Hey friends, Osiris here and in today's video I'm going to show you all the locations for every single baby Pokemon in Pokemon Legends Arceus. Okay we're going to start off in Jubilife Village and make our way to Obsidian Fieldlands. This is going to be the first place that we're going to hunt for the baby Pokemon. We'll start with the easy ones and then we'll move to the harder ones as we go through. So now we're in Obsidian Fields you can get quite a few baby Pokemon in this area. If we look at the Pokédex we're going to start with an easy one like I said and it's going to be Mime Junior now. There are two locations where it will spawn. There's a rarer one in Horseshoe Plains. It doesn't really spawn there too often and the more common spawn area is going to be the Sangam Flats which is where we are going to be looking for today. So if we just go to our map it's easier to get to from the Heights Camp so we'll just kind of transport ourselves over there and then what we can do from here is drop a pin down because it's right at the end of the Sangam Flats is where you're going to find Mime Junior. Mime Junior is one of the easier ones to find really. There are other baby Pokemon that are more difficult but the kind of common trend that you're going to see with most baby Pokemon are they spooked quite easily. If they spot you or you kind of fail to catch them they're quite prone to running away and you could lose the spawn and for the rarer ones that's super irritating and it can be quite tedious at times so having a lot of patience is a good thing when you're hunting baby Pokemon and they're definitely Pokemon that you're going to need to complete your Pokédex and in this area right here is where you're pretty much mostly guaranteed to always get Mime Junior now. I say this we're not going to get any today are we? We might need to go to the Horseshoe Plains and I'll eat my words for the more rarer spawn. We've got a Mr Mime there they cannot see in Mime Junior now if you just fly up a little bit and take a bird's eye view there is a Mime Junior right there so just in a different location so if we just land and then we kind of give ourselves a little bit of cover we'll be able to sneak up on it. Oh if you get lucky sometimes you're going to get them where they are asleep yeah this thing's sleeping so we can sneak right up on it look at it and like I say if you get lucky this is this is a perfect situation we did wake it up but if you're quick enough with the Pokéball you can catch it and then you've got yourself a Mime Junior like I said this area here on the map is the perfect location for Mime Junior all around the Sagan Flats is where you're going to get them they're pretty easy spawn you know they're a common spawn so they're not going to be super difficult to get a hold of okay next one in Obsidian Fields that we're going to go for is Munchlax now this is a much more difficult spawn and Deertrack Heights is where it kind of spawns normally and it is like I say a very difficult one and probably the more frustrating one of all of them so again if you want to just transport yourself back to Deertrack Heights this is where you're going to be able to kind of hunt it if you just turn around you'll see a tree here and a little clearing this is the way that you want to kind of make your way over to and we can come over the edge of a cliff here and what we can do it's going to be starlies here but we want to just be a little bit careful you can look from up above here we can kind of peek from around the corner because Munchlax will spawn in this area here now there are two cricketerps in this area so there's a method for kind of forcing the spawn or respawn this area and that's either by chasing the cricketerps off or battling them or catching them it's entirely up to yourself I think they're going to move I don't think they're going to move I think we're going to have to catch them this one's gone I think so that's all right okay so if that is the case and there's no Munchlax when you come around the corner like I say just kind of get rid of all the Pokemon in that area so what you can do now is we can take a look at the Pokedex and you can kind of see Munchlax when it likes to appear there's not really any favorite conditions it's going to appear in the morning in the afternoon evening and at night and pretty much most weather conditions it can spawn it's just got a very low spawn rate so if you've done what we just did we're going to change it until night and see if this does the trick and we're going to get the Munchlax spawn again and we kind of just repeat this process going from night to morning clearing out the Pokemon that are in this area and hope that the Munchlax at some point does spawn now like I say the spawn rate for Munchlax is pretty pretty low so it can take a long time for it to actually pop up in this area but you kind of have to be very careful because when it does you don't want to scare it off and it doesn't look like it's here this time no not this time right now morning again this is what I mean about having a bit of patience because it will take like I expect this to take a long time to spawn but when it's your kind of one of your last Pokemon for you to there we go it's there you can see it Munchlax is right there sneak up here we'll throw another berry but we'll try and throw it like behind it okay so it turns around we can sneak up on it and then we can do a back shot there we go okay so there are a few ways how to catch it you just need to be very careful and there we get the Munchlax so that's excellent right that's Munchlax and on the map this is where Munchlax is if we come in a bit closer you're gonna find it in this location using that method clearing out the spawn table and then when you have just changed day to night and at some point Munchlax will appear okay next Pokemon we're gonna go after is Pichu and I'm gonna show you exactly where I've had the best luck finding Pichu and every time I pretty much come to this area there's always been a Pichu there are other areas in nature's pantry that it can pop up but Pichu always appears down in this area for myself so if we again look at the Pokedex entry for Pichu it's gonna give you a few areas where Pichu can pop up in all of the areas on the Pokedex like the Pokedex does not lie the Pokedex has the areas where it will pop up but I do feel like there are certain areas where it will spawn like a bit more common than other areas floor as gardens and nature's pantry so we're gonna head down to nature's pantry right now okay so you want to just leave the highlands camp and pretty much just come straight down where this pin is and just nose bomb down here this mount here because you've got this ridge around the corner and you want to kind of duck around because when you come around this area here this is where the Pichu are normally located you want to kind of sneak into the grassland and just be very very sneaky stealthy when you're coming in here because you don't want to spook the Pichu they tend to spook super easy and if they get spooked they're gonna be hard to catch and it's gonna get more frustrating because they're a rare spawn anyway oh we've got a shiny we've got a shiny there's no Pichu here anyway oh here it is it is a cricketer I think and here's the shiny I've just caught a bunch of them that weren't shiny and there we go there's a shiny so if there's no Pichu in this area we get the shiny cricketer which is quite a nice bonus you want to just fly back we cleared the area you want to fly back to the height camps again and use that same process that