Hi! Hello! Before this video starts I want you to know it does encompass a lot of stuff. I was debating on making the videos like all separate but I think I just want to put it all together because it would be like one video that's like five minutes long. Like it's not that long. So I'm thinking about just making a whole video which you're watching now and there's just gonna be like a little bit more ad placement. Like I'm gonna like manually put more ads just because I'm not posting multiple videos because why post like a three minute video saying we're moving. I mean I could do that. Also my longer videos attend to do well. So I guess with Alpha they do. This footage was filmed over the course of time so yes we are moving and I'm so excited. We closed earlier this week and from here on out the next videos that are going to be posted are going to be posted more like in real time rather than the footage you're seeing. So yeah I hope you guys enjoy this video. Today's video is going to be super exciting because it's kind of like the announcement video slash come to the design studio with us. We are moving. I don't know when you're seeing this. We just want to make sure that everything is happening smoothly so that's why I just like held off posting. But we are moving back to celebration and I'm so excited. I have been waiting to make this announcement video for you guys so long. Basically that is why we didn't decorate for Christmas etc. But I'm just starting off the video so it's not just jumping into coming to the design studio with us. This has been a project that my family and I have been working on and I'm so excited that I get to take you along the journey. I know that the videos might be posted a lot later but I still wanted to document this also just for myself as well because it's going to be super fun. But anyway in the next clip you're just going to be seeing us going to the design center and picking out our house details kind of like the cabinets and the flooring and just like all of the little detail stuff because we are building a town home and it's an island village. It's a new part of celebration which I'm so excited about. It's just going to be really nice. So you're just seeing us go into the design center and pick out stuff. So I hope you guys enjoy this little section of the design center. Morning guys. Welcome to the portion of the video where we go to the design center. I'm so excited. Sherri's also excited. I am very excited and Sherri loves doing this. I haven't really done this. I haven't really done this in my lifetime. We picked out stuff for our current house a little bit but I was like in college and I wasn't like really fully involved. This is going to be super fun and I can't wait to show you guys. I guess you were only in first grade. You're going to first grade when you moved to celebration. So I guess you really weren't involved in design center then. No. I was probably just like waiting for it to be over. Yeah I don't think you even went with us. I think mom came down and watched me during the time while mom was hanging out with you. Oh that's just probably what happened. Yeah because I don't remember anything. Yeah. All right this is Sherri's outfit. Looking cute. I want to show you mine. I'm wearing this cute coat again. This is the outfit and I just expect it to be cold in there because typically everyone puts their air conditioning super high especially in Florida. So just dressed to impress. Valerie's wearing her purple. My purple shirt. Sherri got some coffee over there. We're bringing out samples now. We don't we don't want that. No. I like this one. It's darker. That's the we're looking at countertops. This is going to be my bathroom one probably. It's super pretty. It's the white ice. It is darker. That's a little more grayish. The next down it's like a soul. Done. Okay I guess we have to do the black again. Yeah. Yeah it's just too similar Valerie you know. But this is beautiful and then I think that's going to be my bathroom one. I love that. So pretty. I think if you're going to have a contrast with the island if you go do it all the same you do it all the same. If you're going to have a contrast with the island you need to have a contrast. The island be like the the showpiece. Right. Yeah. I think this is the one. I mean I really think in my HGTV watching because I have watched the islands that are not the same as the rest of the kitchen. The ones that look the best are the ones that have a real contrast. They're still they make sense but there's a contrast. So we have now taken this one away. Yeah. So this one can go away. Okay. Okay now I like this. That is pretty. That is true. Yeah. Okay well I really like that one. I like that best. Yeah I like that best. See a daughter's intuition knows. Just knows. It is a blue gray. It's a blue gray. It's a cooler tone. I think okay we got to have backsplash then in order to that's true. I like that the best. That'll look very nice with the white. It keeps that all yeah flowing and the contrast contrast here and it looks good with the floor. All right so guys when I was um saying I really wanted like a more white tone for the island and Valerie was very set on like darker and we finally found this is a good compromise Valerie. This is the color. This is like perfect. They've been watching way too much HDTV. So I know but it's not it's pretty. It looks brown. Yeah but I really like this Valerie. Overtones. Yeah it looks really good. That's it. That's it because this is God. We like we really like the shiny shiny that we had in our old house in celebration. Yeah it's the same. She just said that's shiny. So that's basically the same thing. This one's shinier. Okay you're right. Whoever you are you are right. Everyone is right. Yeah. Sherry picked this in the very first time.  