubernetes API and the form of config maps so that you can use for your policy decisions or literally any other resource that you want inside of the cluster. And that was great and necessary in a lot of cases, but one of the things that we heard is, hey, you know, sometimes I need to make calls to something that's not Kubernetes itself in order to get something to inform me about what my decision should be. And so we're glad that in this release, we've enabled that ability for you to call external services and get data from some sort of a JSON REST API. Now, this is an initial feature. So there are some things that aren't there like authentication, but in general, this is gonna allow you to write policies like this. And even if you aren't familiar with Kaverno, if you're watching us for the first time and you haven't seen a Kaverno policy, you can see that this is fairly straightforward. I mean, here's our context call that we're making to some other service that allows us to do a post. Will you zoom in on that please? So it's bigger on the screen. Thank you. How's that? That's much better, thank you. So here's an example of a policy, even if you aren't familiar with Kaverno, you can probably detect what this does and you're able to make a very effective service call very simply with this new capability. You declare what your method you wanna be and we support get and post. You provide some sort of data in the body here. And so this is a key value pair that it would be bundled as JSON and sent to some endpoint. You provide your service URL. You provide a CA bundle in case you're talking to like an HTTPS endpoint because we need to establish trust. And then you just use whatever the response comes back and this is gonna be stored in result and you do some validation against it. So in this case, this is just basically a prototype that does a deny action if the result in the allowed field said false. So what this actually allows you to do, and I'll flip over and just show an example like this, you can do things like subject access reviews now and against the Kubernetes API server. This is a little bit of a, it's a variation of the service call but this allows you to do a subject access review to find out if whatever user or principal that is submitting the request has the permissions that you expect. So I'm not gonna go through and dive into this. Whitney will put the links out there. This is an example policy that's in the Covert No Policies repo and so just to show that real quick, if you haven't seen the policies repo, there are 283 Covert No Policies that are out here. There are everything from pod security to what I just showed subject access review to custom resources to you name it. These are all things that you can pick up and use right now. Many cases you don't even have to modify you can just pick it up and plop it down. In other cases, you can gently modify it or if that doesn't get it, you can use that as a starting point to write your own policies. And since Covert No does this very, very simply there's bound to be something here that you can piece together to make whatever use case work for you. So anyhow, that is the overview of the service call and the next major feature is support for software supply chain security with CNCF Notary. And I'm not gonna steal Jim's thunder because he's gonna talk about this more in depth and also show a demo around this, but just to quickly gloss over it, Covert No has had the ability to verify signatures and attestations with six-door cosine tooling. Well, now in this release, we're adding notary support as well. So the end goal is that no matter how you wanna secure your software supply chain with either of these projects Covert No wants to meet you where you are you can verify signatures already with cosine six-door. Now you can verify signatures with notary. So Jim's gonna go into more detail in that, but that will be a pretty cool demo later on. That's notary support. And the last of the major features before talking about some of the other minor ones is that we did some major work on the generateability. So for those that may not be aware, Covert No has this cool ability to generate resources that is create all new Kubernetes resources based upon a policy that you define. And those resources can either be defined in the policy itself, or they can be cloned from other locations and other resources that are in the cluster. We did a massive amount of work on the generate rule because we heard there were some issues with it. And also there were just some features that users wanted to have like, hey, I really want my generated resources to follow the same life cycle as my triggering resource. So for example, if I label the namespace, and this is pretty common in multi-tenancy where based on the label that you assign, you want some resources to go into that namespace, maybe like a T-shirt size of a resource quota, like, hey, I want a medium T-shirt size resource quota in a medium limit range. But if I go and update the labels later to maybe change medium to large, I need those resources to be adapted. Well, in this release, we've done that. So you can change those resources and delete them if the trigger no longer matches and a lot of other things, not going to go and boil all this down. But in short, we did enough work on generate that we felt that this was a major feature. We know that generate rules are very heavily used out in the community. They're one of Coverno's most favorite capabilities that we continue to hear over and over. So we really wanted to make sure that we not only added new things that met people where they were, but we were delivering a better user experience and making sure that things worked when they should work and they didn't work when they shouldn't work. So we put a lot of work into that refactoring and that's the generate stuff. On the, some of the other minor ones, I'll just go through this, but some of these will be, there will be some silent cheers and rejoices in the background if all of your microphones were up. So I'll just quickly run through these. The first one is that you can now specify operations directly in the match. So for those that do use Coverno and know it, you had to use something like a precondition to match on the operation that you wanted, whether that was create, update, delete. Well, we made that even easier. So now all you have to do is specify this. If you want to match on create, all you have to do is operations, create, and you get it. So pretty simple and straightforward, but does allow writing simpler policies and making the simple Coverno policies even simpler. Policy exceptions for those that have not seen the 1.9 release policy exceptions are a unique feature in Coverno that allow you to create what's called a policy exception. And it's a separate custom resource from a policy that allows you to exempt any resource from the policy or policies that are named in that policy exception. So this type of decoupling is really great because now you can allow something like a self-service portal to generate policy exceptions. And even though you may not have or want to grant somebody access to modify a policy or anything having to do with the policy, you can still allow them to create an exception. And that exception will allow those things to bypass a policy. So this is really great for these legitimate use cases where it's, hey, I know that we have a policy in place that forbids this, but I have a valid reason and I want to create a policy exception for it. You can do that with a policy exception feature. But in 1.10, we enhance that to do things like background scanning so that you can get policy reports that reflect the policy exceptions and also making rule names more flexible with wild cards. So we'll go into a lot of details with that, but if you're a fan of policy exceptions, we know that a lot of people out there are already using it, even though it's only been around for one version, even more support and enhancements around the policy exception feature in 1.10. Policy reports, so quickly for those who do not know about policy reports, Coverno has this cool ability to generate a policy report in a Kubernetes cluster. A policy report is an open standard developed by the Kubernetes policy working group of which Jim is one of the members. And the policy report is just another custom resource in the cluster. And this is cool because it allows someone to see the results of a policy that may not have permission to look at a policy itself. So you decouple the policy and what happens with the evaluation of that policy so that anyone, including tools, by the way, can scrape those policy reports. So we've made some enhancements to policy reports in 1.10. And one of those things is if you've already excluded namespaces in the resource filter and the resource filter is just an internal mechanism that Coverno uses for its own configuration purposes, those will now be obeyed in background scans. And this was one of those yahoo moments that we heard from folks that they love policy reports. They also want those to be exempted from background scans. We've done that for you. That is, of course, configurable. So if you want the previous behavior, it's no problem, you can still do that. Some other, let's see, minor things, context variables. So these are now evaluated just in time. So this allows you to write policies that you perhaps couldn't before or make those policies simpler because they're only gonna get checked at the time that they're run. So that can be super handy. There's now a new message field that's in condition. So if you're using Coverno and writing conditions of which, let's see, the one that I had just pulled up is an example of such a policy. And I'm looking at our 110 policies here. So in the condition is this thing right here, this tripartite expression, just like we're all familiar with in Kubernetes today, you have expressions like this that are all over the place. We've now added a message field in here as well so that in special cases like the verified images rules, whatever the value of that message field, it can show your users when something is blocked. You can show this exact condition or the exact expression that produced that result. So super handy and that'll allow folks to display even more rich messages in a more dynamic fashion. We have some new James Path filters. I won't cover that because that's going a little bit more in the weeds. Do check out the blog that Whitney shared because all of this is in there and we have links to the docs and you can go find all that stuff out. Last thing just quickly mentioned, so obviously the docs, we did a lot of refreshing on that. I showed the policy library, 283 policies, the largest policy library of any policy engine that's out there and it continues to grow even in between version releases. But all of those policies are now reflected on Artifact Hub. So if you know and use and love Artifact Hub like a lot of us do, you can find all of these out there right now which actually makes Kubernetes policies the fourth largest artifact type on Artifact Hub. So that's it for the features. So the major and the minor features just wanted to bring out a couple of notes on breaking changes. So we did have some breaking changes in this release. And as I mentioned, one of the main ones as a result of this decomposition to provide that increased scalability was we had to go to a new Helm chart version. And as a result of that, there's not a direct upgrade path because we're going from one or two deployments to four. So things aren't gonna