Good morning everyone welcome to cloud native security con and welcome to our talk on what is zero trust Or what is the zero trust tunnel? We're gonna dive into ambient mesh and how We're able to provide a simpler approach to security operations with ambient mesh Come on work Go ahead. There we go. Hey. Good morning everyone. My name is Jim Barton. I'm a field engineer here in North America with solo And yeah happy to be here this morning Awesome, I'm Marina Wiget. I am a platform advocate at solo There's a lot of things you could do you could follow me if you want But one thing I will say is if you're kind of new to the Istio journey or the service mesh journey I run something called 70 days of service mesh and I'm doing this on github. You can follow along I basically will dive into various topics of the world of service mesh and an Istio and even application networking So go check that out But we're gonna dive right into it you might have heard of something called ambient mesh which was announced last year as a joint effort between solo and Google and What it really is is a new mode of operation Within Istio or within the Istio service mesh, which offers up a sidecarless approach So within Istio today You would normally deploy something called a sidecar resource alongside your your main application container because it behaves as the proxy to process requests process policies Provide a level of telemetry and whatnot, but there are certain Applications out there that don't really benefit from it and actually are hurt by it So for example sometimes you may be experiencing things like a race condition between one of your applications trying to come online Before a sidecar comes online, so you can't quite get Your application up and on and online so you have to tune this and set something like a there's a field called the hold Application timer within your deployment so that you can ensure that your sidecar comes up online first There's also some other elements like the server send first protocols like sequel and another you know data database style of Applications and they don't play nicely with the Istio service mesh with the sidecar or using any sort of sidecar for communications So this is where ambient mesh shines because it provides a an opportunity to simplify that operation altogether What that means is while you still get the the benefits and the capabilities of a service mesh The function of the sidecar shifts away from the actual application and moves towards two components We've actually broken this down into layer four and layer seven So the two components are known as the z-tunnel and the waypoint proxy that Z-tunnel what we're really here to talk about the zero-trust tunnel is what's doing a lot of the activity for Tunneling requests between one particular service over to another service maybe within the same node or another node now The reality here is that You know not all applications are going to require the sidecar some will require the sidecar But not only that what happens when you need some sort of layer seven style of policy So this is where that waypoint proxy comes in no effect here to basically come in and say let's Act on that policy whenever there is one that comes about we'll talk a little bit more about how that all flows but the mode of operation changes here the direction of traffic changes and This means that we can provide Istio or service mesh like capabilities for workloads that don't need the sidecar Whereas we can also provide it for workloads that do take advantage of the sidecar There's also some other interesting components around how we route traffic within let's say an ambient mesh environment So we deploy something called a CNI node pod that is Deployed as a daemon set alongside the z-tunnel the z-tunnel is also deployed as a daemon set Now if you've ever worked with IP sec before there's something interesting that goes on you have to define an access control List that tells the tunnel. Hey, this is the traffic. We're gonna encrypt This is the source traffic. We're gonna encrypt. This is how we also operate in the world of ambient mesh We have traffic that is tagged towards the z-tunnel pod that's gonna tunnel over to another node and Once we've identified what that traffic is it's encrypted. It's sent across the tunnel and it gets to its destination So the same process flows for when we're having to do this with let's say a waypoint proxy But we'll talk a little bit more about that shortly But when we look at it at a deeper level, we have two services service a and service be when I have traffic That's Dustin from service a to service be that traffic is gonna go towards the z-tunnel Which used to be the sidecar that z-tunnel will actually derive Identity from that workload and use it to form its end of MTLS The destination does the exact same. So now you have end-to-end MTLS between these z-tunnel pods This way when your traffic or your requests are going through they're gonna still maintain their their encryption all the way through to the destination now Actually, one other thing I will point out though is that this is strictly layer 4 So if I'm just doing strictly or for communications TCP or UDP style of communications Then I only need the z-tunnel object or the the z-tunnel pod that gets deployed per node when I need When I need layer 7 authorization, for example, this is where the waypoint proxy comes in We deploy this at the destination side so that as traffic is coming in or as layer 7 requests are coming in That waypoint proxy is supposed to sit there and analyze those requests And then we'll allow that request to flow through or deny it altogether or provide some sort of response to the originator Now the other interesting thing though about the waypoint proxy is that it actually makes use of the Gateway API spec in Kubernetes So you specify a gateway class which I think Jim is going to show you a little bit later on when we get into the demo and That acts as our enforcement point for layer 7 Now one other interesting thing about this is that the waypoint proxy still uses Envoy because Envoy is the most Performant layer 7 proxy that we know of and that we've used alongside Istio for a very very long time Now what are the benefits of using? Ambient mesh so you cut back on race conditions like I mentioned earlier on but then you also have to Think about this this idea of sidecar injection it no longer is there Which means that you can easily onboard services into a mesh without having to roll them out again and restart that deployment The other thing too is when you have to upgrade let's say a sidecar or now more specifically a z-tunnel You're not having to do this on a per pod basis. You just do this at the z-tunnel level So that way you're cutting back on your overall upgrade parameters in terms of how many objects you have to upgrade The other thing too is you're also limiting your blast radius overall in terms of who gets affected in terms of your configuration Let's just say you and you applied a configuration that accidentally applied to all of your sidecars now all of a sudden You've locked out all of your services and they cannot communicate with each other that could that could actually be thwarted with Something like ambient mesh and using the z-tunnel The other thing too is with respect to cost savings and resource consumption Because you're not deploying sidecar resources everywhere and only where you need it You're now consuming less CPU and memory and even not having to worry about the additional configuration that goes alongside those services and Then this all of this actually works