I'm like yeah it's beautiful. So good. I think we're gonna go with this one. That's definitely. Now that this has changed. Purple. Yeah. This is beautiful. So pretty. Level five. Is it a level five? Yes. You don't like the this in there? Oh that's got that silver. Is that level five too? Yes. Of course. Okay well that would go well with the stainless steel. This is called the mixed up metal. Mixed up metal. Let's see. This one has some of the stainless in it. Put them both like this. Okay I think I like that. It's gonna be right here. Yep. I like that one. It's gonna be right next to the white. And this one's less busy Sherry. See this one has like more little like things. Right. This actually that would be better. That would not be better with that because this is already right. Yeah. This is a bigger. It's totally different than this. Yeah. But it complements. Right. Yeah. That's but I think this is the one you said you didn't like because they were all different sizes. But I like that. This one is all the same size. But I like that one because it's less busy. This one seems more busy. Well especially if we do this. Yeah. Yeah. Then we've got a bunch of that. So I think we we're gonna land on that one. All right. Here we go. Decisions made. Finally thank god because you know something if we didn't have one was in those bathrooms at the millennia mall I know that you would be forever. Yep. Sad about them. Which is this? They're looking at carpets. I like that one. This is the level three. Actually I like that better than that. Actually yeah that that has more gray. This is for like my bathroom. Well that looks good. That looks good with it. It brings out the browns and she said that there's a lot of variation as well. Oh yeah we can't do it in the bathroom. Never mind. Natalie. Natalie you're right. Natalie what's that? Perfect. Level four for the floor. That's so pretty. Oh that one's good too. Brown. It has a little brown cast. I was I was thinking that I should have lighter floors because I really like and I wanted to I wanted to compliment this. I don't want it to be like black you know. So that's good for my kitchen for my for my bathroom. Sorry wrong room. Nice. Oh I love that. That's really pretty. Do you like the one that's with the countertop? Niter down? Yeah. Yeah this kind of still got the gray. It still kind of carries through the gray. Yeah. This one you're looking at powdered. Yeah it'll be okay with the gray. Yeah. So this is definitely prettier. It's a level two and it complements this, this and this and it brings out the white. So everything just looks so good. I like that. Yeah. That's a good shot. All right so the mothers made their selections for their bathroom. Oh semi-frameless shower enclosure is what that's called right? This is for their shower. Okay I'm gonna forget this one. Countertops and their cabinets. The bathroom grand bar. Yeah. Yeah. Look at all the carpet. I know but that's the thing that she showed you. Floors. Under cabinet. Yeah. It looks like you still have that. This is cool. Double sink. Single? Okay. Of course single. 110 dollars for single singles too. Right here? Yeah. This is what we want. Oh yeah we want this one. Yeah we want that one. Big. Big. This is so pretty. Look at the big shower. I'm good with that. Yeah. All right. Black selections are gonna be available in these designs and the aligns screen. So we're just deciding on faucets now for the bathrooms. So yep. So we're picking where our drawers are gonna be. I didn't realize that we actually got to pick so that's kind of cool. One eternity later. So this is being filmed in real time but like not real time because I don't know when you're gonna be seeing this but we are gonna go through and look through our house right Sherry? Yep. It doesn't rain. It's a little cloudy out but I'm gonna get some clips hopefully and share with you guys like the building process even though it's over kind of but I don't know. It's good for the memories as well. Excited Sherry? I'm very excited. I don't have any cabinets or tile or floor or anything like that but yeah it'll still be cool. We'll see the inside. We can measure some things if we want. Yep. This is ours. How exciting. Yeah it looks nice.  