translate and it's gonna be really nasty. So we came up with a new Helm chart, put everything in it along with all of our learnings from previous versions. So we've made that a lot better. There are also a couple of things when it comes to policy declarations I won't go and distill all those things down. Again, check the blog, look at the release notes. We have a Helm migration guide that's out there to make this process easier, but do just wanna make you aware of those things. And yeah, that is it for the 110 features. Anything to cover any questions out there, Whitney, before handing it over to Jim to dive more into the notary stuff? No questions in the chat so far. If you do have any questions, everyone, please do be liberal, ask your questions. We have, we can ask questions in a moment, but we also have a Q and A section at the end, so please don't be shy. And I just wanna say I really love how in tune you are with community needs, I think that's really admirable and super cool. And I love the policy library, that's amazing too. Thanks, yeah. We really spend a lot of time listening to folks in the community and understanding, Coverno is supposed to be the easy button for policy and it's not just supposed to be easy, but it's supposed to be imminently capable in a lot of different areas. And that doesn't work if you don't listen to what real problems people are trying to solve. So we love hearing cases where, hey, I'm trying to do X, Y and Z and here's why I think it's valuable. Is there something that Coverno can do? And very often the answer is, yeah, there is. And if not, then that's something that we'd like to take and chew on for a little bit and then figure out, all right, how can we take something that's kind of maybe difficult to solve or involves multiple tools or maybe just can't be done without a bash script and make an elegant way to do that, but also make it simple. And so that's what we really try and do in the Coverno project to make this stuff simple, but also make it powerful. That's evidence and impressive. I do have one question about it. When people do have, you say you love hearing from the community, what is the space where you do hear from the community? We hear a lot of feedback in different channels, but the biggest one probably is Kubernetes Slack. So we have Coverno channels that are on Kubernetes Slack, as well as CNC of Slack. We're on Twitter and obviously we're on GitHub. So we hear a lot of feedback on all of those channels, but probably our most active space is the Coverno channel on Kubernetes Slack. And in the documentation, there's a link that can take you there. So if you wanna go and check those things out, you can go and subscribe to the Slack channel. We have a community meeting. There are all sorts of things on our community page that you can go in and check out. And also in a similar vein, we love contributors. And if you wanted to get started as a contributor, we have all sorts of resources to help get you started, not just developer docs, but issues that are labeled good first issues. And we also have a channel called Coverno Dev on both Kubernetes Slack and CNC of Slack. And we would love to talk with you and help you out on any challenges that you may have in contributing to Coverno. So lots of ways to get in touch with us. We're very responsive, as you can see. And we like working with our community and our contributors. Amazing.  Yes, absolutely. Thank you, Chip. Thanks, Whitney. So let me share my screen and I'll pull up. We'll start with just going back and describing what the image verification capability in Coverno was and how we have changed this in 1.10. And I'll also talk a little bit about how this will evolve a little bit further. So first of all, you see just this warning in the documentation that image verification, we have kept it as a beta feature. And one of the reasons was we were anticipating some of these changes coming in for notary. The cosine support, I believe, landed a couple of releases ago initially and has matured where, and I'll explain a little bit about what cosine and notary are and how we're utilizing them in Coverno. But just stepping back a bit, and for those of you who might not be familiar with, you know, software supply chain security or image verification and why all of this is even necessary. So today, what's interesting is more and more we're seeing that production systems are getting a better security sort of treatments. We have better tools, especially with cloud providers as well as we know with the vendor community. And, you know, as production systems are getting secured, the one interesting thing that's also happened is with cloud native tooling, with infrastructure as code, we're seeing that, you know, build tools and CI CD tools have become more powerful and in many cases have the capability to deploy into multiple production system. So combining that with another, you know, factor which is more and more applications are leveraging open source, are leveraging, you know, other, you know, services or modules and getting composed, you know, with maybe even in some cases, hundreds if not thousands of different packages. What we're seeing is that attackers have started exploiting these CI CD tools, these build systems as a way of penetrating multiple production systems. So what, you know, with attacks like we've seen in the last few years, like SolarWinds and a few other type of like the log4j, you know, it's security issue that we've had other things. What's been happening is that by, you know, either injecting malicious code at build time or being able to compromise build systems or being able to run things which are not authorized, attackers are able to, you know, leverage these, you know, powerful sort of capabilities in terms of, again, what CI CD tools and infrastructure and codes tools can do to be able to penetrate production systems. So what can we do and how do we solve that, right? And the good news is in the open source community, there's a lot of activity to be able to address these issues. Six Store Cosine is part of the Linux Foundation and, you know, that they have developed some great tooling to be able to help with some of these software supply chain type of attacks. And I'll explain that a little bit. But what Kiverno does is as it's an admission controller and a policy engine, it can do a few things to make sure that the images, the container images you're deploying into your clusters are signed. They have, you know, there's integrity in terms of checks, in terms of where this image was built or who built it and is it a trusted image which should be allowed to be deployed into your cluster itself. Other things you can do is you can even check, for example, if that image has an associated vulnerability, scan report, an associated S-bomb or a software buildup materials. So things which, you know, really prove that that image was not only built on a trusted system but hasn't been tampered with and has the right security posture to be allowed to be deployed into production. So how we do all of that is through this Verify Images rule in Kiverno and that Verify Images rules has two main components to it. It takes a set of attesters and think of attesters as authorities in terms of proving the identity of your image itself, right? So these could be keys, they could be certificates, SixTor allows something called Keyless which is, you know, a way of using OIDC and short-lived certificates to be able to verify that identity. But attesters are a way you can prove that some, the thing that built your image is something you trust. And then attestations are metadata that you produce along with your build systems. Could be scan reports, could be provenance data and provenance just means, you know, proving where this image came from. So it could be information about your environment, your workflows that, you know, let's say if you're using GitHub Action, your workflows which built that image or any other metadata that you wish to check like even a software bill of materials. So within attestations itself, of course, you have the same problem as with images. How do you know who built this attestation, right? So again, you can use attesters to verify that, you know, identity of the builder or the build tool for the attestation. And then you can check certain conditions and chip briefly touched on conditions in Kibirno and how those work. But you can check, you know, go fairly deep into your JSON data that's in the attestation itself to check various things and to prove that that image can be trusted and can be deployed. So the basic structure of the rule is, you know, you're verifying images, you have attesters to check the signature of the image itself. And when we say an image is signed, it really means that the manifest that's stored in the OCI registry for that image has been signed and you're verifying that along with the signature, the public key of the signature that you want to trust. And then you have one or more attestations which you can also optionally check. There's a few other things that Kibirno helps you do. It can also, it will automatically mutate tags to digest. And this is very important for security because if you're using tags and if your tags are immutable or they are mutable, what can happen is, you know, an attacker can again present a particular tag but then can switch it in, you know, some time window where now you're running an untrusted image, which you thought was previously trusted. And Kibirno can also do things like it can make sure that all images coming from specific sources or from all registries are signed and are verified before, you know, allowing them into your cluster. So this is, you know, what we had before, even with cosine. And now what we've done is we've been able to maintain this, you know, pretty much the same rule structure but add notary year as an additional type of signature and verification that we use within Kibirno itself. So I'll show, you know, what this looks like. But just before we go to that, just to briefly kind of mention what notary is and I'll also elaborate a little bit about why it's different or where it differs from six store cosine, right? So notary is a CNCF project. It is, you know, it works with X509 infrastructure and it uses underneath, it uses, you know, OCI standards, like the artifacts and references which came out in the new, the 1.1 version, I believe, of the OCI spec. And I'll show what that looks like in an actual registry because it's interesting to see, you know, how notary is managing some of this metadata and the signatures itself. But just, you know, first, if you want to kind of, you know, just assign something with notary, notary comes with its own command line too, much like six store. So if I do notation, you know, sign, I can sign any image and, you know, this image is already signed so I'm not gonna rerun the signature. But once I sign this image on the command line, it will, you know, show me or it would sign that image and it would push up the signature blob into the registry itself. So if I do notation inspect just to show you that this image is signed, what I'll see, and by the way, here I'm using the digest because otherwise it'll warn me saying that the tag is mutable and, you know, the recommendation is to use the digest. But if I do an inspect, what I'm now seeing is that, you know, this image and this is my digest for the image has a signature associated with it, here is the signature, you know, digest itself and then notation gives me a lot of helpful information on the signature, who created