we did with the munchlax let's see is this the moment of truth where the Pichu is going to spawn no Pichu here though oh there is there is a Pichu it's right over there pull another berry and it'll eat this one and it'll just get a little bit closer to you and then you can target it when it starts eating and then you can throw a pokeball at it and hopefully that's enough to catch it there we go and there's the Pichu so Pichu is in this location like I say it might take a few times but you are going to be able to catch it down in this area here it's right on the area of nature's pantry so this is the exact place where I've had a lot of luck where you can catch Pikachu as well if you're ever wondering about that Pokemon okay the next Pokemon we're gonna look at and baby Pokemon is going to be Hapini so Hapini appears throughout the Hesuian region but it does appear a few times in obsidian field lands and to catch it probably the best place that I've discovered to spawn it is the obsidian falls which is right over here and the Hapini normally appears on the path over here normally Hapini will appear around here if there isn't a Hapini at all that doesn't look like there is but again it's just the same process of being able to reset the counter table and then come back here and check and see if Hapini is around this area because it will be just around this area right here and on the map this is where it is located as you can see in the polka dex it's in a couple of areas it's an orbore or burrow tunnel which is right below us to come down here there will be a tunnel entrance and this will be orbore tunnel and you can kind of come into this tunnel here and just go through it and then sometimes I've never found a Hapini in here I've always found it on top of the tunnel but maybe today's the lucky day and I guess it's only going to be in one location there's a big kind of opening when you get to the middle the centerpiece of the tunnel oh and Hapini is here so okay if it's not on top of the mountain it's probably below the mountain so you need to be quite careful here I don't think I've got any smokeballs I don't really have any food left for it there we go okay no there's a match up okay we get the Hapini anyway that's fine there we get it okay that's good right well there the locations as I say right on the edge here of obsidian falls in orbore tunnel or on the top here is where we were before they're the two locations for Hapini and that is all of the baby pokemon that we're going to get access to in obsidian fields so we can head back from this location oh we got 19 pokemon oh we got the shiny we got the shiny krikotot as well on our journey so that was quite nice um so yeah they're all the baby pokemon from obsidian fields and now we're going to head up to the alabaster ice lens the first one we're going to go after in this area is going to be Riolu okay so the two places that Riolu does spawn is ice band falls and then the snowfall hot springs now the next place we're going to look is down in the ice band falls okay so I'm actually just gonna go back to the snowfields because it's super quick to get to from our base camp and we'll just fly across there through this tunnel and it'll take us to the other side where the falls are and then it's just down from here where Riolu does spawn and pretty much most of the time I don't think it might be a rare spawn but pretty much most of the time I've been down this way I've always had a lot of success getting Riolu so hopefully we have the same success here but seeing it we are recording so it might not always work out like that let's see right the grain cakes are what we want for Riolu and there we go you see it's just chilling just chilling on ice right here and we can probably do a backshot on it if we want you can sneak up on it you can feed it again if you want but this is the location on the map precisely here you can see this is where Riolu will always kind of be spawning if you were wondering let's feed it there we go nice we got Riolu that's good the other thing that we're going to say in this area is like I say this is the area for Riolu and the other thing that we can actually go hunt in this area is going to be Hippini again so Hippini does appear in this area and we'll just go back to the Pokedex entry for Hippini right Hippini or Avalanche Slopes is the other place that it does appear as well so what we'll do is like we're pretty close to it here so yeah what we can do is just put a pin down and we will make our way out of this area that's all these Elector Buzz oh Ellie kid as well that's another one Ellie kid quite happily along this path in the Avalanche Slopes Ellie kid appears as well most of the time there may be occasions where you're coming into not but then you can just kind of go back to camp go back to Jubilite come back or just reset the Pokemon in this area go back to camp changes the time of day and you're going to be able to get Ellie kid most of the time so what you can do is just kind of lure it in with some nice mushroom cake or one of the cakes that you're going to get probably going to get the Elector Buzz kind of coming over as well we can just pop an Ultra Bowl there and that should be there we go Ellie kid and like I say it's here on the map in the alabaster Iceland right here just between kind of Avalanche Slopes and Icebound Falls but this location on the map just pinpointed if you're wanting to know where it is and this is where Ellie kid is and now we will head to the Colbert Crosslands so what I'm going to do is just change the day until the morning the first one that we'll go for is the Eevee so Eevee as you can see it appears in a bunch of areas crossing Slopes is the area in Colbert Crosslands that it appears in that's down in this area crossing Slopes is down here and normally around this area is where I would find Eevee so we'll head down this area we'll just um we can fly I guess but it's just around not down here I've never really had much luck with it around this area the two spawn spots where I found it have been just up towards these trees now so if we dive down now but I don't know if we'll find it today because it is a very rare spawn spot and I mean I repeatedly when I was trying to catch Eevees had so many encounters or trying to get encounters of it and you know reset the table over and over again and it just didn't it just wouldn't spawn so it was very difficult to get it but I did catch it there a couple of times we'll pick up some beans because Eevee does love beans just in case it is around here so should just there we go okay it is there which is perfect for this example which is perfect so we want to just get ourselves into the grass again Eevee is one of those pokemon that's spooked very easily so we need to be pretty careful but we can select the beans that we just picked up and just drop them down and it should entice Eevee to kind of come over and um have a munch and if not we've got a bean cake as well this tangela is annoying can we get it without spooking the Eevee or this is not ideal we're gonna spook this Eevee it's gonna run away right there we go and we put this to bed hopefully we haven't scared that Eevee off but still there okay I think it's sleeping and this is the thing like Eevee will sleep so you can be quite stealth about sleeping up on it if not you can use food to get it but the best way to get it is always going to be like an actual ball this is super cute this Eevee bosh there we go this should get it hopefully it does if it doesn't there we go we got the Eevee and it is this location right here in overcoast land is