Smell. Right Sherry? That's right. Going up the stairs now. Very cool. Gonna get used to climbing stairs here. This is the laundry room. This is where the furnace is. This is my room. So exciting. Bathroom flooring. Beautiful. All right so this is my bathroom. Obviously there's no lights but as you guys can see I picked the tile to go like a diamond instead of just like flat just so it'll give it more like I don't know personality. Oh look we have a little shelf there too. I didn't even know that we did that. Does that just like come with it? I don't remember like taking that out. Sherry you must have chills about flooring. That's nice. This is Valerie's lair, her office. All right so now walking in here this is the mother's lair. Oh my goodness so which this is Valerie's closet and then this is Sherry's closet which they're very excited at least. I think Sherry is excited, most excited about having her own closet. So this is the master bedroom. I know. And then this is the mother's bathroom. Oh my gosh the tile in here looks great. Oh my gosh Sherry that looks amazing. And then this is the toilet room.  That's where the toilet's gonna go. Yeah this is the floor in the gray. I love it. Very complimentary. Hey guys welcome to this video. I don't know again when you're gonna be seeing this we're doing the house walkthrough today so I'm filming on my good camera to get that good footage. I'm so excited to see the inside guys it's so pretty and the couch like you guys I am it's just so pretty. My parents did a really good job. I was like involved but like yeah you guys know my interior decorating skills are not that strong to be honest. So I trust other people with the judgments and it looks really good.  So I don't want to like repeat footage you know. We'll probably just hop over to house because I know that's what you want to see anyway. Okay everybody who's excited. Are you excited? We're excited. All right so first things first Starbucks. It's like the reveal date on HGTV. Oh my gosh you guys know they love HGTV and they got some inspiration too from it. I want to say I don't know did you guys? I don't know maybe. Yeah some things you haven't been able to read yet. Yeah so the colors like my favorite is probably the backsplash. No no no it's probably the cabinets because I think the cabinets are like sleek looking so oh I can't wait to see it. Can't wait to be inside. I have a little square that's the kitchen is like the best. I mean well you know frankly though to give the rest of it it's due. That's really always seen as the downstairs and the rest of the downstairs is just paint and flooring so there's not a lot to compare. That's true. I can't wait to see our cabinets upstairs and see your bathroom. Oh I know. My bathroom's cute. I'm looking at the design areas. There's nothing really too much design. That's true. Till we get in there. And guys okay so I have another dilemma of like what mirrors you get but I think I'm gonna go with the black border one that's like really like it's a black thin border from CB2.  It'll literally you'll just see the outfit and like the reflection of the room and like obviously my phone. And I really like that but also too I really want the like the giant famous primrose anthropology mirror. Yeah I just don't know which one to get. Obviously the CB2 one's a little cheaper but to be honest like not that much because like I didn't realize how much mirrors were.  And then my shower curtain also has a black detail so I think it'll like tie everything together if the mirror matches that rather than like the heavy gold like fancy stuff. But I really like both but I'll probably end up going with the more simplistic mirror which is fine. I think Karen's friend Taylor um I follow her on Instagram Taylor Rochelle she's the one that like linked the mirror and I was like ooh that's also a good one and it would probably match better with my room. Okay part of the whole house the trash can you know like yes the one now probably is just a little wider but it's pretty much just inside study it's really pretty. We're actually gonna keep one in here maybe it's gonna be where towels go. And then this is Valerie's closet the girls have their own closets they're thrilled about it. Isn't it nice? It'll be nice to have your own and this is the master bedroom. Whoa this is the best part of the house I think. I think all of it. Oh my gosh look at the sink. Oh my gosh. We're stopping to look at the clubhouse I don't think it's officially done but there's mailboxes here. Very cool man there's a lot of mailboxes here. Oh this is a community bot. All right so my camera battery freaking died so we're on the phone now but I want to show you guys this is a little common area the pool obviously and like look at this gym look at how cool that looks in there not neat so there's a bike right there and then there's mirrors oh and then there's TV so maybe that's a nice nice nice


When I was asked to give this talk today, I was asked to speak about marriage. And I'm always just a little suspicious when I ask the woman's speakers to speak about marriage. And I think to myself, ask the Melshi. Rasad, Abed, Al-Avyn, Zabarak, Al-Afiq, you redeemed the brothers tonight. Inshallah. Inshallah. Inshallah, what I decided to speak about actually was when I thought about the concept of love in the Quran. Someone dear to be asked to me and said, what story of love in the Quran speaks to you most? And the first thing that came up for me was a beautiful love story, but a different kind of love story than we have been talking about tonight. And it's not one of marriage. I want you to transport yourself back into early Islam. I want you to imagine that you are the closest friend and companion to our beloved, the Prophet Muhammad sallallahu