the certificate for it and other, you know, things itself, right? So now, you know, with this itself, if I, even on the command line, what I can do so is I can also run notation to verify this image and then we'll take a look at what that looks like in a, you know, cavernum but if I just do verify signed and notice now it's telling me, hey, you know, you might not want to use the tag, use a digest instead but it's giving me back the digest and saying that it already verified the signature based on what's configured, you know, how I've configured my trust or in my system itself. I have a question that might be silly but is notation the CLI for notary or the CLI for cavernum? Notation is the CLI for notary. Yeah, it's a good question because it is a little bit confusing. Notary is the project. Notation is the command line tool which is a sub-project or one of the repos that's maintained and delivered as a CLI binary. Excellent, thank you. Sure. Yeah, so this was just a quick, you know, how you would verify it, you know, from the command line and of course, if I do, you know, unsigned, it's gonna tell me that there should be no signature associated and, you know, to make sure my artifact is signed, right? And these are just test images we're using. So let's take a quick look at how you would do this with cavernum, right? So now going back into cavernum policies, what I'm gonna first demo or first show is this policy and I'll kind of do a, you know, walkthrough of how this is laid out. So here, what we're doing is we're first of all saying that we wanna enforce validation, which means if there's a failure, we're not gonna ignore it in the web book. We're gonna block the image. We're giving it a generous timeout here. Typically it just takes a, you know, few milliseconds, but we're saying 30 seconds just in case the registry is delayed. And then, you know, the failure policy we're saying for the web book here is fail, which means also again that if the web book is unreachable, block, you know, new images from being deployed. Notice here I'm writing this policy on a pod, but cavernum will automatically generate, you know, from the pod policy will generate for different pod controllers as a autogen feature in cavernum, which helps do this. And it will, you know, run so I can even have a deployment if and as long as it matches the pattern that cavernum is looking for, it will enforce the same policy. And then what I'm doing is in my context, I'm loading, you know, a config map, which contains the public key that I want to use for verification. And I'm saying that verify images with notary and any image that matches this pattern, which is our test image, I want one attester, so one key to make sure that that image is signed with that one key. And here I'm gonna use this key from my config map and the key name for it is just production, right? So if I look at my config map, this is what it looks like, and I can inject this key over here into my policy itself. So let's take a look, I think I already have this configured, but I'll just quickly check. So if I do get C-Poll, C-Poll is a short for cluster policy. I have this policy configured. And now if I do kubectl, you know, let's say just run and I'm gonna run, let's try the signed image or well, we can try on sign first and I'll just drive on it so it's not really creating anything, but it gives me a failure as expected saying, you know, similar to what we saw to make sure that the image itself is signed because it couldn't find any signature here. So if we go back and do a signed, what we would expect to happen is it checks the signature with the key and the pod is allowed to be created, right? So pretty much as expected, no, you know, no major surprises there and Kivorno is able to run this check and at this, you know, I don't need any other extension or anything else complicated. This is all built in into Kivorno itself to do the signature verification. So like I mentioned, what I also wanted to show though is what this image looks like and I'll explain, you know, also some of the things we're adding to this feature and what will be coming in release 1.11 in terms of, you know, how we will also do things like annotation checks, right? So just going back to this image, I'm using another command line tool and because notary is very much standards-based, you can use any registry client, any tool that understands OCI artifacts and here I'm using a tool called ORAS which is, you know, running, you know, command which pulls down that image which we just checked and it's inspecting everything attached to that image. So a few interesting things here, right? So first of all, in this image, I'm seeing that there's a signature and this is my OCI artifact type and it's giving me a digest for that signature. Then it's telling me there's a scan report attached to this image. I have the digest for it and in addition to the scan report, I have a signature associated to that, right? So the interesting thing here is to that same image, I have, you know, I can check the signature for it but I can also check some of this additional metadata and I have, you know, I can make sure that metadata was signed by authorities that I trust and then, you know, the last thing here I have is a Cyclone DX image or an SBARM, I should say, which is also attached to the image and similar to the scan report, it's also signed. So if I look at all of this in a registry and I'll pull up, I have, you know, here, just as an example, I'm using Azure Container Registry which has this preview of OCI artifacts. So if I look at this and let me make this. Do you make it bigger? Yeah, excellent. Yeah, there we go. So one thing I wanted to show here, which is interesting, right? So if I go, you know, into my artifact preview, so going back, let's go back a bit here into the image itself and if I look at my manifest here for my image, I see this is just, you know, it was built. It's following the Docker distribution spec and it's showing me the digest, et cetera, and the layers for that image. If I go to my artifact preview, much like we saw on the command line, I see there's a signature and there's a scan and underneath the signature. So by the way, this is a different image. So it looks slightly different, but similar concept right to what we were just looking at on the command line. And if I go in and look at my signature itself and the manifest for it, one interesting thing, and this is new, you know, there's this subject block here, which is pointing back to the hash for my original image. So this is how, you know, when I looked at this on the command line, this is how a command line tool can figure out that this, you know, artifact is associated with a particular image and is actually adding or attaching something to that image, which can then be verified by policies. So the combination of all of this makes it really powerful because now I can, you know, I can check for my image artifacts or any, you know, anything attached to an image. I can check whether they're signed. And, you know, in the next release of Kibirano, what we're gonna do much like we do today with Cosign is we can, we will be able to check the details, the contents of these artifacts that are signed and attached. So all of this, you know, just works, you know, right now with Kibirano and like one of the things going back to Notary when I, you know, we've mentioned that we also support six store Cosign. So Notary uses X509 certificates underneath. It is using, you know, so if you have standard, you know, infrastructure or if you're using a KMS type system to build and deliver these certificates, you can continue using those. And that's where, you know, there is a, you know, mechanism to have plugins also for other external KMS systems, other things that you would build in. So if I go one, one just quick thing to show over here, if I kind of look at my, you know, in my local system where I have notation that command line to installed, I have a trust policy configured as part of my Notary configuration. And this trust policy is saying that if my image pattern matches, you know, this test image that we were using to be able to, you know, use the keys in my CA store with, you know, the name test. But I can also have a KMS system and you're having AWS, you know, external plugin, which is saying that if my image pattern matches this other pattern with Kibirano demo, then go ahead and use this plugin to verify, to pull the keys automatically and verify, right? So that, you know, Chip mentioned the extension feature that we have added in Kibirano 1.10. And the intent there is to be able to use that extension feature to be able to run these kind of external plugins to be able to also do verification for images where needed. So overall Kibirano would then be able to provide that ability to either check signatures built in, like locally, just like a demo, or to be able to run other plugins, which can do additional checks and additional verification. Right, so that is just a quick overview, you know, of how Notary works, what some of the things it does in terms of the OCI artifacts and how, you know, that's laid out. So it's pretty cool to be able to see some of these details of the image, some of the other things. And we will be adding more capabilities into, you know, Kibirano to be able to, you know, verify this type of data itself.  So with Cosign, you know, and one question that comes up is, okay, we have a six store Cosign, we have Notary, why would I use one or the other? What are some of the, you know, pros and cons? Like I was explaining Notary works with, you know, X509 certificates that integrates very well with your KMS or with other systems. But Cosign offers the ability to also do a few other things like keyless. And it also has, you know, components. So six store has three major components. Cosign for signing and verification. Rekor, which is a transparency log where information is stored for additional security checks. And then Fulcio, which is the keyless support for web-based or, you know, OIDC certificates, which are short-lived and can be generated as part of your CI CD tools. So it works really nicely if you're using something like, you know, GitHub Actions, which has an OIDC provider or GitLab also provides that. But the one thing to also realize is if you're signing something in Cosign, and what I'll do here is just to kind of simulate, I'm not gonna actually sign this. But, you know, if I kind of see what it's telling me here, is I see a warning here, which is saying that six store or Cosign is gonna send some information to the transparency log. So it's something to be aware of and to keep note of that when you're signing anything with Cosign, there is this other component which gets used by default, you know, it's using the public transparency log, which can be configured to use your own. And just as a demo for what that looks like, I'm gonna go to one, you know, test image I have and to show like, you know, and as part of this pipeline, we have signing configured, right? So again, it's- Can we make that bigger, please? Sure. Thank you. No problem, yeah. So you're, we have signing configured and you see it's generating, you know, it's using keyless. So it's generating ephemeral keys. It's actually, you know, doing some check. And then there's this one line which says T log and T log is transparency log, which is record entry created with index, you know, and there's a number here, right? So if we go and look and there's, you know, SixTor provides this, you know, tool to search record entries. Let's go in and