where you get it and please that appeared when he came because at so many times where he'd come it wouldn't be here so it's normally here or it would be up on this ridge just here next this glamya and right here is the other place where you would get it okay so that's that done now the Togopee is the next one Togopee is located in the cobalt cobalt at Bathers Lagoon and Tranquility Cove so if we look on the map Bathers Lagoon Tranquility Cove is on the other side of Tranquility Cove is in here I've never come across a Togopee there but I have come across down in this area here okay so what we're going to do is go and look for Togopee and it is over in this area if we go on the map it is down in the kind of the Bathers Lagoon area so Hideaway Bay and it should be Bathers Lagoon in this area up here and it's normally in this like little alcohol up here so yeah there is the Ritogopee there I think it might be sleeping yeah it's sleeping at the minute we're getting quite lucky with all these pokemon sleeping so we'll try and catch it now but this is where Togopee is try and catch it this is where Togopee is like I say right in this area here this is the location where it's going to spawn just make sure it is daytime because if it is night it will not appear through the night I'll show you on the Pokedex in a second and there we go okay so here's Togopee's Pokedex entry as you can see it only appears in the daytime so morning afternoon or evening as soon as it gets to night time it's going to disappear so don't try and hunt for Togopee at the night and this is the location where you're going to get it so the next pokemon that we're going to actually look for is Mantike which is another baby pokemon it is classified as a baby pokemon and you're going to find it all around to include your being and like there we go okay on the map anywhere in this cove you're going to find you're going to find the um the mantikes and they're pretty easy to catch as well they're not a super difficult baby to catch but it's just known where they are and that one where has it gone there it is okay camouflage and when they're in the air there we go they're not too difficult to catch and there we go there's mantike like i say there's one behind us straight behind us as well so they're really quite popular pokemon easy to see they'll go under water then they'll fly up again you can get mantine here as well but that isn't a baby so that's not included in today's video um okay the next place that we need to head over for baby pokemon in this area is fire pit island which is a molten area so in this area we're here on the map i just moved my camera for a minute you'll be able to see a little bit better we're here on the map this is where we are in regards to cobalt coastland you'll know this because this is where you've got to come to fight the arcanine right but what you want to do is make your way down this path and there'll be a magmar first off and then there should be some magmies kicking around along this route it likes mushrooms honey grains beans all that sort of thing so we're good for feeding it i swear the baby pokemon are probably the trickiest pokemon to catch in the entire game to be honest because they're difficult to catch and they can run away pretty quickly so what we'll do now is we'll get our cake should we give it a bean cake it likes beans drop a bean cake out of this smoky barrage let it eat and then we'll pick it off and there we go magbie that's the location right here on fire spit island yeah that's pretty much it for the baby pokemon in this kind of region you've got piplup as well which is on the beach but it's more of a starter pokemon so not really going to count it here so the next place that we're going to head to is mount cornet okay now we're here at cornet highlands so we'll start with cleffer to start with you you're gonna need it to be night time for cleffer cleffer is a very very rare spawn and a difficult one to get it took me a long time to get it doesn't matter on the weather condition as long as it's night if we look here it will only appear at night time and as i said it doesn't matter about the weather it's down in fabled springs so that is down in this area right over here this is where we want to be heading so we'll put a pin down there is no quick way to get in here unfortunately so we'll just make our way across okay so we're pretty close as we come up to fabled springs now we want to just dive down onto this side of the bank is where i would suggest diving down cleferia pretty you know they're not they're not offended by you kind of walking around they're not really going to run away they might do they're not going to attack you though for one thing so they're pretty nice pokemon but on this side of the bank i wouldn't see you ever going to get cleffer like cleffer has never been on this side of the bank so we're going to have to cross over the river here you can get some big basculins in here but cleffer has always appeared to me beside this big alpha clefable if you didn't know there was an alpha clefable there is there is one here cleffer is normally around this area it doesn't look like there is a cleffer here on this occasion which is a little bit sad because it would have been nice but this is the location oh there could be there could be a cleffer there or is that a clefairy i think it's just a clefairy okay so what we'll do we'll try and clear out the table and then we'll go back to camp the hardest thing about this area is if you look on the map it is so far away from like every camp so it takes an absolute age to get here so resetting the table the encounter table here and then going back to camp changing to morning then tonight again can't disappear yeah there we go okay so it's gone right what we will do now is head back to the main camp and then we'll have to come back here after we change it to morning and then tonight right we are back in the area and i think there is i think that's one right there so let's just approach from this side i guess they have never found one on this side of the water i think because it's a baby they have kind of tendency to spawn in one area so it should be the same for you but i could be wrong and yeah there it is so we've got the cleffer spawning throw a bean cake out now try and lure it in it's eating and there we go there we are we got it so it is exactly in this area like i've just shown you friends this is where cleffer is okay so that wraps up this area what we need to do now is just head to the crimson mearlans we've got a few more baby pokemon to get and as we try to get bonzly in the mount cornet and we didn't have really much success i think that's the first one that we'll try here so we need to go to cloud pool ridge so if we fly cloud pool ridge and i think it's more here like right next to the we just pin this and then we'll fly up to the brava area okay so we're in cloud pool ridge now but we need to go down to this marker which is this direction here which is where bonzly and sudo woodyu normally kind of spawn in this kind of area down here so we just need to see it looks like is this a mass outbreak no it's not there's just a lot of gold bat activity going on around here right now so sudo woodyu down there let's see if we can just land it's going to pretend to be a tree and let's see if we can find ourselves a bonzly i don't think there's a bonzly anywhere around here because they're normally like i say with the baby pokemon they're normally in like one one kind of place and it would normally be around this kind of area here where the bonzly would spawn so um i don't