alaihi wa sallam. And I want you to imagine what it means when you realize that there is such fear and such potential, that beautiful potential of Islam could be completely taken away if his life is taken away. And that you are meant to be his companion and to help him migrate from Mecca to Medina. Who am I talking about? Sayyidina Abu Bakr Siddique. And I want you to imagine that the prize for finding the Prophet sallallahu alaihi wa sallam is 100 camels. You do the math and tell me what that means in today's money. And I want you to imagine that as you're taking this trek, you need to stop. It gets dangerous. And you stop at Ghad Thor. And you stop there at this cave. And the first thing you do is try to clean out the cave so that the Prophet sallallahu alaihi wa sallam can go in safely.  But one hole was missed.  You see the snake. And so you take your foot and put it in the hole. And the snake bites you. But out of your love for the Prophet sallallahu alaihi wa sallam, you don't even want to move in order to not disturb his blessed sleep. So you're just so such in pain that all you can do is start to tear up silently, silently in excruciating pain. And the tears fall from your cheek onto the Prophet sallallahu alaihi wa sallam and it wakes him up. And when he wakes up and asks you what happened, you explain. Do you feel the love? Can you feel the pulse of this kind of love? The Prophet sallallahu alaihi wa sallam took his blessed saliva and put it on Sayyidina Abu Bakr's wound and it healed completely. Such is the blessing of the Prophet sallallahu alaihi wa sallam. And when Sayyidina Abu Bakr tells this story, he says at one point, we heard the footsteps of the people who were coming and all they had, they got all the way to the cave where we were and all they had to do was just look down and they would have seen us. But they didn't. You remember why? There was the spinning of the spider web and the pigeon with her eggs. And they thought nobody went into this cave and they went off. But the Sayyidina Abu Bakr was worried because any harm coming to the Prophet sallallahu alaihi wa sallam meant the potential for Islam to be gone right in its infancy. And can you imagine that this kind of love is mentioned in the Quran in Surat At-Tawbah? Twice. You're referenced. Imagine you being the one referenced in the Quran. Sayyidina Abu Bakr is referenced because Allah sallallahu alaihi wa sallam says, The people who disbelieved took the Prophet sallallahu alaihi wa sallam out of his home in Mecca. And Allah sallallahu alaihi wa sallam refers to Abu Bakr by saying that he is one of Thaniith name. He's one of the two. Imagine you being referenced in the Quran as the Prophet sallallahu alaihi wa sallam and you're the second. Right? Thaniith name. And as they are in that cave, this is when Sayyidina Abu Bakr says to the Prophet sallallahu alaihi wa sallam that he's worried, he's fearful. And what does the Prophet sallallahu alaihi wa sallam say back to him? What is repeated is mentioned in the Quran. Imagine that your conversation with the Prophet is reported in the Quran. Love. This kind of love, it's a special kind of love. And the ayah continues. Don't be fearful. Don't despair. Don't be scared. Allah is with us. Allah is with us. And not only that. It continues because it says He send down a tranquility, a calm that took that fear and that sadness and that despair, that sadness away. And Allah gave them forces like angels that you can't even see. Allah is providing the entire time. What do you do with a kind of love that is so strong that when you are the first to go public with your Islam, you get up on the mountain top and you start talking about Islam.   Not just what happened to me, am I missing a nose as my tooth gone? Is the Prophet okay? This kind of love is so strong that when you see how the Prophet sallallahu alayhi wa sallam reciprocates and responds, you'll understand. Because one of the other Sahaba of the many, there's actually several narrations similar to this. But this particular narration that's in Sahih Bukhari and Muslim is on Amr ibn Abnaas. And he said to the Prophet sallallahu alayhi wa sallam, he was just appointed. So he was very proud of himself. And when the shema alit says, whenever the Prophet sallallahu alayhi wa sallam would speak to you, he would speak to you so directly. You would think that only you were in the room and he would think that you were the most beloved person to him at all. And so several of the companions would say, Ya Rasulallah, who is most beloved to you?  