look at a particular log index. So I just copied the log index I saw in my bill log. And what I see is in record, this record that was created, which matches exactly what was signed. Now, this is pretty cool because I can fetch this record and do other checks on it. But it's also something to be aware of that if you're using, you know, SixTor and it's way of verifying trust, there is this additional record that's created and it's something when you're configuring a policy, you would be able to also fetch this and check this in addition, right? Whereas if you're looking at, you know, notary, it doesn't have the capability of keyless. It doesn't have this other additional transparency log. It's relying on X509 infrastructure and KMS to do its, or, you know, you can of course, like in our example, what we did is we just passed in the key directly into the inline that certificate, the public key, which we are using to check, but this could be coming from an external system, you know, if you're using a certificate management system or some other key management system to manage your keys, right? So a few interesting differences. There's also some differences in how with SixTor, you are, you know, if you kind of go back to an image itself and here I have an image which is signed, both with SixTor as well as with, you know, notary. So the SixTor, you know, image signatures are stored in this dot sig extension, whereas with notary, like I showed with the ORS command line, these are stored as artifacts, right? And I believe at some point SixTor will also move to storing and, you know, managing as artifacts, just few minor differences in how again, you know, the signatures are stored, retrieved, and can be managed as well as attestations as you're looking at, you know, these OCI images. So that was a, you know, somewhat of a deeper dive into notary, but we're pretty excited to have this support. And with Kverno, you can do, you know, again, with a fairly simple policy, you can already now in 110 start doing signature checks and we will be adding more features, which are already well, you know, into development and which will be part of 111 to do additional checks for attestations and other, you know, metadata that you attach to your images. So what I'm hearing is with notary, it uses traditional PKI infrastructure. So you have the responsibility of managing your private keys in that case and keeping them up to date. And, but then with SixTor, your key list, so now you don't have that burden anymore, but then your records are in this public log, which, yeah. So there might be, uh-huh. There is an additional component to transparency log with SixTor introduces. You can run your own private version of that, but it's, you know, one other sort of, you know, infrastructure component that would be required. And then if, say I was switching from one to the other, is it possible to have for Kverno to make policies or for you to make policies with Kverno that would use both types of verification, like in the same policy? Yes. And that we do see, you know, there is a potential, at least in the same cluster that perhaps some images may be signed by Cosign and Cosign, you know, is fantastic for open source projects, right? Cause it works really well. It integrates with GitHub where most of the open source CNCF projects live.  And that's where, from a Kverno perspective, we of course will continue to support both and see how the standards evolve, how the specs evolve and, you know, add features accordingly. Super cool. We don't have any questions in the chat right now. Is there anything you want to embellish on? It's not. Yeah, maybe we still have to cover a little bit of the futures for Kverno. So if there's nothing left on signatures and the new stuff on 111, I'll flip back over and cover that last piece. And we can see if there are any questions that arise during the course of that. Absolutely. Let's do it. All right, so I realized that I was remiss earlier and I didn't talk about the scale testing that we did during the course of the decomposition of Kverno 1.10. So one of the things, in addition to that that we've done or rather complimentary to that is that we've completed a pretty extensive set of scale tests with Kverno, at least when it comes to the two main components, the admission controller and the reports controller. And so as Whitney showed earlier, there's a link that's out there that'll point everybody so that you can go and look at these scale tests. But what this shows is Kverno is able to handle really high scale. And we see this very often in the community where folks are using this in clusters of 100,000 pods or sometimes more. And so we put together a test case where we would measure things like latency, resource consumption and storage consumption space for these controllers. So you can go out here and take a look at the docs and what we've done in these cases because Kverno has so many capabilities, we had to kind of limit it to what are the most common policies or the most common types of policies. So that's what's reflected in these tables. There's a lot of numbers there. Definitely not gonna go and try and distill all of this stuff down. But if you're interested in how Kverno scales, if you're interested in what the, as a 110 anyway, what resources you can kind of expect to see in your environment, then this is a great way to kind of get that baseline. Of course, it's no substitution for you monitoring your own cluster using your own tools. But this is a good starting point so that you understand a couple of things. Number one, what should I be getting it to it? Because you don't necessarily want to waste resources. Like that's, you know, an over allocation thing creates waste and clusters. But if the behavior that you're seeing, you can check against this and say, is this normal or not? And those are both two very important pieces of information to get. And like I mentioned, we published that for the admission controller and the reports controller. So a lot of cool facts and figures, but you can see in the case of like the reports controller or we've scaled this up to, this is the, let's see, where is the one for pods? So a hundred thousand pods, you can see what that looks like if you really want to see how this performs. So anyway, that's the last piece of covering 110. And if there's still no questions that are out there, I'll flip over and we'll talk about what's next for Kvernor in the future. Still no questions. So let's hear about the future. All right. So we got 110 out of the way. We're obviously still not done. Sorry to interrupt. Thank you for the reminder. Thank you. So we're just taking a look at the milestone here. So 1.11 in Kvernor, let's talk about what the plan of record is, plans change, but as the saying goes, planning is still essential. So we'll talk about what the current plans are for 1.11. So the first thing is Kubernetes validating admission policy support. So this is also known as cell admission that was introduced in Kubernetes 1.26. As an alpha feature, it's still alpha. And what this allows you to do is inline basic validation policies to the Kubernetes API server. So Kvernor has been, you know, have our finger on the pulse of the Kubernetes nation as it were. And we're listening and hearing things that are going on and we're going to have support for this in 1.11. And this could take more than just one form, by the way. This could be, for example, the Kverno CLI has the ability to test these validating admission policies in your pipeline, the sort of shift left movement. So we're looking at that. We're looking at being able to generate the policy reports that I talked about earlier as a result of these validating admission policies. We're also looking at Kverno being able to, you being able to express rules using cell, common expression language if you want, and maybe even Kverno in the future being a controller of these validating admission policies. So depending on the type of policy that you create if it's appropriate for Kverno, we'll leave it as a Kverno policy. Otherwise, we'll translate it to a validating admission policy so you get the best of both worlds. So in any case, we don't know exactly what we're gonna do fully, but we do know that we're going to do something and work has already underway in a couple of different regards on validating admission policy support. It will still be alpha, but we are gonna intercept with it. And so that's the first thing that's on the roadmap for 1.11. Pod security admission enhancements. So we are hoping to enhance Kverno's ability to pick up the upstream pod security admission library. So just for a little bit of backstory, pod security admission, as those may know, is the current in-process policy enforcement mechanism that's the successor to pod security policy in Kubernetes. It came out in 1.25. It's still here. We like it. It's very good and very flexible. Kverno, however, pulls that in internally and makes a little bit different use of it to give you more flexibility with those same libraries. We wanna enhance this even further to allow you to do things like per control or sorry, per field exemptions. We need some upstream help from the Kubernetes project to do that, but we hope to have that wrapped up and have this out the door in 1.11. OCI artifacts and references. So Jim talked a little bit about this when it comes to cosine and notary support. So we're gonna hopefully have more support around those OCI artifacts and references in 1.11. Same thing with cosine and notary updates. Cosine 2.0 is a pretty significant change from cosine one. And so we're working on being able to support cosine two. Again, kind of the idea behind this is we don't wanna be ideological as far as what tools you use for your own software supply chain. We wanna try and support all of those tools or at least the major ones that we can. So if you wanna use cosine, we wanna support you to use cosine. If you wanna use notary, we wanna support you to use notary. We don't wanna pick a side. We wanna just offer you the option but also do both of those things not only easily, which that's one of Coverno's great hallmarks is being able to do all of this cool stuff but easily without having to write an esoteric language but also being able to keep up on top with the latest changes. Since this stuff is moving pretty quickly, we can't just hang our hats on a version that we did two years ago or what not two years ago, even two releases ago. We gotta keep up with this. We gotta make sure that we're staying current with the changes in the software supply chain ecosystem. We hope to get to some CLI refactoring. So Whitney, you asked a question like is that the Coverno CLI? Good question, it wasn't but Coverno does have a CLI as folks may or may not be aware.  