think we're gonna have any luck here with the bonzly so what we'll do is we'll head back to the camp and we'll just make it morning the nice thing is because all the zoobat and gold bat are there kind of resets the table doesn't it so we should have a good chance of it kind of respawning so this is probably a better area than where we were before and mount cornet to get these pokemon okay we finally got the bonzly it is just up ahead here you can just see it we've got to be very careful the thing that it likes is crunchy salt so let's try and see if we can lure it with some crunchy salt and then there we go bonzly we have you there we are that's good that's awesome okay we got bonzly so this is the area where you're going to find bonzly in the crimson mea lands had a lot more success with it here than we did in um the coronet highlands which was a little bit tricky to say the least because it normally appears around celestic ruins there but you know sometimes it's just for speed of this video we can give you both locations but at least we got one of them and just for the sake of it we'll go after we'll show you but do i mentioned it in this video as well and it is whether i like it or not probably is a baby pokemon i don't know if it's officially classified as a baby pokemon but when everything you look at online it comes up as a baby pokemon so we will just pull it up right now and you can see it's in the golden lowlands and the great joe bog so there's two areas where you can get it and i think if your bog is here and the golden lowlands are here and i think if we just walk down here i think there'll be a bidu right here this is another reason why you know it isn't a massively difficult baby pokemon to get because they're quite available all the time but as you see you can just leave there and they're super easy to catch they do run away so you have to be careful because you don't want to spook them but there we go there's bidu and it's right by the camp so easy to get there's a couple of locations for it but there we go so no one can say anything if they think bidu is and i say it isn't but it probably is isn't it it is a baby pokemon i guess so there we go so friends that does it that wraps up today's video i hope you found this one useful i think because the baby pokemon are pretty rare and they're difficult to catch i'm hoping that the locations that we've shown you in today's video have been helpful for you completing your pokedex if they have been do consider dropping a like on the video it does really go a long way to help the channel out and if you like the content and you're wanting to see more of ledges auspicious coverage because we've got a lot more on the way then hit the subscribe button and make sure to turn on the notification bell thank you so much as always for tuning in friends have a great rest of your day until the next one take care and bye bye


My goal is to build knowledge in the construction industry. I chose this to get a few steps ahead in the plumbing industry. I chose the construction technology program because I wanted to build knowledge and get a few steps ahead. PCTI gave me the tools and knowledge I need to enhance and build my worth ethic. My name is Jake Sonny and I am a student of PCTI's School of Construction Plumbing.


What's up everybody? Jason here for jasperjasecasebrakes.com another sell-a-pack off the board 1920 Panini Prism sell-a-pack basketball one-pack break number 63 random teams and again another way to win two spots in our last basketball mixer So we randomized customer names and teams open up the sell-a-pack to distribute the hits then at the end of the break Randomize the list of customer names again in a separate dice roll And the top two names win a spot each in the three hundred eighty dollar last-dance basketball mixer. So good luck Let's roll it and we got a three and a six nine times. Good luck Jared down to Joey one two three four five six seven eight and nine Nine times Ryan down to James Let's go nine times Hawks down to the Wizards one two three four five six seven eight and nine nine times 76ers down to the Houston Rockets See those nine times All right on the 76ers Matthew the Magic Larry with the Wizards Danny the Blazers Lorel with the Bucks Matthew with the Cavs Nathaniel the Nets Clippers Larry with the Bulls James with the Hornets Joey with the Kings TJ The Grizzlies Lorel with the Pelicans Jared with the Heat Thomas with the Celtics Bart With the Pistons Brian Brian's our Knicks Marty with the Thunder Brian with the Raptors Larry with the Pacers Matthew with the Mavericks Larry with the Jazz Matthew the Tewos Jesse with the Hawks Joey with the Lakers James of the Wars Jesse with the Nuggets Drew with the Spurs Nathaniel the Suns and James with the Houston Rockets There you go. All right quick 20 30 seconds if any trades and I will stop start the break What up Logan? Hang in there man. I mean I wish I was at home chilling too, but I do love breaking all right chair We're gonna close guys Here you go. Little cello pack chair Colburn Justin Jackson Nice Logan. There you go. See seven days straight off nice Rui Tyler hero and beyond both and a jammer and look at that very nice red white and blue Memphis Grizzly is going to TJ Leonard. There you go. Boom. Boom. What up Jeremy? What's going on man? Alrighty guys awesome Base cards All right, let's switch teams guys. Good luck two more spots in the mixers been given away right now Roll the dice and we got a six and a five eleven times from Jared down to Joey one two three four five six seven eight nine ten and eleven Boom eleven times Good luck Thomas are And Ryan Bartow there you go Congratulations guys you guys are now in the mixer Now the cello pack coming up number 64 Jasper's case breaks calm


Good afternoon everyone and thank you for joining us. So for the next 30 minutes, we're going to talk about Kubernetes policy management So really excited to cover, you know, and we have quite a lot of topics prepared So we're going to start with some quick introductions talk about why you need policies and Kubernetes What Kubernetes policies are what types of policies are supported then we're going to go into some details about, you know specific policy recommendations, including pod security admissions or for also like talk a little bit about PSPs why they were deprecated and then go into Validating admission policies, which is a new type in Kubernetes Compare that with what dynamic admission controllers can do And also introduce cell, which is the language used by validating admission policies So quite a lot of topics to cover and we'll go through these and of course we'll try and save some time for questions and answers So happy to have the conversation So to start off with just some quick introductions on who we are and why we care about this subject So I'm Jim Begwadia co-founder CEO at Nirmata I'm a co-chair in the policy working group within CNCF also a maintainer on the Kivarno project Which is a CNCF policy engine And I'm Andy. I'm the CTO at Fairwinds I've been working in the cloud native space for about eight to ten years at this point I'm a maintainer of several open-source projects that you may be familiar with Goldilocks, Pluto, Polaris and Also a co-chair of the policy working group as of late last year All right So just to kick things off Introducing what we do in the policy working group and this is a community forum everybody's welcome to join We have bi-weekly meetings. So the charter of the working group is to define or at least catalog architectures different policy implementation types and provide some