And so here's Amr ibn Abnaas, who's been appointed. And he asks this question and the Prophet sallallahu alayhi wa sallam says, Aisha. He says, okay, okay, from the men, from the men. Who's the most beloved to you? He says her father, inshaAllah. And then he goes on. He says, and then who? Sayyidina Umar. And in a different narration with a different Sahabi, it says there, he said, I wish I had never even asked. Imagine that you are the person that is so beloved to the Prophet sallallahu alayhi wa sallam. That you have given up your comfort. You've given up your safety. You've given up your land. You've given up your wealth. Yes, wealth, because Sayyidina Abu Bakr, one of the most important things that we know about him, is how much he gave his wealth, particularly freeing of slaves. He freed Sayyidina Bilal. And he freed Amr ibn Yasir. And so on the list goes. And imagine you are the person that once you have this Islam, you want everyone else to have it too. Imagine you're the one who brings to Islam, Orthman ibn Affan. Imagine that you're the one who brings to Islam, And Sa'ad ibn Abi Waqas. Imagine the scales for scales. Now, why do I mention all of this love? It says that Abu Bakr, radiallahu anhu, likely had met the Prophet sallallahu alayhi wa sallam when he was like 10. They were out on the same caravan when the Prophet sallallahu alayhi wa sallam had also gone out when he was about 13. The Prophet sallallahu alayhi wa sallam was about two to three years older than Abu Bakr. And who knows how exactly the friendship exactly came to be, but when you think about who these two people are, when you think that the Prophet sallallahu alayhi wa sallam is Al-Amin, the trustworthy. And Abu Bakr al-Siddiq, right? When you think about how these souls, we say, When they meet each other, their kindred spirits, they know each other as soon as they meet each other, they just mesh. And they became good friends. And when the Prophet sallallahu alayhi wa sallam married, they became neighbors. And when the message of Islam came, so this is what? They were neighbors since he was about 25, right? And when the message of Islam came at the age of 40 years later, Sayyidina Abu Bakr heard this and said, he went straight to the Prophet sallallahu alayhi wa sallam took a shahada. This kind of love starts young. This kind of love that Sayyidina Abu Bakr had for the Prophet sallallahu alayhi wa sallam is a mirror. It's a mirror because it reflects the love he has for Allah, Subhanahu wa ta'ala, and his commitment to Islam. It is the kind of love that we need to have for our own Prophet sallallahu alayhi wa sallam. And the kind of love we need to instill in our children. Now, let me tell you something. In the last several weeks, one of our dearest teachers, one of my dearest teachers, Ansa Sosa and Aimadi had done an amazing, amazing series on parenting at the Rahma Foundation. And I want, if you've missed it, you've got to go back and listen to these recordings. It is phenomenal. She takes the milestones, the physical, cognitive, emotional and spiritual milestones of children at every single age. And she tells us how as parents, we do a pretty good job with the physical on a decent job with the cognitive, the emotional milestones. And the spiritual milestones of our children, we just fall right off. The reason that that series is so extraordinary, every time I listen to it, you can't help but learn something amazing and new. When she gets to teens, I told you, the friendship between Abu Bakr and the Prophet sallallahu alayhi wa sallam started young. When she gets to teens, this is where everybody's ears perks up and go, huh? You just told me we need to instill the love of the Prophet sallallahu alayhi wa sallam in our youth. What do we do with these kids of ours who all they have all day long as a stone in their face? I remind us the phone that we gave them, that we pay for, that we give the subscription to. Just saying. And so, what does she say about these teens? I'm going to say something. Maybe pushing the envelope, pushing the envelope just a little bit here. She says, take these about 10 years or so. Let's start at the age of 14 and let's say, let's go in our field. We say transitional aged youth are until about 24. So 14 to 24. At this stage of life. Now listen closely. This stage of life is called the stage of spiritual and sexual awakening. Now, when you think about this, let it just sit for a minute and you think about what this means. You'll realize that most of our youth and actually by extension, you see the ramifications of this and most of our adults too. That if they did not grow that spiritual awakening in the years in which you can hit its peak and prime, which are actually your teen years. And for anyone listening to this going what your teen years. Absolutely. This age is an age in which you don't have the many responsibilities that are to come. But it's also the age of decision making because you've learned so much all this time. And now you're finally making your choices for yourself. Whether your parents like it or not. And the people you're listening to more often in this stage are not your parents anymore by and large. They are the others. Who are the others? Who have you put in their path that they're turning to? Where is the Suhba Salihah, that strong companionship and friendship like we saw with Sayyidina Abu Bakr on the Prophet to turn them back to the spiritual awakening? You see one can grow and completely stunt the other. And in this society, the emphasis is I don't have to tell you it's not on the spiritual awakening. Where is the emphasis? You know where it's being pushed and pushed and pushed. So how do you combat this? You combat it with a spiritual awakening. This is the stage where a youth can get up and actually pray in the middle of the night and feel and taste Iman, Allah. This is the period of life where they can get up and actually feel a kind of faith and kind of love for their Lord and kind of love for Islam. But they don't actually