So we wanna do some refactoring to fix some issues and to address some things in the CLI that will lead to a better user experience and make this more future-proof. So we hope to do that. Policy reports, we're gonna be making some changes to policy reports to hopefully make them consume less space and maybe a little bit more performant. A ton of work, by the way, has already gone into that process in Coverno 1.10. So if you were a user of previous versions and you upgrade to 1.10, again, please read the release notes in the migration guide if you intend to do that, but you may see quite a big boost in performance already in 1.10 with policy reports. Cleanup, we didn't talk about this because we didn't really make any changes in Coverno 1.10 but Coverno also has the ability to clean up resources very easily based upon a policy definition. That's been there in the previous release 1.9. We wanna take this to the next stage in 1.11 by allowing you to do things like individually label resources so that they can be tracked and picked up outside of a policy definition. So just more flexibility around that and also policy exceptions, which I did talk about policy exceptions and enhancements that we've made in 1.10. We wanna go further with this in 1.11 and I honestly can't remember what it is that we're supposed to be doing in 1.11 but we're gonna enhance it even further and make it better and it's still, I think we listed as currently alpha or maybe beta status and that's just because we wanna make sure it's really rock solid before we stamp it and send it out the door. So we're gonna make future changes to that in the next release and then hopefully get to that point sooner rather than later. So that is the Coverno 1.11 story in a nutshell along with what we've done in 1.10. We've got a couple of minutes left. Glad to take any questions or have any other future discussions. I really like the cleanup policy. I know it's in the space. There are some tools that help you group your resources to, in terms of application because Kubernetes doesn't natively provide that. So there are tools like Carvel Cap Controller or Crossplane to help you label every Kubernetes resource that's associated with the same application associate them with one another. So I can see how that combines with the cleanup policy. It could be very, very valuable. But yeah, that's absolutely true. And Coverno takes a couple steps further by not just looking at things like labels and other metadata but it can actually dive into the resource and then group them by whatever that you want. So a couple of use cases that we've seen around that that we've seen have been highly valuable are things like cleaning up bear pods. You know, like we launch a bear pod to do things like oh, we need to do a Qt control exec or we need to curl or something. But like typically happens, those things get left behind. Well, Coverno can find not just all pods that would be, you know, not useful but only the bear pods and clean those up or finding old resources. Things that maybe weren't labeled the same way but saying, hey, you know, I want to remove things that are older than two months or something. It can do that as a component of the cleanup policy. So we want to take that stuff further in the next release by doing it on an individual basis. This is kind of a funny question to ask is the very last thing. It probably should have been up at the beginning but like what are the most popular use cases or a couple of the most popular use cases you see for Coverno generally? Oh, there's so many, Jen, do you want to take a step at first? Yes, I think it's starting with simple stuff like pod security of course tends to be a top runner but even just proper hygiene and clusters like labeling and other things, right? So those tend to be very popular like Chip mentioned, generate policies. So just like clean up. It's necessary to generate a few things by default and that Coverno does a great job of too. And then of course supply chain security has become, you know, fairly prominent in a hot topic recently, yeah. So time is up, let's recap how people can get involved in where to go if they have further questions and also any parting statements y'all want to say? Sure, just a way to get in touch and get involved. So Whitney put a link out there to the community page and you can go and check out the Coverno community page on the website and you can be a contributor, you can join and just have a discussion. There are links from there jumping off points to all sorts of other locations, the developer docs, Slack, I mentioned several others. So that's a great place to get started. And, you know, if there are any other questions and for even more information, join the Coverno Slack channel that's on Kubernetes Slack. We've got more resources that are out there and we'll be glad to point you to anything else that you're interested in knowing. And we do have one quick question in chat and then we need to say goodbye, but is Coverno used much in OpenShift? Yes, it's a good question, yeah. Coverno is pretty heavily used. We see a lot of utilization in OpenShift environments, not just OpenShift, but a lot of the cloud providers as well. And also just by the way, Coverno actually has OpenShift policies that are pre-built in the policy library that are ready to go. So if you wanna use Coverno on OpenShift, there are some policies that you can just download and start to use right now, or at least like I mentioned, use them as a starting point to build or customize your own. And also do check out the docs because we have a separate docs section just for OpenShift users, some things that you might wanna know before you deploy Coverno in your OpenShift environment to have a good experience. So check out the docs, check out the policy library and come and talk to us on Slack if you have any other questions. I do like, you mentioned earlier, the extra work you put in to be tool agnostic and to not have opinions about what tools people wanna use to support as many as you can. So I think this is evidence of that. And I think that's a really cool thing you'll do. Thanks. All right, I think with that, we're gonna say goodbye. Thanks everyone for joining the latest episode of Cloud Native Live. It's great to have Chip and Jim here to talk about Coverno. We also really love the interaction and the questions and comments from you in the chats. And thank you everyone who watches the recording. So we bring you the latest in Cloud Native Code every Wednesday at this time, 11 a.m. Eastern. And that's all for today. Thank you so, so much. I appreciate you coming and sharing your knowledge and appreciate everyone watching. Thank you, goodbye. Thanks for having us. Bye.


Tonight we're going to have some quantum physics, so hold on to your hat, because Kansas is going bye-bye. But first, we're going to open up with, do you remember we watched that movie Frequency, where the father-son used the Northern Lights, the Aurelia Borealis, the Northern Lights to tune in and literally connect beyond generations. At the end of the movie, we were getting ready to shut it off, I said, no, leave that on, there was a song, and it was all about connecting in prayer. And Eric, in just a matter of minutes, has gone, got the song and it's now in the repertoire. So Eric's going to come up and perform the song, you'll remember it from the end of the movie Frequency, when the credits were coming. Along for the chorus, I hear your voice and it keeps me hanging on, and there's four more, but that'll be enough for now.


So I have this neck gate SG 5100 here and I know a bunch of people are going to ask so I'll mention that this is in a rack mount dot it that's their website rack mount kit and This particular one is because someone asked that to an SR dash t1 I don't know if they make this model anymore. We've had it But if you're interested in buying one of these I'll leave a link below to their Sider and affiliate link for it for Amazon. Anyways, we're gonna talk about transparent bridges and that's what we actually have set up right here now This is my control port as in my WAN which is plugged into the neck gate These two ports are the ones that we've got set up in the transparent bridge mode Opt one opt two is what you're gonna see them called in here And then we called the bridge the catwalk now. What is the transparent bridge? Well, essentially it acts like a switch port here You can actually tie more than two ports together and you can not recommend it Use PF sense as a switch and it can then monitor said switch and it does not have to provide any routing functionality in this mode, so you can actually set it up And that's why we're gonna have it set up today As a transparent bridge, which means there's no IPs that PF sense has assigned. We're simply observing transparently what's going on inside of here and we can apply firewall rules to it and we can even provide IDS or even packet sniffing going on here So we're gonna walk through the setup of it pretty straightforward and some of the things you can do with it Now, what's the use case for that is I like to say well, the use case is sometimes you have a reconnaissance mission, let's say and you are dealing with a Unusual situation where you need to observe the traffic But you don't want to be part of the traffic or being noticed being observed You just want to do some packet sniffing You want to do some IDS on it and maybe the equipment that the Client has that you're at on this engagement does not have the ability to do packet capture packet sniffing And you want to observe said device and see everywhere it goes but not alert the device and Letting it know that you're you know adding an extra layer of routing in there to it So of course you could route things through PF sense and just fully observe it That's the easy way and but sometimes there has been times when you want to Transparenly bridge because you want to see what something else is doing So you want to give it a say a public IP address on the internet But you don't want to have anything on the PF sense side Getting the public IP so you'd want to pass through but be able to observe So there are a couple of the use cases you might have for this Now let's dive into how it actually works and the setup of this.  Well, it's not really designed to do that And there are some performance concerns because you're kind of looping things around through it So it's not gonna even a basic general switch is gonna generally perform a little bit faster Than this this is more for observation network engineering less about building switches out of PF sense Which is actually switches are cheap So this is not the most practical use case if you wanted to but you can yes for those wondering build a switch And you do have all these protocol options. So, you know, you've got spanning tree in here Edgeport auto edgeport. I mean you can really go fine grain and really tune some of the settings in here So it's definitely pretty cool. If you wanted to go further beyond the scope of what we're going to talk about today Now once you've chose the two ports and like I said, we just made two members opt one opt two It's interface bridge zero next thing you want to do is go over here and go to assignments And I assigned it already called catwalk. So if it was in the list, I could have just added it But I signed it and called it the catwalk. Now, there's one more thing that you need to do Well, this is optional, but it makes it easier to do it this way We're going to go here to advanced and we're going to system tunables And there's a write up on PF sense about this as well. And we get to find it real quick We want to Follow this right here by default traffic is filtered on member interfaces not on a bridge interface itself This behavior may be changed by toggling toggling the values netlink pfi member And that's what we did over here. And that's what I wanted to let you know So zero but netlink pfi filter bridge packet filter on the bridge interface. Now. Why is that important? We go over here to firewall. We're going over here to the rules Now if you don't do this, you need to create the rules under the member interfaces the opt one or not two versus here This is where I prefer to create the rules because now I know I'm creating rules against the bridge itself And like I said, this is it's just an advanced setting So if