guidance on what users should use right so We've done things like the policy reporting API is one of the initiatives that came out of the policy working group There's a number of different producers and consumers including Kivarno, Falco, Trivi All of them can report policy results in a common structured manner and we're looking at other initiatives as we move forward Including like you know, of course white papers and things like we can do to help out again educate or inform the community So starting with what is a policy right? So there's a definition and one of the things we contributed from the working group There's a chapter on policies in the Kubernetes docs So you're very quite simply, you know what we think of as policies are configurations that manage other configurations or behaviors right and if you think about that a policy is nothing more than just another Config object a resource it could be a custom resource could be a built-in resource or some type of control You're providing which is defining behaviors for other things in your cluster or in what you're managing, right? There's a more formal NIST definition too, but it's very similar. It's talking about you know making sure you're managing expected behaviors and You know what we think about over here is it's not just about Restricting or validating checks, but you can also generate mutated full configuration lifecycle management, right? So why do we need policies we have config objects you can configure them you can manage them What's the value policies bring in? So the one thing to always think about with Kubernetes in many ways Kubernetes is the first platform Which really is built for developers operators security to all collaborate, right? It's a set of standard APIs where all of these roles can interact and the idea behind policies is if you have these shared Resources who's managing it? So if you have a pod or a deployment there's parts of the deployment that security might care about There's parts of the deployment the application developer cares about and there's other parts that the operator cares about So how do you bring all of these together and have them collaborate on the same? artifact or on the same resource and that's where policies can add a lot of value by providing that way to collaborate across those and But Kubernetes, you know, it's not designed to be secure by default. You need to add some Tooling some other ways to secure it Policies become in an ideal way for these various constraints to be applied Security teams to get the compliance and results they need whereas operations and development teams to be able to do their work Without stepping on each other's toes, right? So that's the main value and of course if you extend that to policy as code Why not use the same get ops and the other best practices we love in cloud native apply that to policies as well, right? Now you can do full life cycle management Manage your policies across clusters get, you know Reports things like that and even manage exceptions over but using the same Kubernetes APIs So in Kubernetes, there's four policy types, right? And this is Even as we were going through this and we added this to the Kubernetes docs took a while to classify this for main There's several other ways of configuring policies, but there's built-in objects like obviously network policy, right? So the name itself says policy So it defines what you can do on the networking side So it matches that description or definition we talked about So those are built-in objects and there's our back and several others which would qualify as policy objects Then you have admission controls and these are flags or these are configurations on the API server Which you can enable disable sometimes there's additional settings for these but things like you know If you want to have your default ingress class You can actually specify this on the API server and say yours my default ingress That will apply to all your cluster manage that configuration for you That is not in its different than dynamic admission controls Which is the next category where you have tools like you know a caverno or opa gatekeeper Which are not built into the API server, but they can receive requests from the API server and apply policies, right? And finally now we have validating admission policies, which is currently beta moving to graduation And that is also a built-in type So that allows you to now configure the API server with some customizable policy checks and we'll talk about that too So next Andy is gonna go over a timeline of how all of this happened. Yeah And before you all start squinting and trying to read that we're gonna break it down here in a second but we set out to write this talk and we Thought it started talking about like all the different historical pieces of policy Throughout the timeline of Kubernetes and even you know us in the policy working group We're like, oh when did that happen and when did that happen so we decided to put together this timeline to show Where we started and how far we've come and maybe talk a little bit about what's coming next So if we go all the way back Kubernetes 1.3, I think this might have been before I even started working on Kubernetes We had security context constraints. These are a thing in OpenShift. I actually didn't know what they were until about two weeks ago So we're gonna skip right over that And then we get into Kubernetes 1.3 and beyond in 2016 to 2018 and a few things start happening So we get our first policy engine accepted into the CNCF So this is when OPA went into the sandbox category and then PSP was introduced and became kind of the standard for a long time and we'll see that Throughout the rest of this timeline and that gave us granular control over lots of different settings in the pod And we were able to control it via RBAC and it was rather powerful, but it was kind of difficult to use So we step forward into the future 1.4 to 1.20 PSP was refined maligned hated People talked poorly about it. People didn't use it. People didn't adopt it. And so there was a cap introduced to talk about pod security admission and You know get us into the future and so that started becoming another thing that people wanted to talk about and OPA moved into the incubating status. So it started becoming much more popular and Coverno entered the scene into the CNCF and was released its GA release came about and then We got the policy report CRD from the policy working group in what is that? 2021 so That was kind of the formative time for what we see now as the current state of policy So then we step into the last few years and a lot of different stuff happened across all of these different projects So PSP was officially deprecated and removed from the API And then pod security admission moved into stable and then we started seeing validating admission policy So validating admission policy using the cell expression language is now in beta in the current versions of 1.20 1.28 and on and then Coverno just applied for graduation just last year and so it's becoming much more stable and OPA also graduated during this time So we're starting to see all of these different engines mature and the entry Policy engines mature as well Now what's going to happen this year and moving forward ideally Coverno will graduate At some point. We're not entirely certain when validating admission policy will move to stable and we'll also see An extension to validating admission policy, which will be mutating admission policy Which will allow us to mutate objects rather than just reject them and The policy working group is hoping