feel in other stages. It's a very special stage. So let me tell you something. Don't stunt our kids spiritual growth and progress. Even when we see kids kind of like go a little bit, you know, sometimes it's really, really far out. If they've experienced this, they eventually come back. It's a taste that once you've experienced it, you can't forget it again. So give them this. And Wallahi, if you feel that reserve from this age, they always draw from that light and that new for the rest of their lives. Subhanallah. And so in closing, in closing. I'm going to share with you a story of something that happened in the Rahmah Foundation. For those of you who don't know, it's a nonprofit that we have here in the Bay Area now for almost 20 years. Mashallah, we're getting there. And Alhamdulillah, feeling Wallahi the honor of having worked with so many of your daughters actually over the many years of our summer camps and our youth camps and our Friday night halakas and our youth halakas and so on and so forth for women and girls. And one time I was at the masjid where we hold these events. And because we have a parallel women's halakah with hundreds of women in it. At the same time that the girls are in their halakas, hundreds of girls, mashallah, of all the age groups for all the way to high school. And every so often I get to break away because we have a guest speaker. And I think, you know, as I go through the masjid and kind of want to just look in and peer and listen into what's happening in the different girls groups. I feel like Sayyidna Omar. I was like, I'll make us like Sayyidna Omar, who would he would go and walk through the village at night to hear. Because, you know, it's the same thing. A lot of these rooms are like cubicles. So you can hear even if you can't see what the girls are saying inside. And I would walk through and kind of see how things are going. And one day, one day, Subhanallah, one day I heard these group of girls, they range from like age 12 to maybe 16 ish. And they're behind the cubicle so I can hear them, but they can't see me and I can't see them. And I'm walking through and one of them said, we have to figure out how to get, how to go. And I said, where are these girls? They're going to go. And they said, we've got to convince our parents to travel. This is pre-COVID. And so I stopped. I was kind of interested to see where is this conversation going. And they said, we have to figure out where to go study. And I just stopped. Wallahi in my tracks, you know, when you kind of have that moment where you just like everything freezes in time. The kind of good companionship and the kind of role modeling for those of you who know me, know that I've studied in Syria. When I was a young girl, I was about 14 when I first went overseas to study Sharia. Since we mentioned Syria, please make dua, please for Syria and all of the ummah, Ya Rabb, Allahumma Ameen. And the story is often shared with the rahmah girls that their teacher went to go study and inshallah you should too. So these girls are making plotting and planning. And I thought, what are they going to say? And they said, we're going to go to Turkey. I thought, wow, Turkey's the new Syria. And the funniest conversation, the most comical conversation happened after that. One of them said, hey, you know how to make pasta, right? So we'll be okay. And the other one said, no, no, no, she didn't forget pasta. She knows how to cook. Another one said, you're turning 16 soon. You're going to be able to drive. So you'll drive us around Turkey. And they're having this whole conversation of how they're going to study in Turkey. And they finally get to the point where they say, but who are we going to study with? The Quran and Islam. And I thought to myself, Subhanallah, Wallahi. Right then I literally melted into the ground of the mustard floor. And you have to pick me back up because I thought Subhanallah. We have three rules that Rahma, three rules. You come here on Friday nights to learn about, to grow in your sisterhood together. And here was a group of sisters. They were all in different schools, but on Friday nights, they found their Muslim sisters, right? That you grow, number two, that you grow in your love for Allah Subhanahu wa ta'ala. And that you grow in your love for Islam. And that's it. If you gain more out of it, Alhamdulillah. But if you got those three, you got love. And you got the kind of love that's going to help you in the spiritual awakening and keeping you through.  