you're creating bridges and the only time you need to do that is if you're creating bridges And you would set this therefore this bridge that we just named the catwalk Is an interface that's set up like any other interface right here And this is where you name it. It's Absolutely where you put all the rules now. You don't have to find other places to put it now Please know we can assign we can Be a member within this Setup so we could actually assign an ip address here if we want to do that's within the range For example, if you were doing it on the land And you can become a member and have ip participation in there if this is something you wanted But by default it doesn't need to have any And for what we're going to do here and show how sarah kata works with it You don't need an ip in this range So that's something To keep note of so what do we do now? All right, so you can see with no ip addresses here opt one opt two opt I don't know which one do I have an order in opt two is where the internet comes in not that it matters and opt One happens to be where my laptop is plugged in so once again My laptop is plugged in through here, but not it's not participating So to speak pf sense is not in the ip side of this but it does see and we're going to go over here to status And we'll go over to actually diagnostics and we'll look at the state tables and states And we have some states on here. We're going to look at specifically the catwalk states and the filter So you can see Everywhere that my system is going So one seven two sixty nine one seventeen That is the ip address of My laptop for my network interface. So it's one seven two sixteen sixty nine one seventeen and my wireless I put it on a separate network one nine two one six eight three dot eighteen I did this on purpose that way I can Access this remotely just we'll jump to the beginning real quick So you show the ip addresses because sometimes you look confused by all this The wan of the pf sense itself is on dot three network, but we're Doing the bridging across the one seven two network that way it's too distinctive network So I can see the different states that are in there and not get anything confused Yes, you could do it other ways. Um, i'm aware now One of the things we'll start out first is just talking about uh Sniffing packets a packet capture. So if we go over here and we go down to packet capture under diagnostics And we choose the catwalk interface We can i'm going to take the count to nothing here And uh address family cool. So we'll go ahead and start a packet capture And let's go just ping something This should go out over that interface because it should be the shortest path Hardwired versus wireless philogy wondering. Yes. I'm now because i'm connected to networks on my laptop I'm hoping it goes out that one we'll find out, but i'm feeling pretty confident. It will hit stop Hey, look we can see uh all the states that are down there Or actually you can go ahead and if we want to we can pull it in a wire shark, but you get the idea So Here is me pinging the one one and back and forth So now you can see with no ip's I just packet captured whatever date is on there And this is obviously really handy because then I can download capture Yes, we'll go ahead and open up a wire shark and now we can start diving into Wire sharking through anything that's going across this address here Now for those of you that may have noticed over here I actually have the tour browser open and yes, I pulled the cybertruck up because hey, why not? It seems to be a controversial topic We'll see how this pans out, but I am running this in the tour browser and That's one of the things I wanted to observe So we're going to go through and watch what tour browser does routing across that and with suricada So let's go ahead and uh, just get out of the way of this And actually that's what some of these suricada alerts are so how do we go a step further instead of suricada on here? So I went through just a standard Normal default install suricada updated the rules through my oink code in there to download the latest rule sets And uh, you can see that they're updated as of today saturday november 23rd So yes, we have the rules. We have the emerging threats and then we go over here to interfaces Now we're going to go ahead and edit this And what we chose was once again the catwalk interface because we have that where all the data is flowing That's the one we're going to observe. That's when we're managing the rules on for the bridge So we have suricada pointing at that what categories are we doing? Pretty much everything we just I just select it all I grabbed all the rules and said save I wanted to flag it It's only in IDS mode so intrusion detection mode not prevention as in it's no blocking turned on so we go over here settings now This is where there was a Bit of setup work that had to be done. So home net the default answer is default default And this is out of the box how suricada does this and what your default list is going to be Is ip's found on this router. So the land happens to be 192 168 690 the Wan because it's internal it's double-naded is 192 168 3 So it added those and say hey, these are the home net ones and we're going to observe only those therefore suricada would actually find nothing in terms of alerts you have to have And I call it catwatch a list made now there's two ways to do this You could make a list or you can add an ip in the range of the devices that you want to capture Because when you add a ip in the range you capture that will add to the home net automatically in suricada Therefore suricada will be able to observe the network traffic in there and apply its rules But instead because as you've seen we have nothing assigned to the catwalk. There is no IP range is in there you we actually do it this way And so i'm going to walk through we have a pass list And we have home net and how did I do that? Well, let's go ahead and edit this I just called it catwatch didn't give a description left this all at default And then we chose home net here What is home net? Well, that's an alias. So you actually first before you come to here We had to create an alias and how did I create the alias? So we'll walk it all the way back So I created a thing called home net and Because I know my laptop was going to be in the 172 range and I wanted to watch everything in a 172 range But I could have just filtered for specifically the 172 Dot 117 one that i'm using but I wanted all of them. So I did this Now by the way, I didn't type all these in if you're not aware you can do Typing in one ip and it'll create this so if you added a host and you typed in 192 dot 168 dot, you know 99.0 slash 24 when you hit save it'll generate all the other ones I don't want to do that again But you get idea these it's going to observe all the 172 addresses So once we have the alias created we're going to go back over here to sericata And we go over here to pass list We created this and then alias is if you're not familiar with how they work in pf sense, you can put them in You can look them up to find them Like check the box and save and it'll fill them in or I believe it this supports autocomplete Yeah, it autocompleted when I typed it in as well. So it'll fill in Kind of doing a back end look up for each one of the aliases you may have created So back over here to the interface Back over here to edit and Once again, we just set the home net here and that allows us to observe the alerts and things like that So what are the alerts? What do we have in here? Well, because I have tour running and one of the reasons I have tour running is so we can see this So we see each who et known torn relay blah blah blah and you can see a couple other things I was testing in here Um, just to create some noise to show that okay. Here's the things I observe I was actually going internally moving to the 172 69.4 address Now another reason you may want to use this transparent bridge is when you want to Just tap into and observe some network traffic because you think something type of attacks going on, but you don't Have access to it lateral movement wise and what I mean by that is if you have A network and it's not going through the routing of your pf sense. So it saracada doesn't see it saracada is not going to see Movement between subnets on the same range because there's no routing taken place But when you have a transparent bridge any traffic that passes through the bridge can be observed So it's another use case for this is if you want to observe local Land traffic that's not routed, but you do pass it through a bridge like we do here. You get the observations An insight into what's going on with these So that's another use case you can have for this the other option for doing is to be port mirroring That's a different video at another day Transparent bridging is what we're talking about today So this kind of gets you an idea of how to set it up and how to make it work. So what else can we do about this? Well, let's look at the firewall rules again And we're going to go ahead and look at the catwalk and right here we can see The states and the rules and this rule is a wide open rule So we have everything on here We actually have logging turned on as well because this is another advantage you have is you go I want to log all the traffic like I said, it's you're in observation mode But we also have protocol right now any any so let's go over here to the terminal and we're going to ping something <IP_ADDRESS> No, that's not payable. Let me find something that's payable 69.1 Oh, I got the wrong it's 16 69. There we go All right, now that I got my typos figured out 172 69 4 16 69.4 that is payable So we can see we have a seven packets transmitted no packet loss and that's because we have protocol any What if we only allowed? TCP and udp traffic, so we're going to head and hit save here And apply so know what we've done is now we've applied a rule And we've changed what a traffic has allowed to pass through this bridge So now we should be over here to ping and it should fail And because we disabled ICMP it don't work no more simple as that uh, so now we have Drop those packets now you can see how you can start creating specific rules and start changing things And you're doing it as essentially transparent firewall now So you're you know bridging the ports into similar ways to switch But now your transparent firewall is able to create rules and apply them to here And we could go further logging in log failed packets, etc, etc But like I said, this is a great way to get in dive into network engineering and observing things that are going across We can actually do the inverse here. We can allow ICMP And only but not allow for example tcp udp So there's another thing that you could do if you wanted to mess with it But there's obviously different you can dive into further like you only want to allow gerry or not allow gerry Other types of filtering that you can do here or create a whole set of rules And you create them all under like I said the catwalk option And then of course all the advanced things play out as well So if you wanted to dive further into playing with it or piping things in there or maybe doing some type of Cuing options, they would be all stuff you could do right here So we're going to end it save to just put it back to normal And apply the changes So it can get you an overview It's not that hard to do transparent bridging. It does have some certainly interesting use cases It's wonderful when you want to do network engineering work Where you want to be transparent and