to contribute to providing that zero trust network Now let's take a quick look at Things like how do we derive identity and what actually goes on with this tunneling? So like I previously showed you I have a service service a or app a that's trying to communicate with app B over on the right hand side Now we already know that because these two workloads are tagged for ambient based traffic or ambient based workloads We already know to put that traffic or that request into the z-tunnel and then encrypt it with MTLS The other thing though is that you know, what is this tunnel? Like where did this come tunnel come from? So there was a lot of engineering effort that went in to create this new overlay called H bone or the HTTP based overlay network encapsulation and what this provides is a TCP over HTTP mechanism so that you can carry your your requests over this Overlay network or this overlay tunnel and this is occurring from z-tunnel pod to z-tunnel pod So remember we deploy a z-tunnel pod at a daemon set level So if you're no sorry if your cluster your kubernetes cluster has you know ten nodes Each one of those nodes is going to get a z-tunnel pod Which means that each one of those z-tunnel pods is going to tunnel to each other when there is traffic going over that wire Now there's the element of identity Now the z-tunnel itself actually impersonates the identity of that workload So if app a is trying to communicate with app B Normally if we had the sidecar the sidecar itself would assume the identity Using that spiffy ID format and then you know would form its mtls And this would happen on the other end as well in the case of z-tunnel that Identity is actually derived from the actual workload itself. So the z-tunnel will impersonate that workload for that request flow Now this is also where we can apply our layer for authorization policy So if you're very familiar with how you can work with firewalls I look at this as more of a layer four layer three firewall because now I could just go ahead and say I'm gonna a certain set of Workloads have this label. We're really looking at it at a TCP IP layer We're not looking at it at any you know at layer seven So we can implement a kind of like a firewall policy to say this service can't talk to that service And we could do this repeatedly if we wanted to Now how does z-tunnel actually get the certificate? So z-tunnel will actually solicit the workloads for its service account token once it gets that it actually goes to Istio D the Istio D control plane and says hey I am I am actually a z-tunnel on this node and I'm trying to impersonate or I'm trying to Service this identity for this particular workload. Can you run through the certificate signing request for me and issue me a Certificate and say we're all good to go and once Istio D is able to authorize that and because of all the trust That's already built in says sure. Let's go ahead and do it It'll issue its identity for that particular workload and it'll do so for the other end and then we'll proceed to create that mTLS end-to-end or that mTLS encryption end-to-end Now if we have multiple workloads that same z-tunnel pod is going to service all of these different workloads that exist on Let's say that node and this you know, you might wonder okay What happens when we have many many kinds of workloads running well There are different ways to scale that we're investigating one thing I will point out Istio ambient mesh is still experimental It's not ready for production, but the reason I say that is because we're still testing. We're still scale testing We're still validating various kinds of use cases that we can achieve with with ambient mesh So in the failure scenario here, let's say that this z-tunnel pod went down What would happen? Well Kubernetes will try to reconcile that but why did that pod go down? Did the node go down did the node get disconnected from the actual network? There are a lot of different reasons and varying failure conditions that could have contributed to that failure now How am I doing for time I? Just want to make sure okay. Alright, cuz I got to make sure I gave Jim his time for his demo now in the situation Where I want to implement layer 7 authorization policies I have to deploy a waypoint proxy like I mentioned previous previously before what that means is I have to deploy a Gateway API resource Specifically for the waypoint proxy for the destination workload where I'm trying to communicate towards and then I'll go about creating my layer 7 authorization policy when I create that policy it could be you know Service a or app a can only communicate and make HTTB get requests towards app B But not delete requests and as long as that policy is put into you know into effect and and deployed What ends up happening is that z-tunnel pod on the source of that traffic? Will encrypt using mtls towards the waypoint proxy the waypoint proxy will derive the identity of the destination workload much like it Would do for the z-tunnel and then it would tunnel to the z-tunnels on the destination node And then that z-tunnel will unencrypt the traffic and then directed towards that final workload So the request flow changes a little bit because now you're having to go through another proxy But that's just because we want to enforce layer 7 There's three conditions that I want to talk about in terms of what happens when I have let's say an app compromise Let's say a proxy compromise or even a node compromise So app compromises can come from a variety of different scenarios Hey, I pulled down a container that I didn't realize was malicious and now it's in my environment That can contribute to your app compromise So maybe you need to be thinking about, you know, how do I prevent us from pulling down Containers that we shouldn't be pulling down and deploying into our environment when it comes to When it comes to the proxy itself The original sidecar proxy has so many different Ways to you know create policy ways to tune it there are a lot of different observability filters that you can tap into and This is great for the sidecar because it provides all of that functionality But one of the the biggest challenges here is these are all the different Points of attack or points of potential vulnerability. Now if we slim down that proxy to just Doing layer 4 and MTLS then we can remove all the additional features and we can just secure that surface area Significantly, so this way we have a smaller exposure area and we limit ourselves to you know, the attack surface all together And then there's the final piece of node compromise So node compromise is interesting because I get that question a lot. All right I have an app that's going to be talking to the z-tunnel to you know forward requests over that Communication between let's say that pod and that z-tunnel pod is not encrypted. Okay, that's great That's that's that's wonderful, but here's the other thing. Why does someone have access to your node? Why do they have root access? You know, this isn't this is more of a physical control situation This is more of a role-based access control situation Do you have those proper policies in place to prevent people from being able to even get into your node? Are you using secure operating systems or even secure distributions to run your clusters? So there are other considerations to think about other than the fact that app a and the z-tunnel don't have encrypted communications If someone gets you know access to your nodes, you're in a lot more trouble than what we're seeing here and With that that actually gives me the opportunity to pass it over to Jim to do that