On the spiritual side, please reach out to the programs that are like Miftah, like the Rahmah Foundation, like the others. And of course, the Miftah brothers, may Allah bless them and increase them, have allowed me to give this service announcement and I'm very blessed to give it. If it is more than that and you feel that you need extra help, you know that I'm not going to leave the stage before telling you that if you need the extra help, reach out for help. Some of the issues that are happening are definitely spiritual. And some of them are on the needs of mental health. And please know that the two are connected. I'm very happy in order to tell you that after a bit of a gap, Alhamdulillah, we now have Maristan and Alhamdulillah in the Bay Area. I'm really, really blessed. Alhamdulillah. It's a real, real blessing to have, insha Allah, an organization that's going to be focused on kind of the Muslim mental health and the Islamic psychology. And I want to tell you, and that's here to stay and it's from the Bay Area and it's not going anywhere, insha Allah, insha Allah. And I also want to tell you, my dear sisters and my brother is the table is outside. And take it, please take your bookmark before you leave, insha Allah, and reach out. If it's not for you, then it's for somebody else in your family or friends. Wallahi, the kind of love we've been talking about here is possible. But sometimes we do need that extra help. So may Allah Subh'anaHu Wa Ta'ala, Allah for all of us to have the kind of spiritual awakening and to go forward with it. Wa Alhamdulillahi Rabbil Alameen. Wa Sallallahu Alaa Sayyidina Muhammad Wa Alaa Ali Wa Sallam. Wa Sallam Alaa Alaykum Wa Rahmatullahi Wa Barakat.


So before you freak out on me about my Amelia Fart title that I just made, hear me out. What is up everybody? This is Chris from the Rewired Soul where we talk about the problem but focus on the solution and if you're new to my channel what I like to do is take a look at what's going on in the YouTube community or movies or TV shows or pop culture and try to see what lessons we can learn from them. So if you're into that stuff make sure you subscribe and ring that notification bell and make sure you're following me over on Instagram and Twitter at the Rewired Soul because I love engaging with all of you beautiful people out there. All right so yeah I have heard a little bit about this story between Amelia Fart and Airbnb and I've heard her talking about how you know she was discriminated against because of how she looks and like I love me some Amelia Fart. You watching this video you probably love Amelia Fart like Amelia Fart like she she is what this platform needs right like she is just authentically herself she talks about her mental health which is something that I love she knows that it's okay to be weird it's okay to be different like I think it's very inspirational to a lot of people out there and yeah when I first heard her talking about this and being discriminated against like she was talking about it on Twitter like I was like that's messed up like I'm against that like I hate that like just since I was a kid I never thought that was right I never thought it was right to judge a book by its cover right to judge people by what color their hair is what clothes they're wearing like I love tattoos like I don't have that many tattoos I have a few but like I love tattoos but I knew like growing up like I wanted to get sleeves and everything but I was like I can't because somebody might discriminate against me for my tattoos so I don't like that so when I heard that that happened to Amelia Fart with Airbnb like I was like oh my god like this sucks right but she just posted her video so know that I went into this thing like ready to like be on a Amelia Fart side and like boycott Airbnb but like listening to her story it doesn't sound like that actually happened all right like I envisioned this story originally I thought it was like you know she she tried to stay at a place you wanted to for Airbnb maybe they saw her picture and they were like no that's what I thought it was but the story is actually much different so just to kind of summarize this story she she stayed in Southern California right outside of LA and it's an area where you know people are weird and they know whatever and that's why she wanted to stay there and there was a few things right so one thing to note is the guy cares about five star reviews okay now there was a few issues with the place like she asked if she could take down some curtains to let some more light in maybe for filming or you know she also talks about she likes you know light and everything um then there was an issue with a lamp not turning on and the guy came over like because she let him know about it but she was very kind and generous and you know she wasn't a jerk about it right and yeah while she was there she ended up breaking a plate um she went to Trisha Paytas's birthday party and she had a bunch of stuff she couldn't fit in her suitcase and she left a lot of stuff there okay so as she's telling this story I'm like huh like I'm sitting there and I'm sitting there I'm like wait a second wait like so she did get to stay at the place the guy didn't kick around like where's the discrimination going to come in like I wanted to hear that and I was like and as I was listening to it and hearing about how much stuff she left like a bunch of water bottles a bunch of like like Gucci boxes and everything and she talks about how she assumed like he would like it or enjoy it or whatever like if somebody like left a bunch of Gucci stuff in my house like I'm like what what am I what am I gonna do with this right okay let me give you an example when we were in college um we weren't in dorms we had these apartments and we had a roommate who was kind of a dick and he ended up moving out and like he moved out he packed all his stuff but he left so much stuff just so much stuff and the garbage it was weird we were like at the top of this hill like there was apartments that went up this