observe the traffic that's going across or apply rules to it Or you know set up a series of devices. There's four reports here. So four potential now Like I said before when you've come to the transfer speeds Normal switch port, you know normal gigabit switch port no problems gigabit when you're transferring between here That's where sometimes you can run in some problems And there's a lot of discussion in the forums about that people want to use their pf sensors as a managed switch Like I said, you can do that. But you may run into some bottleneck limitations This is not the fastest way because it's not dedicated designed for switching hardware This is you know pf sensors more designed for routing But when it comes to observational stuff Um in packet capturing and things like that This is a quick and easy way to do it and make this happen So I'll leave links to the documentation over on pf sense And make sure it's just plenty more to read on that But now they have some documentation themselves and how to set this up But now you get an idea of how to set this up With sarah kata and the transport bridging by the way, I will mention for those wondering. Yes, it does work with snort I just chose sarah kata because it seems like more people ask about it The only thing different with snort is I don't think you need to add the IP address ranges and snort because it doesn't have that home that I think by default snort will observe the traffic on the catwalk Bridge without anything. Um, I'd have to do some further testing on it But I did test with snort and it did work. Then I switched it back over to sarah kata It seems to be the more requested one. So I chose to do it that all right Thanks And thank you for making it to the end of the video If you like this video, please give it a thumbs up If you'd like to see more content from the channel hit the subscribe button and hit the bell icon If you like youtube to notify you when new videos come out If you'd like to hire us head over to laurance systems.com fill out our contact page And let us know what we can help you with and what projects you'd like us to work together on If you want to carry on the discussion head over to forums.laurancesystems.com Where we can carry on the discussion about this video other videos or other tech topics in general even suggestions for new videos They're accepted right there on our forums, which are free Also, if you like to help the channel out in other ways head over to our affiliate page We have a lot of great tech offers for you and once again, thanks for watching and see you next time


To get the best Madden team, go to instantmaddencoins.com. You can buy players, coins, and training directly to your account, and code MMG is 10% off. I actually can't believe I'm doing this, boys, but two wheel of months ago, I made a really insensitive joke. And after my management talked to me, a couple other people discussed why it's not funny with me, and I realized just how many people I affect by making these really offensive jokes.  And I know, you know, cancel calls, you blah, blah, blah, but honestly, like from the bottom of my heart, I can't believe I was making jokes like that and I thought they were funny. Really just in reference to that wheel of mud, you know, the one two days ago, you know what I'm talking about. I made a comment earlier tonight about Alopecia, that I'm deeply ashamed of. I am deeply ashamed of. I pride myself and think of myself as a man of faith. I pride myself and think of myself as a man of faith. As there's a drive into deep left field by Castellanos. As there's a drive into deep left field by Castellanos, it will be a home run. And that'll be a home run. So that'll make it a four-hole ball game. And guess what, maybe I will put this headset on again. You think I'd apologize for a joke I made? Are you kidding me? Look at the, look at this beautiful hair on my head. You think I, you haven't done it the other day? The only thing I apologize for is having beautiful luscious hair that grows on top of my head. That's the only thing I'll apologize for. Hey, what's good boys? The true final season kicked off to a hot start. We played a really solid Titans theme team and finally forced a rage quit with a monster hit stick fumble on the kicker turn from Devon White. What a beast. We also got some new players we haven't even seen yet. Since we got them from the rage quit spin. Got Ode Abushi, Danny Immondola, and Julio Jones Free Safety who is playing my cornerback three-slot. Big boy, I don't expect him to get moss so much. I'm excited. Ironically, I have Julio and DK as my corners. I have more wide receivers as corners than corners as corners. Anthony Barr, we did get one upgrade, but I'm hoping we can get a few more. I'm really glad I added the stipulation about TFLs because it helped us out. And we got me and Joe Green and Michael Pierce who we haven't seen yet either. All right, boys, so much to upgrade. It's so exciting at the start of a wheel of mud season. And I see whatever the wheel spin lands on because it just doesn't matter. It's gonna be great. Okay. I don't know if I've gotten this one this year. 2000 coins per yard with our PLP zone bubble. So whether it's rushing yards or passing yards we'll try and keep track. If I'm off by a yard or two, it's okay because we're just keeping mental notes of this, but I get 2000 coins. So I can't buy a player right now, but if we win, I can come back and get whoever I want. So we'll see on this one. Unfortunately, it does not help us right now. And we are in desperate need of a lot of different positions. So really not the spin we want right now, but it's gonna help us for sure if I get this. Oh my God, yes!  It's a gold mine. That is an actual gold mine. We have to win now. All right, to keep it fair though, I'm not gonna go five Ultimate Legends fantasy packs. I'm gonna go one of all the packs that are like available in the store right now. Brandon Spikes already amazing. This is already so good. We've got a left end. We've got a middle linebacker and we've got a backup halfback. Oh, shh. 95 Larry Wilson? I can't even use him. I have Julio. I literally can't use him. And I'm not gonna look at this one or I'm blocking it. Can't see it. Wide receiver that exists. And another heavy weight.  That's huge.  What a pack. I got a left guard. I got a 95 overall. Dude, a gigantic wide receiver.  All right, now we'll go to the Ultimate Legends pack. Keep it simple. Give me some positions I need. Jack Pascal, no. What? Wait, what did I just get? I've never even seen that animation before. Oh my God. William Perry?  I didn't even see what else was in that pack. Shit, there was more stuff in that pack. Oh my God. I just pulled an actual 98 Ultimate Legends. This is the best card on my team now. So I got William Perry, Pascal, Brandon Marshall. I also got another right guard. Oh my God. We'll go one Madden machines. Oh my God. Dude, I might actually run inside stuff. I've never ran inside stuff this year at all because I've never had an insane detackle, ever. He's literally the best card on my team. Michael Carter and we don't get a good Madden. 88 for him. Okay, nothing really usable in that one.  Now I'll go all pro fantasy and I'll see what else is available. Center is actually usable because I don't have a center at all right now. So he may be a 74, but he's still usable. Back up tight end. That's huge. And I guess Jamie Collins. Trey Waynes, Corey Lindsley, and a back guard. It's like all the positions I need right now. And I guess we'll close it out with a game changer pack. I didn't want it to be two OP and just go five Ultimate Legends, but you know what it worked? Cause we did that base, like Ultimate pack or whatever that thing was. And that's where we pulled the 98. Josh Allen, Derek Wajotuni, Kevin Malway, better center, much better center. Well, take your prediction. I think this will take us up to an 86 overall. That's my guess. No, I think it'll take us even higher, bro. We might be like an 88, 98 William Perry.  He's boosted to a nine. I have an actual 99 on my team right now other than Coupe Cup. Michael Pierce down here where Minjo Green was. And my Rush D Tackle obviously needs to be William Perry. I feel like we just give him inside stuff cause that's like what everybody runs, right? And then don't even look at it after that. Inside stuff. I'm actually also going to give him Reach Elite.  And you know what? I don't even got to move around any AP or nothing. I can just send it on him. So I got Richard Seymour right end and I got DeMarcus Lawrence left end. Defense looks good. We're at 85 overall. I haven't even touched offense yet. We're going to be at least an 88 overall after this.  It's not on the table. I cannot lose right now. Cameron Jordan left tackle 93 overall. I got a left guard, right? I got Andrew Norwell. And I also got a right guard. Okay, so I'll put one of my right guards at right tackle. All right, so Joe Thomas right tackle. Dude, oh my God. So we're in 88 overall and I haven't put in my head to tell Jones wide receiver yet. I also got a backup tight end, which was Hawkins socks. This is a six foot nine wide receiver. I also got Brandon Marshall, Joey Gallant. Oh, I got Ayuk. Yeah, let's go Ayuk. 94 speed on the 88 Ayuk. All right. Oh, I got Derek Hwan. I don't need Jacob Johnson. No scum kicks today, boys. DJ Hawkins winner.   That is so sick. The team is still not like cracked or anything.  You know what I mean? All right, Anthony Barb. We need a massive game out of you again, of course. So the challenge wheels can be massive here just in case I'm losing. Obviously I want to win. I'm going to try to win.  It's 40 fantasy points of one player. So the last time we had something similar was 30 fantasy points with the QB, but I almost might have had like 40 with Trey Lance. But that was Trey Lance who could scramble like crazy. Carson Palmer can still scramble not that much. There's William Perry. Welcome to the top three. Elite Omega. He's got Randall Cunningham. Trey about that is a Cowboys themed team. We played a Titans themed team first. I'm playing Cowboys. You know, I played Madden on that Jumbotron once. Might check this down to his half back. Whoa, whoa, whoa, whoa, whoa, there's a guy on him. I'm going QB Spy and playing underneath. Don't run it. Good. We just sacked him. William Perry, William Perry. How did we get that? I'm going with Anthony Barr. Oh, he rifles it over the middle. Good pass. Picked up a lot of that yardage back. If he goes corner out tight end, I might be in trouble. Oh, it's a cross or two. Oh, it's a slip screen. All right, we're guessing pass. I know this is a pass. Play action. Go get him. Go get him. No. These are all open. Oh! I was just about to say, I can't get there that fast with Anthony Barr. Just gave him too much time. He wants to go half back. Oh, he doesn't. That was super open. Feel like the best choice for 40 fantasy points is Bo Jackson. So we keep throwing the ball and this is PPR scoring for fantasy. Really nice to see him on Randery Gregory though. If he wants to do that the whole game, that is a sketchy pass. But dammit, it went through. Five man rush. Ooh, put it over his dome piece. See if we can hold this one up. Oh, yikes. There we go. Cooper Cup. He makes a good attack with Larry Wilson, but we're sitting at third and five. That's open. Oh, bad ball. Horrible ball. Oh, I like the pinch though. I respect that. That was a really bad pass. It was super open. I don't know. I might have just completely goofed that one. I really don't know.  