little demo. Thanks Jim All right. Thank you, Marino So I don't know about you, but I'm someone who really enjoys not just hearing about how things work But actually seeing how they work and so we're going to we're gonna do that here with with a brief demonstration of of ambient mesh in the in the time we have remaining and So we're actually going to start from the from the basically from the ground up Okay, we've done a little bit of pre installation here You can see we have a we have a kind cluster has four nodes on it there's a control plane node there are three worker nodes that are that that are active here and So what we've done is we've we've There's actually a script that goes along with this if you're interested in in learning more you can actually follow along with this Exercise and and do a lot more than just what we're going to accomplish here in the next 10 or 15 minutes By going to academy dot solo dot IO look for this ambient mesh course right here. It's all perfectly free and You can actually go through this exercise on your own time and and dive into it a little more Deeply so at this point. We have a we have a four node cluster that's here. We've deployed that And we have also we have also deployed Istio now at this point ambient is not the default mode for Istio was As Marino said ambient is still is still experimental It's one of the top priorities for the Istio community this year to to get it hardened and get it production ready But at this point it's not so so we've actually installed the ambient profile In in Istio which it gives us it gives us the the Istio D Control plane kind of core Istio capabilities It gives us an ingress gateway and also the CNI components that that that Marino mentioned that's responsible for redirecting traffic between the the worker the workloads and the and the Z tunnels that actually manage the layer for policy Policy enforcement. Okay, so we've we've done that. We've done that installation You can actually see the The pods that are that are available here. So here are the Here the Istio system pods you can see there's the Istio CNI node. It's deployed as a demon set So you can see we have one per node We also have the Z tunnel components that have been deployed as well now at this point They're not really doing anything because we have an activated ambient for any of our application workspaces But they're there. There's one deployed per node. They're ready to they're ready to go And you can also see we have deployed some workloads that we're going to be using in this exercise so to To accomplish that we're we have a little simulation of an e-commerce system You can see this diagram at the right. There are three components here. There's a web API There's a recommendation service and there is a purchase history service. Now these services aren't really real We're using a little framework called the fake service that allows us to just basically Test policy enforcement against the the communication as it happens across Across the different service boundaries and basically when you hit each service What you're going to get back is just a kind of an echo message that says hey You're in the purchase history service now and that sort of thing so that's That's our that's our application workload if you will we also have a couple of client pods that we have deployed here There's one call sleep and one call not sleep. You'll you'll see those be activated in just a bit Okay, we have also we're also using just standard Istio APIs to expose These workloads to the outside world if you're familiar with Istio, there's nothing there's nothing exotic or Unusual here at all. We're just using we basically have a we have a gateway component That we've defined that just says hey We're listening in on the host Istio explain.io on port 80 with HTTP And then we're also establishing a virtual service to route traffic It's intended for that domain to our web API Service which is kind of the the head of our the head of our application chain That we are using here Okay, so once we have once we have all of that in place We can do just some simple tests here So this is one. We're actually going to go through the through the gateway Through the Istio ingress gateway coming from outside the cluster It's going to route to the web API service which is in turn going to invoke all of the others In the chain and you can see that when we when we call that here There is our web API Response and you can see it makes some upstream calls one of those is the recommendation service the recommendation service in turn Makes a call upstream to the to the purchase history service So a pretty simple setup everything is working We have ambient installed on the cluster, but we've not really activated it yet And so that's what we're going to do Next so we will check that out everything should be good and We will move on All right to the next step so we're going to do a couple of things here first of all We're going to add services to the ambient mesh. You're going to see how the activation Takes place. We're going to look at some specific layer for authorization Policies just basic things that you can do that are a prop that are applied via the Z-tunnel Component and then finally we'll show you just a really quick example of a layer 7 Authorization policy as well. So let's let's kick off This this exercise and the first thing we want to do so we have the ambient profile of Istio installed But we've not activated it For any of our namespaces yet So what we're going to do we're going to label the default namespace which is where our web API Purchase history our e-commerce application Services are deployed and so once we label that what's going to happen is we're going to see We're going to see ambient mode be activated for the services in this in this workspace Specifically you can see that by taking a look at the logs of the CNI node We won't go into any detail here, but you can see it's recognized. Hey, we're setting up this default namespace You can see You can see where some routing rules are being defined here And that they're routes that are being added from the from the the source workloads and the target workloads to Their local their local z-tunnels, okay So the nice thing is we're not having to go and restart those components at all We're not having to inject A sidecar or anything like that, but you can see here for our application pods That we still have a single, you know, there's no sidecar injected There's there's no there aren't two containers that are active within those within those pods There's only a single one and in fact the z-tunnel is handling the The routing of the traffic, okay, so so once we have Established that kind of verified that the the CNI has is redirecting our our traffic Actually what we're what we're going to do is you'll see the What what what will happen is the traffic is going to look something like what's depicted in that diagram that It's very similar to what marino showed where we're gonna have a client app talking to its local z-tunnel it's going to establish an H-bone tunnel to a z-tunnel on the target machine and Then it will route traffic to the actual target services. Okay, so No sidecar is required. So if we generate some traffic now to this To this API service you can actually see what the z-tunnel is Is doing so if we take a look at the at the z-tunnel logs You can see here's here's the the HTTP connect tunnel that's that's being established here You can see some of the the spiffy IDs that indicate things like for example We're going from the you know like from the from the web API to the recommendation