to finish moving the policy report API definition Into a more stable state a more permanent home underneath sigoth So next let's talk a little bit about why PSPs got deprecated and you know what some of the challenges there were right and there's a great You know white paper article blog written by Tabitha who leads sick security in Kubernetes Where you know, they mention a lot of the usability challenges a lot of problems and they were prior You know Kubecon talks on this too and the main challenge was like Andy also mentioned that although everybody Understood why PSPs are important It was just hard to configure and use correctly especially at scale right and there were just too many variations Too many ways to trip yourself and misconfigure things Which is sort of the opposite of why you want a policy, right? You want policies to help with configuration not create more problems in your cluster, right? And diagnosing troubleshooting was also a major problem with this right so with The deprecation as this was being discussed in sigoth sick security a lot of people felt that yes We need some something basic in Kubernetes, but it's also time to acknowledge. There's other powerful policy engines There's other solutions So let them do some of the more complex things that are required and you know instead of just Sort of having these configuration objects. Let's think of this almost like a compliance standard, right? So if you look at PCI DSS or HIPAA or you know any compliance standard, it's a document It's well-defined. You can go and see exactly what you know you need to do So one thing which is great which emerged out of this all these discussions is pod security standards This is part of the Kubernetes docs itself It's maintained by the Kubernetes maintainers for every release of Kubernetes and it defines about 17 controls for pod security and and all of this everything we're talking about here is for the security context within pods, right? So within pods as well as containers inside of pods you can configure security context which various settings So these controls go into a lot of detail about what should be you know What's safe to configure or how you should configure them what the allowed values are and they evolve with new versions of Kubernetes You will see changes in this right so it's not Static it's not a one-time thing as Kubernetes evolves these standards also evolve So once you have these standards you can have multiple implementations and the entry Implementation of this is pod security admission and pod security admission the idea was let's provide again Something basic which you know can be easily enabled which may not cover all the use cases But at least it lets you to get to a secure default and the idea here was to you know I have three levels of privilege which of course allows everything But then you have a baseline which any known vulnerability any known issue or misconfiguration is covered by baseline and then Restricted which is the you know recommended way of running highly secure clusters To go into the restricted level of policy and and this allows you to set it very easily Just using labels at a namespace level so that you know again is super easy to configure But has some limitations and in the real world what we've seen is it often doesn't get used because it's only at the Namespace level and we'll talk a little bit more about this later Next Andy is going to go into validating admission policies and sell so We removed pod security policy and then we created pod security admission and Like Jim was saying it's not highly configured pod security admissions not configurable. It's not even highly configurable it's just not configurable and So we were relying on dynamic admission controllers to do all of our policy and then Some folks brought up the need to Write policy at admission time and some people wanted to do it in tree. So what we got out of that was this Validating admission policy. So validating admission policy uses cell. We've mentioned it a couple times. That's a common expression in language It's a relatively straightforward language for defining policy It requires bindings to bind the policy to a specific object or set of objects You can declare as a separate CRD Parameters that are used by that policy. So it is configurable per Namespace or per binding to allow you to modify how the policy behaves and as we mentioned before it's currently in beta Keep forgetting I have a clicker. All right, so If we look at sell how these policies are defined, it is fairly developer friendly. It's Sort of small. We'll get into that in a second It's very extensible. So there's quite a few different macros that are in the current implementation of validating admission policy That allow you to do fancy things like regex matching Optional types you can compare different types of insta gather and one of the interesting ones that I learned about recently is the authorizer so you can actually Check groups and users of the whoever's performing that admission action But really the issue with Cell that we see is that it gets rather verbose. This right here is just one check To say don't let the container run its route and the reason that it gets over both is because I have to check every single container I have to check and make sure that the run as root the Run as root section exists and then I also have to check the init containers separately So we end up with this very verbose policy for what is a relatively simple and straightforward check In Kubernetes, so we could split this into multiple Policies, but then we're running multiple checks against every object every time we do that and also here We don't get great error messages because right now it's like well One container in this pod somewhere is running this route But we don't know which one because we just had to run 12 checks as part of this single check So this is sell it's relatively straightforward to use for simple things It gets you a lot further than pod security admission But I think there's more improvement to be had here And then the next thing coming up on top of that is mutating emission policy So there's a cap out there for this. This is just kind of a side note here Currently in it's not even an alpha yet, right? Yeah, so it's coming hopefully in alpha in I think 1.31 possibly 1.32 So just keep an eye out for that So we put together this table to compare all of the different policy options and talk about You know what they're good at what they're not good at we've talked about this a little bit already But it's nice to see it all in one big table And so we've got you know the first column there with pod security admission We've got validating admission policy which gets you a little bit further It gives you more granular control. It's still built in just like PSA is And then you know, we've got a weird little symbol there for exception management to denote that Since validating admission policy is opt in not opt out Exception management is a little bit odd. So, you know, if we say this applies to every object in the cluster There's no way to opt a single workload out of it But you could write in a cell expression to You know exempt various workloads or pods or containers from your policy But then you're modifying your policy every time you need an exemption Which we've found across the various people that we talked to is not the ideal way You want to sort of have one solid policy that works all the time and then make your exceptions somewhere else and then None of the built-in controllers support the policy report API which the working group has published