Get ready for a pass. He's gonna roll out. Oh. Oh yes, no momentum. Oh, Shaun T, you gotta hit him a lot harder than that, buddy. Oh yes, sir. Horrible. We gotta come up with that, boys. We wanna win a game like this. We gotta come up with that. Right here. Little interception on the goal line. Really our only option. Throw back across to this. Oh, I saw it just a little bit too late. Oh, okay, a little run play. Oh, it's not. That would have been big. Big fumble right there. Hopefully we'll be in a position here where we can force field goal. Spectacular defense. Great defense, boys. Pen to zero, not fun. But if I score with no time, then get ball half. I still feel good. I don't think he's gonna cover the seam. Passes all the time. Is there something about Carson Palmer that I'm missing? I make these throws routinely. Oh, this is bad. I literally throw that like four times a game. That's same pass. Two, seven to 10. It ain't over till it's over. That is such good news, though. He's not unstoppable. I'm not playing a super sweater. This is a game I can win. Slip screen. Slip screen. Goal it, Anthony! Fantasy points, Bo Jackson, though. Let's make a good read, beautiful. Yes, sir. Yes, sir. Yes, sir! I wish I could have returned that with Anthony Barber. We jumped so high that he fell on the ground, which is unfortunate. Absolutely monstrous play. All right, a little bit of clock-chewage there. Bo gets a really nice push. 12 seconds on the clock. That's a touchdown, Bo Jackson. We are closer to those 40 fantasy points with Bo. Bo has a majority of my team's yards right now. It's definitely looking good.  Defense wins championships. If I can put this in, we can lock this game up. Like, if I put this in the end zone, not a field goal, end zone. Cooper Cup is so butt naked right open on this, I'm pretty sure. Oh, no, he's not. That's man. I forgot about my wheel spin with our field peaks on bubble.  I have to be using our field peaks on bubble. Third and 10. That is the throw I've been trying to make there in Waller that I, whoa, he's up on his feet. Nice. I got so many players in the 5,000 store packs I forgot. 2K per yard, our field peaks on bubble. Let's bring it out. And you know what? This is a PPR point for Bo Jackson. It actually works out really well. Does he follow? He follows. Oh my God. He could have just absolutely picked six to me. No question. Wait, he doesn't follow at that time. Uncool, but guess what? Michael Carter has got five yards. I've now got nine with our field peaks on bubble, which is 18K. Not a lot. He's not following. He's not following. Please block. Please block. Fourth and six. I'm gonna make a really, really ballsy play here. It's either Darren Waller or Bo Jackson. Bo was so open, I clicked the wrong button.  Bo was so open, it's not even funny. Since, yep, we're down there. We're down in there. No, what is that animation? Come on, come on. Somebody, yes sir. Fourth and one, do it again.  How? With the guy in his face, he just slings it and hits it. I can't believe he hit that.  Let's go. I wanna try the run. Oh my. He's so open. Great ball. Delayed blitz. Oh my God, you're so open. It's not even funny. Ayuk! I have had two tall Jones as a check-down and I'm pretty sure he's open. Yeah, he's there. Look at two tall. I've been sleeping on my 95 overall this whole time. That's exactly what I wanted. 21 to 17. I kinda wish that touched on a gone bow because I don't think I, I definitely don't have 40 fannies points of bow. He's having a good game. He's probably sitting at like 25 right now, maximum. Best case scenario, we get a stop here and we score a bow. Snaps it with one second. Almost a TFL. Actual handoff. Oh, good hit. I'm covering everything here.  All right, sweet. I like when he does that.  Let's go! We actually got a stop. That was PA boot over. It was.   I'm pretty sure this is how you can stop it. This isn't it. I don't know what he's running. Oh. Oh no. I don't know what he's gonna hit me with here. Rams, you could just end the game, you know that?  Just in case he's running PA boot over, I wanna be ready for it. Few different things he could throw here. Yes, sir. Matt Cap, you dog! You dog! It's the final season, baby. We win those. No challenge, real no rage-hit wheel, but we do get an Anthony Bar upgrade and we keep all the incredible players we added. That William Perry had an insane sack too. Look at that score graph. That is one of the coolest things ever. Two and O. I have the peaks on bubble thing. God, I forgot about it. I forgot about it again. I think I had nine yards with it. Guys, that was such a close game. I completely forgot. I had nine yards? Peaks on bubble? So I have 18K. I could probably get a decent right guard. Let me get, let me get Vi-tie. Let me get the lion. There's a Vi-tie. Holopool-a-Vadi Vi-tie. Holopool-a-Vadi Vi-tie. It's a tongue twister, but it's an 88 overall. And my nine yards on peaks on bubble got me that. If I had paid more attention to that peaks on bubble, I could have gotten an insane card. Guess what? I would have lost. I won that game by four points in the final seconds of the game. Two and O, so we got some wiggle room to lose some games. I don't plan on it, but we got some wiggle room. And I'm gonna call it for the video. William Perry stays, team clutched up. And that's gonna be an A, boys. I love you. Thanks for watching as always. I'll see you in the next video. Oh, Anthony Barr. In the middle of my outro. I remember my Anthony Barr upgrade.  But we're gonna get him there, bro. But all right, boys. That's it for today's episode. I hope you guys enjoyed and I will see you in the next one. Peace.


Okay, the question is that discernment question of the difference between the voice of for fear and the voice of love Initially I used I Used feelings I remember one time I was working through the course and Jesus said you know the one right use of judgment is how do you feel and I thought I I need to pay very close attention to that Because when I looked at the life of David, I said David's into intellectualism into denial repression and Though David feels some things David they spent an entire life at not feeling and now the course is saying You know the one right use of judgment is how do you feel? so the first problem was Okay, very good, but I don't feel I wish I could feel More intensely and more subtly and more be more sensitized to those feelings Because that's it like a barometer. I'd like a little touchstone of getting what's underneath so um, I started going through a process of Again with the preferences it was like Saying to Jesus how it's how am I going to feel now that I've spent decades at not feeling and Jesus just said well, we're going to use some of those things that you love the most about this world music so I was taken by Jesus to Get all this to go to the library go to different shops get this music and The emotions would just start to well up in me tears would start to come and I would listen to sort of music and Then after that long phase of working with the music Also, my dog chipper when I was younger Was like an unconditional loving Symbol I could pour out all the emotions So I think I saved thousands of years Working with this dog.  That was another huge way of getting in touch with emotions And then the movies I would have Jesus take me to the movies Not the movies that David would pick these were far from it I mean, I remember being guided to blockbuster videos sometimes and I would just say, okay I'm here only to be truly helpful. I'm here to heal guide me to the movie that would be best for me and I would go You've got to be kidding I Am not going to watch this violent movie or I am not going to watch this sad depressing movie No, I'm not going to watch another war story These war stories, you know the persona of David had very strong preferences in terms of movies as well as music and the guidance came in was a way of washing away and bringing up those emotions so that I could start to feel and I remember The other thing about David is not only was David shy But this shyness carried over into relationships David didn't go on his first date until He was 27 years old That's a bit extreme But there again that was David so I remember when I came across the course and was working with the course and it was in a relationship at 28 years old basically What I found was there was these intense emotions That had been pushed down out of awareness that were coming up now in the context of the relationship very intense I had graduate school and this relationship and Teaching assistantship going on at the same time and the combination of those three was like brought up an enormous amount of emotions and then I Would say that those were a Key block in being able to discern the spirit versus the ego That repression and denial was like just buffered me from being able to really tell the difference I wasn't sensitized So that process at some point I remember saying I can't see how people even function In this world with emotions this intense. They felt debilitating they felt like I felt like I was completely dysfunctional as a human being with the intensity I don't like I allowed myself to feel and it turned on a waterfall appears And I thought oh my god, I'm not gonna be able to turn this waterfall off I've unleashed this crying man and After all those years of being the stoic Man that doesn't cry the boy that doesn't cry I've turned on this giant waterfall and then That all turned out to be really important because I became much more sensitized to My feelings and when I wasn't in alignment with the stock systems So then when I was working with the course I also would hear things like from Jesus. The Holy Spirit never commands and never demands And I started to realize that there was a voice in my mind that was doing a lot of commanding and A lot of demanding it was quite stern It was quite serious Actually was pushy Very pushy and and I started to really feel like this is not the Holy Spirit The Holy Spirit never commands never demands most like these gentle suggestions Gentle like offering a plate of suggestions to me every day The Spirit was very soft and That's started my journey of starting to know the difference Because the ego is quite clever and it does disguise itself and it can even use affirmations and It can even quote the course You know it quotes scripture and If it had a face it would be smiling and kind of snickering like This works every time Get them with the Affirmations and vanity. I'm thinking that they're a spiritual person For holding on to these spiritual affirmations. It really was another trick So it's taking I would say a lot of fine-tuning over the years But it started off with me starting to really allow myself to feel Because without that I don't think The discernment could have unfolded at the speed Which it did it does remind me when I go down to South America because a lot of the women down there are so open-hearted It is there's just you could feel their hearts immediately and they pour out everything And then they seem to have a lot of partners and husbands that are already like the macho it's very like the bravado thing and that kind of macho bravado thing and trying to To stuff feelings down is one of the best ways that at locking your spiritual awakening It just shuts it off, you know, just really it's almost like a device. It's then keeps the unconscious mind buried and That's that is one of those questions of you could we could spend Easily the rest of the week just and we probably will with Gary's sessions in my sessions There'll be no pointers that will come in Increasing that discernment