engine You can also see here at the very bottom a record where that we're capturing Outbound traffic and there's no waypoint proxy that is that's involved And that's because all we're doing here is we're just activating the layer for Component of the network right we're encrypting the traffic We're using we're using cryptographic identities to establish the connection between between the z-tunnels and the and the source the source and destination services But because there's no layer seven Policy that's being applied. We don't have to we don't have to have one of those Activated at this point so that's an important consideration for a lot of what we see customers who are adopting ambient mesh or adopting Istio they care primarily about the the security aspects of Securing the services within their mesh they don't necessarily need the full layer seven capabilities And so this gives you a way to Incrementally adopt just the components of Istio that you need without biting off the full The full layer seven model, okay, so we can see the traffic now going through the Through the z-tunnel and now let's actually Apply some policies to that to that traffic. So first we'll start with you know good zero trust foundation here We're gonna start with a policy that basically denies all Denies all traffic. Okay, so this is an allow Nothing authorization policy another thing you might notice is that the the Istio API's we're using standard Istio API's here The API's themselves have not Changed it's simply the way the Istio decontrol plane is is activating these policies is by programming You know z-tunnels and waypoint proxies as opposed to programming sidecars that are attached to each individual workload So once we establish that allow nothing authorization policy, we'll do the exact same operation We did before that worked fine and not surprisingly what's gonna happen is that request is going to be denied So we will expand out our authorization policy again using best, you know least privilege access sort of Practices will establish a suite of policies that basically authorize each link in that service chain So here is one for the for the web API component. It's going to allow It's going to allow requests that come from either this this sleep identity the sleep pod or from the Istio Ingress Gateway Component all right So and then in turn the next link in the chain the recommendation service is only going to allow Access from the web API Identity and finally the third link in the chain the purchase history component is only going to allow access from the recommendation service Okay, pretty straightforward stuff, but gives you a nice policy-based foundation for For establishing this sort of thing now. So now what do we expect to happen if we use that same? That same invocation again in this case Now we expect that it's going to work just fine because we've authorized each link in the in the service chain And in fact, that's exactly what you see. We're hitting web API We're hitting recommendation and we're hitting purchase history. Okay Now one final step here, and then I'll turn it back over to Marino to wrap up So We've talked about we've talked about the layer four policies how those are applied via the via the z-tunnel We can also apply layer seven policies for services for identities where that makes sense We can spin up the additional Infrastructure to to make that happen But we don't have to bite off on establishing that infrastructure for each and every Workload in the mesh. So in this case what we're going to do is we're going to establish a layer seven policy for this web API Identity okay, and so to do that we're going to first spin up a waypoint proxy Which is at this point just it's an envoy proxy just like just like the like sidecars are in Istio that It's actually going to be the policy enforcement point for for this policy. So all right What does the policy look like we're going to do well first of all, let's actually as Marino said We're going to use the gateway API to actually spin up that that waypoint proxy so you can see this gateway This gateway corresponds to the web API identity service account here, so let's Connection close the demo gods have struck I hate it when that happens All right Here we go. Did you offer your sacrifice to the demo gods this morning Marino? I forgot so that's that's probably what's going on here all right, so So all right, so we have we have established that gateway and If the gods are being kind to us we can look now and we should see that a Waypoint proxy corresponding to this web API service has indeed Been been spun up for us and now let's actually do something interesting so so far We've only been specifying policies that require layer for access Let's do something that that introduces a layer seven component an HTTP component So we're going to expand out the web API Policy so that now We're using we're allowing traffic from the same principles as before but we're only supporting HTTP get methods All right, so something that requires layer seven access to to be able to enforce So when we when we activate that policy now if we try to do the same thing that we did before This is going to work because we're issuing an HTTP get Against the against the web API. All right, and so that's all that's all fine. That works but if we Try to issue a delete request instead of a get request What do you expect to happen the policy is going to kick in and we're going to get an access denied? Message there you can also see we get back a because this is at the HTTP level. We also get back a nice HTTP 403 Forbidden code as well. So with that I'm going to shut down the demo and turn it back over to Marino to take us home All right working perfect. Thank you so much for the demo. Appreciate that Jim. Okay, so let's go back to the Is it I got hidden somewhere?  You're not having to restart it You actually tag your your namespace that you want it to be a part of the ambient mesh Environment and once you do so then the way point sorry then the z tunnels get deployed and then they start Looking for traffic destined towards other ambient mesh based workloads Now what this means is because we're you know operating with less sidecars that means there are less Resources consumed, but does that mean we lose any capability? No, because we've shifted that operation towards the z tunnel and the waypoint proxy if I want layer for authorization It's there layer seven. It's also there, but through that gateway API deployed waypoint proxy Finally, I wanted to just point out one very interesting thing here You might have noticed that the waypoint proxy as well as the z tunnel currently use implementations of envoy There is work being done today in the Istio community to change that that z tunnel proxy to be rust-based So that it could be far more performant It could also allow us to you know scale in different ways as well So you could go check that out There's actually if I'm not mistaken the Istio community has even got a branch for that that you can go check out and even test it Up for yourself to understand like what the performance might look like in fact I think one of the Istio contributors also created a very good document that just walks through the different Envoy a go-based proxy and a rust-based proxy and the different performance Metrics that come out of that as well Finally, I will say if you are if you are interested to play with ambient mesh in detail We have a lab that's available through solo Academy. Go check that out. It's academy.solo.io We have ambient ambient mesh based workshops. We also have Istio We have ebpf and psyllium so