And neither of them work in in the CLI And so really what we end up at is dynamic admission controllers Still as kind of the de facto way to do all these things if you want to do them all I think Jim wants to talk a little bit more about some of the the other bits Yes, the one question that comes up often and you know, like Andy was describing is So you can do checks and sell but Validating admission policies do have some limitations to what they can check, right? So what exactly can you do and can you not do and when do you need dynamic admission controllers? So, you know, the the usual answer as well for more complex policies use Something like opa gatekeeper or caverno or other tools But if you kind of dig in a little bit into more detail Really the way to think about it is any policy That operates on a single object, which is the thing that's being changed Added mission controls you can write a cell expression to do that There's also built-in, you know, like andy was saying with the authorizer if you want to do Like a self-check review for you know access control You can do things like that because the kubernetes authors have put in extensions Into cell to allow that right, but you can't look up some other api object as part of your policy Classic example if you want to limit every namespace to a single load balancer You know opa or you know with drego or caverno can do that fairly easily With something like cell and validating admission policies you can't do that look up So that's one thing to think about anything that you know expands beyond the scope of that single admission control It's not possible to do in the you know with validating admission policy Other things like if you want to do image verification, right you want to check signatures You want to do that you can't you know now call an external registry to fetch the signature artifact and to compare that You it's not something validating admission policy will support It's not something you can want to do in the api server because of the latency and other things that it introduces, right Also, like of course with policy going back to the definition we started with If policies are configurations to manage other configurations the keyword they're being managed You want to think about the full lifecycle of configurations, right? So you want to be able to mutate which will you know again simple mutations will be allowed In the api server and but you want to do even complex mutations on existing resources, right? So let's say some api gets deprecated you want to write a mutate policy and you want to update it to a new group A new type why not write a policy for that? It's a great way of you know handling that Things also like you might want to generate resources when a new namespace is created Generate secure defaults generate fine grained rolls and roll bindings generate network policies So all of those things when you think about managing configuration are within the scope of policy management Which you know will not of course be handled within validating admission policy or the upcoming mutating admission policy You'll need external tools for that, right? So that those are some of the tradeoffs to think about as you're comparing these tools So ultimately, you know one of the things to think about is so you can use validating admission policies Then you should whenever possible, but you'll still need dynamic admission controllers So what is the best you know way to manage these and the good news here is both Kivirno as well as opa gatekeeper both cncf projects They're fully embracing and supporting validating admission policies So with the latest releases of these, you know, these policy engines They will generate and manage the life cycle of validating admission policies for you So you don't need to necessarily think about which one to choose And when to do what if you're using, you know gatekeeper and you use their way of you know declaring policies Wherever possible, they will execute that policy in the api server Same thing with Kivirno if you write Kivirno with sell It will automatically generate and manage the life cycle of validating admission policies As well as bindings Automatically for you so that these policies can execute in the api server Rather than receiving the web book Which you know is the normal way of processing policies in Kivirno, right? So gives a lot of power in terms of how you can kind of balance between those two Yeah, so just you know on that and there's a lot of discussion on So what are the challenges? Or why run something in the api server if i'm still gonna Use you know a dynamic admission controller, right? So why not just put everything there the problem with dynamic admission controllers is few things like first off Once dynamic admission controls came about It's like you know, they say if you have a hammer in your hand everything looks like a nail Every problem in kubernetes was solved by another dynamic admission controller Obviously not a good scenario where you have if you have a half a dozen Dynamic admission controllers running in your cluster all trying to mutate or validate things You are going to run into issues. So don't do that, right? Just pick one or two try to keep it as minimum as possible But as you're running dynamic admission controllers, these are Highly mission critical workloads. These are things which have to be managed carefully If you just take the default helm chart from any of these projects and slap it into your cluster And expect it to work in production. That's not going to happen, right? You need to tune this you need to understand what is happening in these controllers They receive like, you know in the very early days of even qverno Naively it was receiving every request from the api server and of course, you know keeping up with that It will you know, slow down your api request. It will impact other workloads So there's a lot of tuning that can be done with these projects And the way to think about it is it has to be a highly available highly secure Low latency type of workload and you want to minimize what goes to these dynamic admission controllers And do as much as possible in the api server itself, right? So and that's what both of these projects now are moving towards Is very fine-grained configuration of the web book configuration objects Which is where you can define which requests go to the you know, the dynamic admission controller like the qverno workload or the gatekeeper workload and which requests should be handled directly in the api server And you can tune that in many ways. There's also defaults of excluding certain namespaces One common problem like with coop system or your cni namespace If you have let's say for example qverno now Policing your you know coop system namespace or your cni namespace And if you're trying to do a cni upgrade that might get blocked now That will of course impact your cluster So to avoid things like that you want to make sure you have configured it correctly Based on your set of add-ons based on how you're managing qverno And you continue to monitor that right so there's a lot of metrics Even traceability in these projects which show you exactly what requests are being handled how much latency it takes for each So keeping these within milliseconds anything that goes over 10 milliseconds is a problem webbooks can also they have this failure mode called fail open and fail closed And basically what that means is How do you handle a failure fail open means? Well, even if there's a failure something unknown happens continue with the operation But the problem is you have