that you can learn the whole stack for application networking Also, if you want to continue that conversation about ambient mesh You have more questions if we're not able to answer them here obviously come visit us at G 18 We're we're in that expo hall somewhere, but you can't miss us so Let's open it up to questions and by the way We also have giveaways the ambient mesh book so we can give you some more details If you're if you have a plane ride home like I do this is great You can read it. You can read on the plane on the way home. So yeah come come ask us for one All right any questions Yes, go ahead So currently as it stands you can't at the moment only because there hasn't been any sort of I'd say Configuration or coding or programming for let's say the Istio see an iPod to direct that directly to the waypoint And in fact the waypoint is only meant to be deployed when you have to you know use layers of an authorization Most of the trip are all of the traffic should be flowing through the z-tunnel so that it can decide Do we want a tunnel towards a waypoint or directly to another z-tunnel so that we can Well, yeah, there could be other options specifically for Istio We've gone on the path of using the z-tunnel and then taking advantage of the each bone protocol that in fact if you go look at I think Istio one dot one six now supports if I'm not mistaken Don't quote me on this because I gotta go back and check now supports each bone to the sidecar as well so this means that There's more integration going towards this ambient mesh and non ambient based workloads that run the sidecar So the potential of you saying when you just mentioned hey, can we just go to the the waypoint? That could be a possibility and that's something that we could probably feed back to the Istio community to further develop So another question over here Intermediary yeah, that's right Okay, so my what I would say is we're not there yet. Well the Istio community is not there yet But that's definitely being investigated If we could do it with Istio today, I mean there's no reason we can do it with ambient mesh as well It's just we haven't gone down that path Envoy's SDS Yeah, I don't think that's available not today in the community yet. Yeah Any other questions? Awesome. Well, thank you very much for coming by appreciate your time. Thank you. Take care


Now as howling winds echo across the snow-covered reaches of the Wild Northwest, the Quaker Oaks Company makers of Quaker Puff Wheat and Quaker Puff Rice, the delicious cereal shot from guns. In cooperation with the Mutual Broadcasting System, present by special recording Sergeant Preston of the Yukon. It's Yukon King, swiftness and strongest lead dog of the Northwest, breaking the trail for Sergeant Preston of the Northwest Mounted Police in his relentless pursuit of lawbreakers. Gold, gold discovered in the Yukon, a stampede to the Klondike in the wild race for riches. Back to the days of the Gold Rush and the adventures of Sergeant Preston and his wondered-of Yukon King as they meet the challenge of the Yukon. Our adventure will begin in just a moment. A little thought a few moments of planning can change your whole existence. You can have security instead of worries about the future if you start now to invest regularly in United States savings bonds. For regular systematic saving, two plans have been set up for your convenience. The payroll savings plan where you work and the bond a month plan where you bank. With the payroll savings plan, you authorize your employer to set aside a certain sum each payday and invest the money in bonds for you. On the bond a month plan for those who are not on a payroll, you authorize your bank to issue bonds to you each month and charge the purchase price to your checking account. Bonds may be redeemed any time after two months at the purchase price plus interest. Remember, savings bonds are absolutely safe and are protected against loss, theft or destruction. Now even better, invest more in savings bonds. This message is brought to you as a public service. Sergeant Preston was riding along the banks of the Klondike River on his way back to Dawson City when he sighted a rider some distance ahead along the trail. The man's horse was followed by a pack mule laden with prospecting equipment. As Sergeant Preston drew closer, the man turned his head and the sergeant recognized him as Gil Dryden, a young mining engineer. Gil Dryden, come on, get up there fellow. Touching spurs to his horse, the sergeant galloped forward until he drew alongside the other rider. Easy boy, easy boy. Long time since I've seen you and King Sergeant. That's right Gil, not since last spring. How are you doing there, King? Still helping the sergeant enforce the law? Looks as though you've been doing some prospecting. Oh, I have. What's more, I made a strike. Oh, a strike and claim? Well, not yet. I want to make further surveys to locate the richest possible vein. Besides, if I were to file a claim now, it would start a rush. I don't want that to happen just yet. Not till I have lined up some backing for my own venture. You're not going to work the claim yourself. Oh, I can't without capital. The place where I made the strike is located in the mountains. You'll take the mining equipment to get the ore out. Then, of course, the ore will have to be refined. What do you intend to get the capital? From the Seward Mining and Development Corporation. Well, I thought you and BJ Seward didn't get along so well. That's true enough, Sergeant. O.B.J. is a self-made man. And he doesn't have much use for college-trained mining incidents. Not to mention the fact that he didn't approve of me courting his daughter. My financial rating wasn't satisfactory. But now that you've made a gold strike, it'll be a different story. Is that it? That's what I'm hoping, Sergeant. When he gets a look at these rich ore samples I've brought back, I think that attitude will change quite a bit. Anyway, I'll soon find out when we get to Dawson City.  After parting from the sergeant in Dawson City, Gil stabled his horse and packed mule and checked into the hotel. Then he went to call on BJ Seward and his daughter, Holly. Gil. Hello, Holly.  Come on in. Thanks. Oh, I see you have a visitor already. Flint Parker is hardly a visitor. He's Dad's mining supervisor. You two know each other, don't you? Oh, sure. We've met before. Howdy, Dryden. Hello, Parker. Strictly a business call, I suppose. As a matter of fact, it isn't. I came to see Miss Seward personally. Any objection? Wow, if you put it that way, we might... Now to see here, you two. If you can't at least be polite to each other, maybe you both better leave. I'm sorry, Holly. That's all right, Gil. Won't you sit down? Thanks. When did you get back to town? This afternoon. I just checked in at the Victoria Hotel. I was chasing rainbows again, I suppose. Call it that, if you like. Only this time I found the pot of gold. But you mean you made a strike? That's right. And a mighty rich one, too. Oh, Gil, that's wonderful. What about if you make your stay? Sorry, Parker, but I'm keeping that information to myself as I'm being... Well, at least it makes a good story to impress Miss Seward with. Are you implying that Gil might be lying? Oh, no, not at all, not at all. I just think your father's too sure to be taken in by a lot of empty talk. He'll want facts and proof before he backs any new mining ventures. Don't worry, he'll get both. I have a number of war samples in the detailed map of the district showing where I made the strike. Well, maybe so, maybe so. If you can convince Mr. Seward, that'll be good enough for me. Goodbye, Miss Halley. Goodbye. And in the meantime, don't believe everything Gil tried and tells you. A short time later, Flint Parker went to the office of a crooked mine broker named Cass Hinkley, who had amassed a fortune since the start of the Klondike rush in various shady mining deals. Hinkley, a portally bald-headed man with bulldog jowls, chewed a cold cigar as he listened to Parker state his business. Hinkley, a while back you made me a certain offer. That's right. I said I'd make it worth your while to tip me off in advance to any mining deals that DJ Seward was cooking up. To be exact, you said you'd cut me in 50-50 on the profit. I did. I did, and the offer still states. All right. Now, how would you like to get in on the ground floor of a new gold strike? Hmm? I'd like that real well, Parker. Real well, as who wouldn't. It'll take capital. Well, well, don't worry about that. I can supply plenty of capital if the deal looks good. Okay. Here's the dope. A young gent named Gil Dryden blew into town this afternoon, and I just found out he's made a rich gold strike. Whereabouts? I don't know yet. He's being cagey. But I found out that he's made a detailed map showing exactly where he made the strike. Well, this begins to sound interesting. Uh, you, uh, you have a couple of strong men in your payroll, haven't you? That's right. With D-Drexel and Pughatton. What's your plan? Dryden is staying at the Victoria Hotel. Your men can break in his room some time tonight, and they can hold it at the map before he turns it over to old man Seward. Heh, heh, heh, heh. They'll do it all right. That map will be in my hands before morning. And while they're at it, have them take his ore samples. Oh, why bother with that stuff? Because without the ore samples, Dryden may not be able to interest Seward in his proposition. I see. Which means you'll have no competition at all when you send a party out to stake a claim. Heh, heh, heh, heh, heh. It's a smart idea, Parker. Smart idea. Gil Dryden was a light sleeper. That night he awoke suddenly at the sound of footsteps moving about in the darkness of his hotel room. Hey, who's that? I forgot to put these away. Oh, soon for the sleeper-grip store. Like the lamp, Pug. Right. He's out cold. Yeah, but he may not stay that way long. Better tie him up and gag him with a bedsheet. Then we'll look for the map in the ore sample. Right. The next day, Sergeant Preston will see to that his desk in mounted police headquarters when Gil Dryden burst into the office. Gil, what's wrong? Plenty, Sergeant. I was robbed last night. Sit down and tell me. All right. It happened in my hotel room. I woke up during the night and heard someone moving around. Too dark to see anything? Well, too dark to see anything clearly, but there were evidently two of them. One of them hollered, look out, Swiftie, he's awake. And then the other one knocked me out with his gun. What did you come to? A couple of hours before morning. But they had me tied and gagged. I didn't get loose till just a little while ago when someone came around to make up the room. Anything valuable taken? Yes. My ore samples and the map showing where I made my gold strike. All right. Let's get back to the hotel room and see if we can pick up any clues. Come along, King. A short time later, the sergeant surveyed the scene of the robbery. The room had been thoroughly ransacked. The marks on the floor indicated the robbers had gained entrance by picking the lock of the door. But although the sergeant went over the room carefully, he was unable to find any clues that might help him track down the criminals. Have you done much talking in public about your strike? None at all. Why? I'm just wondering how many people knew about the map. Well, let's see. I told Holly Seward. I suppose she told her father when he got back to town last night. And then it... Hey, wait a minute. I'll bet Flint Parker is back of this robbery. Flint Parker? He's Seward's mining supervisor, isn't he? That's right. He was at Mr. Seward's house when I went there yesterday. He heard me tell about making a strike and he knew I had a map showing the location. Huh? Well, if Seward's right hand man, he'd find out eventually where you made your strike without stealing your map, wouldn't he? Sure. But if he felt like double-crossing Seward, he could sell that map for plenty of money. Besides, there may be another reason. What do you mean? Parker is in love with Holly Seward, and he hates me. He may have figured that by stealing the map and the ore samples, he could delay me in getting any financial backing. He might even try to jump my claim. Well, you'll be seeing Parker today? I suppose so. I'm going to have a talk with Mr. Seward, and no doubt Parker will sit in on the meeting. All right, now here's my plan. When you talk to them, let on at the map that was stolen wasn't the real map. Wasn't the real map? I don't understand. Say that you were afraid of being robbed, so you placed a fake map with the samples. Let on that you have the real map hidden away in some safe place, and you'll produce it later on. If Mr. Seward is interested in backing your mining method. No, I get it. You think that when Parker hears that, he'll make some kind of move to get hold of the other map? That's right, and when he does, we'll have the evidence we need to convict him. We'll continue our adventure in just a moment. Say, why aren't you fellas and girls out at the ballpark these days, watching those home runs walloped into the grandstands, eating peanuts, popcorn, and hot dogs? Come out to the ball game as guests of a major or minor league team. All over the country, kids 12 years or younger are seeing major or minor league games free.  You'll find two free baseball tickets inside Quaker Packo 10. Names of teams and dates are on every ticket. So be guests of your favorite team at the ballpark. Brush to the storm with your mom and grab free baseball ticket packages of Quaker Puff Wheat or Rice, Muffet Shredded Wheat, or Quaker Packo 10, which has two free tickets. The more packages of these delicious Quaker cereals you get, the more free baseball tickets you get. To continue, after listening and agreeing to the sergeant's plan for trapping the thieves who had stolen his map and door samples, Gil Dryden had gone to call on B.J. Seward, the man he hoped would back his mining venture. Holly Seward and the mining supervisor, Flint Parker, looked on with interest as Seward spoke to Gil. Well, Dryden, my daughter tells me you've made a gold strike and you have a business proposition to talk over with me. Yes, sir, that's right. I've located a ripped deposit of gold-bearing ore, but it will take capital to exploit the deposit. That's why I've come to you. Yes, how do you figure on going here at this venture? Well, first of all, a survey party should be sent out to state the best possible strike and plan the mining procedure. After that, we can decide on the necessary equipment and estimate the cost of operation. I see. And just how big a share of the mining you prepared to offer in exchange for my capital? Fifty percent. Fifty-fifty, eh? Well, I might be willing to agree to those terms if the venture looks profitable. Now then, I understand you brought back some ore samples. That's right, I did. You have them with you. No, sir. Unfortunately, I was robbed. Robbed? You mean your samples were stolen? Yes. You? Have you gone to the police? Yes, but they weren't able to find any clues to who did it. You know what I mean?  