to wait for 10 seconds for that failure to happen So let's say all your you know admission controller pods are down And you have to wait 10 seconds for each api request which should go there Of course, it's going to slow down other things right so these are things to be aware of And just use best practices much like you would with the database or with other Mission critical workloads you're going to apply best practices from monitoring managing that workload Apply the same for your dynamic admission controllers And try and keep them to a minimum in the sense again if you have too many of these It starts creating problems in your clusters Yeah, so just you know in terms of guidance and some of this we covered already so wherever possible Use what's built in right so start with that as validating admission policies are going to j If you haven't kind of started, you know experimenting with them start using them try out what can be done You can like in within the Kivano project. There's also a library of policies for everything for pod security You now there's a cell version of those as well So they can be executed directly in the api server So take a look at that or just take a look at other examples for what needs to be done And and then for you know as you kind of pick and choose different policy engines Figure out what applies best to your workloads to your use case But try and prefer tooling which automatically uses and leverages these tools right So again, there are other tools which may not know how to deal with the validating admission policy So then you're missing out on certain features coming in kubernetes Because all of this has to be now offloaded into some other Check or some other configuration tool right and for you know thinking about like other stuff like Applying things in pipelines so as much as you can if you're following get tops and if you're not you should be looking At just seeing how you can leverage get tops If you can apply these checks directly in your cica cd pipeline But then apply the same policy as well at admission controls and periodically as background checks Now you have defense in depth at every layer right so but at the earlier you can apply this the better So definitely executing some of these um, you know in your pipeline should be something you look at as well all right Now it's time for the audience participation part of the talk Um, we always like to do this when we talk with various folks And this is the biggest audience we get because people not this many people show up to the policy working group meetings So i'd love to ask a couple questions of the audience. How many of you in the audience by showing your hand Are using pod security admission in your workloads? I've got one two three four five people It's like Three percent of the room. All right. How many people are using some sort of dynamic admission controller? for their policy A lot more people. Sorry Sure Why not we still love python. There's nothing wrong with it um And how many people are using validating admission policies even though they're not ga yet Got one. All right How many of you are planning to use validating admission policies once they hit ga? Okay a few more a few more. All right Great. Um, and then Uh, we'd love to hear your questions. So if you have any questions, please raise your hand And also we'd love to see you know as a policy working group What you would like to hear from us next what you know, what can we do that's valuable for the community? And uh, you know, what guidance can we provide or what content can we put out? Or you know, is the policy report api useful? We love all that feedback We are going to be working on putting together a survey for the entire community So keep an eye out for that and please tell us all of your policy wants and woes Does anybody have any questions There's a microphone coming to you Thank you. Hello. Oh this worked immediately. Nice. Um So a question and a request so a question of We obviously like using a bunch of policy stuff of the three that you just said we don't use the alpha one, but we use the other two And We'll like apply things in the cicd pipeline But we also want to apply even earlier like shift left. We want to get it down to being like Our developers are writing java code. They get compile time errors. They write the yaml They get errors in their ide that say this is going to break the policy before they even commit Um, do you know if there's like further development within the policy tools for developing plugins for like vs code or IntelliJ or any other of the ide's that poppily used For hooking that in to make sure that policies can work There's one project that was attempting that and I Don't recall the name. I'll have to look it up But they were using a cli Both from keverno and gator, which is the gatekeeper cli to do almost exactly that To provide validations and those you know again vs code plugins, of course Can be developed so Both as long as you have a cli you should be able to do those type of validation checks and apply them as well Yeah, but I'll look up the thing and maybe try and post it at least in the you know policy working group slack sweet And then my thing for the future is like we use backstage and we See a lot of other people using backstage as well and getting those policy reports and things into backstage and visible for developers as well to see like Hey, maybe we're allowing things, but you have a bunch of stuff That's kind of a bit of a red flag that you should probably fix soon and getting that reports easily available So Similarly to vs code plugins is like backstage plugins and the tooling for visibility Would be amazing As just a general request to the room We will also be probably doing development work, but if anyone else is interested in that that would be really appreciated Yeah, I think that would be a great addition And then if anybody wants to come work on backstage plugin as part of the policy working group I'm sure we would be happy to talk about that I think we had a question over here Thank you both for the talk We've been using dynamic controllers now for probably three years and we've racked out perhaps 100 200 different policies mutating about a dating and generating and Now with vap I've not thought about it much But have you got a view as to whether we should start thinking about refactoring some of these Think about cl How do you see that? Tension between the two in a sense for someone who's already been doing this for a long time and has a body of policies already in in production Yeah, I think jman probably has a gradient So if you're not having any issues or problems with what you have does no You know necessary reason to change right so But at the same time if there are these any of these simpler checks which can be moved to the api server Think of it as offloading your dynamic admission controllers Executing these you know further down into the system. So you're just embedding it at the api server level So it really comes back to how expensive are your policies? Are you seeing issues in the workload? Which you want to offload and if you don't have any complaints or any challenges with that It's fine to stay as is No, no All right, we're being told we are out of time I think they're going to kick us out. So so we do have a session tomorrow, uh, there is a come like a meet and greet At 11 tomorrow So again, please stop by if you have any other questions If you want to know more about what we do in the policy working group or even join one of our future meetings Hope to see everybody there and thank you. Thanks everybody