I suppose your map was stolen, too. Oh, no. That's where you're wrong. A map was stolen, but not the real one. What do you mean? I've been afraid all along that someone might get wind of my strike and try to rob me. So I purposely made a plate map and placed it with the ore samples. That's the map that was stolen. What about the real map? Oh, I have it stored away in a safe place. Well, Dryden, I don't know what to say. Without having seen your ore samples, it's difficult to give you a decision. Oh, but Dad, surely you can take your word about the richness of the ore? When it comes to backing a mining venture, I'd be afraid to rely on my own judgment not to someone else's. You mean the deal is off? Let me think it over. Come back tomorrow and I'll give you a definite answer. As soon as the discussion broke up, Prince Parker hurried straight to the office of Cass Hinkley. Well, what's wrong with you, Pa? I'll tell you what's wrong. That map your men stole last night is a fake. Fake? What do you mean? Dryden was too smart for it. He figured somebody might try to rob him. So he drew up a phony map, kept it along with the ore samples. That's the map we got hold of. What about the real map? He told Stuart he has it hidden away in some safe place. And what's more, if Stuart could decide to back him, he'll turn over the map for him tomorrow. That's the case. We'll have to act fast. Meaning what? We'll have to find out where the map is hidden. Get a hold of it tonight. And just how do you expect to do that? I think Dryden can be made to talk. Providing pardon swiftly, apply a little persuasion. Just leave the details to me. I'll handle it. At that same moment, Gil Dryden was speaking to Sergeant Preston at Mount Police Headquarters. Well, Sergeant, I did just as he told me. I pretended the stolen map was a fake and told him I had the real map hidden away in a safe place. How did Prince Parker search the memory? Oh, it hit him right between the eyes. And the way he reacted, I don't think there's any doubt that he was behind that robbery last night. Well, that remains to be seen. Oh, what's the next move? For the moment, just sit tight and wait. If Parker is guilty, we may soon learn who is the confidant. Well, how's that? Nobody thinks that last night's robbery was a failure. He'll want to report that news to whomever he's working with. Anyway, that's what I'm hoping. I told Constable Ross to follow him and see where he goes. Good idea. Oh, it's Constable Ross now. What'd you find out, Alex? A set of setting, Parker, as soon as he left Stuart's place. Went to the office of that mine broker, Cair Sinkley. Cair Sinkley, eh? Know anything about him, Sergeant? I know he's made a lot of money by shady mining deals. Sade is right. What they say has been gilly of everything from claim-jumping to selling solid mines. Yes, he's the solid manager, as any means, to get advance information on a new gold strike. In other words, just the sort of man Parker might have made a deal with. That's right. How soon do you think they'll make another move? Probably not before tonight. Will you be away from your hotel any time after that? Yes, as Holly Stuart invited me over to dinner tonight. Parker will be there, too. Oh, thanks as though you were suspecting nothing. I'll see what happens. That night, a guilt-riding was returning to his hotel. A sinister figure detached itself in the shadows and fell into step behind him. Before guilt could turn around to investigate, a menacing voice wrapped out a sharp warning.  What's the idea? You'll find out if he's walking straight ahead. And don't try hollering for help unless you want to stop a bullet. I'll tell you where to go. Gail asked no further questions and made no effort to escape. But simply followed the directions which the man behind him issued from time to time. Their destination proved to be a ram-sackled cabin on the northern outskirts of Dawson City. A glow of candlelight was visible through the window. All right, go on inside. Remember what I told you about not turning around. As Gail entered the cabin, he saw a man seated at a table with a bandana tied over the lower half of his face. Well, well, well, you brought him here safe and sound, don't you? Keep him covered. I'll tie a handkerchief on my face. A moment later, when the first gunman had adjusted his bandana, he drew his gun again and said, All right, Gridy, I'll sit on in that chair. Yeah, better circle and make sure he's not packing a gun. All right, good idea. Clean. I'll tell me you've been to tell me what this is all about. I'll tell you right now. We aim to get our hands on that mat showing the location of your gold skirt. Oh, you got it hidden. Sorry, boys, but you're too late. That map was stolen from my hotel room last night.  That map is a fake. You got the real one hidden somewhere. Who told you that? We're asking that question, driving you to Sanford. Okay, looks like you're holding all the acres. The map taken from my room was a fake.  Suppose anything you like. What we want to know is where's the real map? If I don't feel like telling you, you'll be making a mistake. Sorry, but I'm not talking.  I'm still not talking. You will sooner or later. Don't worry. All right, tug time up. We'll go to work at it. As tug picked up a coil of rope that was lying on the table, the door suddenly burst open. What? I don't want you to drop your gun. All right, all right, I'm reaching, ain't I? Me too, Monty. Don't shoot. I'm a shooting club. I think you knocked the gun right out of the scene. Yes, and I imagine it hurts. All right, Alex, take the gun. Right, Sergeant. Where in blazes do you two Marley come from? We expected someone to make a move against Dryden tonight, so we kept him under surveillance. When your partner picked him up, we bailed him here to the cabin. Did you hear what was said before you got in the cabin, Sergeant? Yes, we heard it all. We were listening outside the door.  And kept them, Alex, till I keep them covered. All right. We'll continue our adventure in just a moment. The bases are loaded. It's the last of the lines. Here comes the pick. He's playing. Be right there in the ballpark and see a grand slam hold run. Come out to the ballpark this very week as guests of a major or minor league team. Walk right through the gate three if you are 12 years or younger and bring mom or dad or another paying adult. It's so easy to get a free baseball ticket. It's right inside a package of Quaker Pop Week, Quaker Pop Rice and Muffet-Treaded Week. You get two free tickets in Quaker Packer 10. The ticket tells you the names of the teams and the dates. Don't miss out on the fun another day. Bring the whole family. Remember, no mailing, no waiting. You can get as many free baseball tickets as you want. They're inside packages of Quaker Pop Week or Pop Rice, Muffet-Treaded Week or Quaker Packer 10. Get yours right away. Now to continue. A few minutes later, when the prisoners had been handcuffed, Constable Ross removed their bandanas. He made suit jaspers around town, Sergeant. That's all right. What's your name, Missing? Poghatton. I'm your partner's name, Swissy. What? Yeah. How did you know?    You can't prove that. We won't have to. What you've done tonight will be enough to put you behind bars for several years. Who hired you to get hold of Gil Dryden's matter? Wouldn't you like to know? Who's a matter of fact, I think I do. It's Cass Hinkley. Cass? Hey, maybe we'd better come clean, Swissy.  We've done enough talking already. If you're counting on Hinkley to get you out of this, you'd better think twice. You'll go to prison no matter how many smart lawyers he has for you. We'll take our chances. Suit yourself. All right. They may as well take you through to jail and we'll go play a visit to Cass Hinkley. A short time later, Flint Parker was emerging from a café when he caught sight of the two Maldives and Gil Dryden escorting the prisoners to jail. He ducked back inside hastily, waited until they had passed by. Then he hurried to give the news to Cass Hinkley. All right, I'm sorry. Mark, let me in quick. What's the blazes you used to work up about? Listen, Hinkley, the game's up. What are you talking about? The Monies have arrested Poggin, Swissy. What's that? I just saw Sergeant Preston haul them off to jail. Gil Dryden was with them. Good heaven. Suppose they've squealed on it? I don't know, but we'll soon find out. Poggin, Swissy have talked. The Monies are soon to be coming around or outside. There's no doubt about that. We'd better clear out while we have a chance. Don't be foolish.  We might be able to make it to the border. We'll wait till they come around to nab us. We'll have no chance at all. We will if we're ready for them. What do you mean? You have a gun. Not on me, why? Wait a minute. There. Take this. I'm carrying one my shoulder holds. What's the idea? We'll wait here for a couple of hours and see what happens. If the Maldives come around, we'll know the digs up. What then? We'll go to enter the door. You step down behind the place. As soon as they walk into the room, you cover them with that gun I just gave you. I'll take over from there. A short time later, the two men heard a knock at the door. Maybe the Monies now. Go on over and get behind the stand. Yeah, all right. That's impressed them. That's right, and this is Gil Dryden. The man who's Matthew and Parker was so anxious to get hold of. Why, I don't know what you're talking about. Never mind bluffing, Hinkley. Come on, Gil. Get your hands up over there, Prince Parker. Yeah. A little surprise, you gentlemen are expecting. Watch that door, Preston. Don't let them make any sudden moves. Very good. Parker, my advice is to put down that gun. Don't make me laugh. In case you two don't know it, Twisty and Pug are behind bars. You always know it. I saw you hauling them off the jail. That's how we happened to plan their trap for you. You walked right in. Oh, McComber, you two were the ones who walked into a trap. What do you mean? There was no need to send Twisty and Pug out to Gil Dryden tonight. That map they stole from his hotel room was the real thing. Real thing? I told Gil to pretend it was a fake just to lure you into making another move. Hey, what'd you do with that map, Hinkley? Don't worry, I didn't destroy it. It's still here in my safe along with your samples. Not that it'll do Preston any good. Thanks for the information. Alex! Prince Parker! Now get him! The constable fired first, drilling Parker in the air. Hinkley was already tripping his gun out of a colster. The sergeant Preston saw the move. The mine broke a reel back under Preston's blow, but he didn't let go of his gun. He thought he could pull the trigger, King was on top of him. He sees the cook's wrist in his powerful jaws, forcing him to drop the gun. Get him away from me, Preston! I'll go him all the way! Oh, King, let him out the way. I hope it'll ever make you something about my arm. It's broken. No pointing, Parker. I'll attend to your arm as soon as possible. You and Hinkley are under arrest in the name of the Crown.  Because I had no definite proof that you were back of the attempt to rob Gildriden? What do you mean? You mean that Swifty and Parker didn't squeal on us? That's right. The only way to prove you were guilty was to let you convict yourself. As it turned out, you and Parker were all set to apply. Well, I'm glad you found out what they did with the map in the ore sample, sergeant. Now I'll be able to get the backing I need for Mr. Sewer. Yes, Gildr. And those same items will provide the final evidence we need to send these cooks to prison and mark this case closed. We'll return in just a moment for the word about our next exciting adventure. There's warring adventure on mutual. Tales that will take your breath away and transport you into lands where danger is your constant companion. First, we take you far up into the barren Yukon territory of yesterday, where icy winds and howling wolves are enough to drive a man wild, and civilized ways are gone and never present lust for gold. Now let's go to another lawless world, the West of early frontier days. Not so cold, but which makes up for the freezing temperatures with trigger-tenth tempers, where the gun is a man's lease on life. This is a country which abounds with cattle rustlers and where miles and miles go by before you see any signs of life. The West, beautiful but wild, a land which cries out to the hand of the law. You'll never lack for adventure on mutual, whether it freezes you of fear in the wild Northwest Territory, or scintils you of the accurate heat of the Western Plains. It's all on mutual every week over most of these stations. Now, on a remote section of the Yukon Trail. Then, we pull that express robbery easy enough. With snow falling like it is, nobody will be able to pick up our trail. Don't forget that shotgun of the moniker we saw in town. It's one with a big door. Oh, you mean Sergeant Preston? But don't worry, if he picks up our trail and comes to the hideout, you'll find a bullet waiting. Not only for him, but for that snooping mother here. Must you hideout! When Sergeant Preston and King do pick up the trail, they'll expect trouble when they find the crook to rob the express office. What they won't know is that when they reach the hideout, they'll be going into a trap that may mean death to both of them. Be sure to hear this exciting adventure Wednesday. These Sergeant Preston of the Yukon Adventures are brought to you every Monday through Friday at this time by the Quaker Roast Company. Makers of Quaker Pop Week and Quaker Pop Right. The delicious cereal shot from guns by special recording in cooperation with the Mutual Broadcasting System. They are a copyrighted feature of Sergeant Preston of the Yukon Incorporated, created by George W. Trenville, produced by Trenville Campbell Mule Incorporated and directed by Fred Flower Day. The part of Sergeant Preston is played by Paul Sutton. This is J. Michael, wishing you good-bye, good luck, and good health from Quaker Pop Week and Quaker Pop Right. So long. This is Mutual Radio Network for All America.


I think it's the last one that we actually have I'll see a pad parasha Good luck Brian. Here we go. It's the last one that I saw I didn't see any more in stock on the site So I would assume it's our last one. All right, we're charlissing dried bow and just go go far at the all and wonder kids of Futabu got rookie Bruno Eglacius and Salaramos Rookie Noah sasa and a Gavi. I think that's the variation. Gavi It sure is image variation Gavi first numbered card coming up here All right. First we got Patrick Schick Come out these for the mana Arquinhos rookie and it is a green Goreen or at the right way Oh 20 cruise Solid cruise there 18 of 70 with the Holland base Leonardo Bonucci Casemiro Marquinhos the other Marquinhos this time rookie Christian as Lonnie Ryan Graven birch Marco Lasatich and Rico Lewis rookie wonderkins Luca Modric rookie Alvaro Sanz Lucas gonna do off rookie and Jude Bell again yellow coming at this time. You got the on all block Darwin Nunez Hit a masa marita and a yellow of Alfonso Davis numbered 56 of 99 nice Davis Santiago Jimenez rookie probably nice one a great if it looks good Francisco Conce show they uncool of Sevsky and No need my duke All right, there we go Brian. Thanks again for the order. We'll get the cards out to you You