hill and the garbage cans were all the way at the bottom right he left so much stuff and we're like dude you left all this stuff he's like oh just throw it away like he thought it was like no inconvenience to us to have to lug all his crap down there like it was just rude and like I was remembering that a figure of this story as Amelia Farrell like oh I just left it like he thought he was being nice like oh you guys can have my old stuff and we're like we don't want your stuff you come back and you throw this stuff away right but anyways what ended up happening was she ended up getting a bad review so a few things a few things on this point and by the way this isn't like to knock Amelia Farrell like yes obviously you know she's a topic of this video but to give some context to all of you as well because like we need to be better and we need to have some self-awareness so like Amelia Farrell like I do empathize with her because she talks about some things like she wasn't raised a certain way you know whatever but I'm very fortunate something my dad always taught me was this leave things better than when you found them right like pre Airbnb my dad and I we used to travel a lot for his work throughout California when I was really young and we'd stay at his friend's houses a lot of them would travel to and they would leave us a key and we'd stay at their house or whatever and he showed me he taught me as a child like before we left like we we made the house cleaner than when we got there right and I continued this as an adult like I was just telling my beautiful girlfriend Tristan about a time I watched my friend's pets while she was out of town and before they got back I thought it would be a nice gesture because I remember what my dad said and I cleaned up their house her and her boyfriend's house and made it look better and they were very very very appreciative of that so like when I'm sitting here and I'm hearing Amelia Farrell's story I'm like wait a second like you left all of this stuff there and just left it up to this guy right like then she reads the review and like I feel on Amelia Farrell's end of things there's a lack of self-awareness and there's a lack of empathy right like she didn't take a moment at any point throughout this process to put herself in the homeowner's shoes at all and this is something that we have to do like we expect other people to understand us and empathize with us but we don't do it in return right and here's the thing like again Amelia Farrell do your thing boo if you want to wear boas and put makeup on and do your thing like that is amazing but at a certain point we have to ask ourselves like when that guy walked in right to fix the lamp like we have to ask ourselves like what are they going to think is happening like you see it in sitcoms all the time someone like walks in is like whoo it's not what you think it is right but like there's a stranger in your house right that's part of what Airbnb is it's a woman with a camera out and boas all over the place like if you're somebody who doesn't know not even what YouTube is but if you don't know who Amelia Farrell is like think about walking into that into somebody staying in your house and what you're going to immediately think I was reminding Tristan about when we first moved into this apartment and I didn't have like my my setup and everything and I was recording videos like in our bedroom I set up like my box light I put on I put up a the tripod and everything I was recording videos sitting on the bed and like when you walk in when you walked into the room I started cracking up I went oh my god I was like it looks like we're filming a porn in here right like there's a tripod and lights like facing the bed you know what I mean so like I laughed about it because if somebody walked in they would have think it's a porn I wasn't doing a porn obviously I was like filming videos for YouTube you know so like I just I just feel that she needs to have some empathy and understand what he thought like I would think like if somebody walked in and they walked in and saw that like hey just so you know I do YouTube videos and da da da da I would have like joked about it and I get at Amelia Farrell probably you know is a little awkward and thing maybe shag but I would say hey this isn't this isn't what it looks like all right but anyways the last thing I want to talk about is the perception of discrimination like that that's just one of the reasons I wanted to make this video because don't get me wrong like I'm half African-American I I'm a recovering drug addict you know I struggle with mental health issues all these things like stigma discrimination all these things are very very very real but it's also important that we have self-awareness because not every bad thing that happens to us is based on how we look or based on a certain aspect of our lives and it's important that we understand that if not we're just constantly making excuses for our behaviors right like it's easy for me like if I start being a dick to people right and somebody doesn't like me I can easily make up excuses like oh they just don't like me because I'm fat right or oh I just didn't get that job because I'm a man or you know whatever it is like I can make up all these stories like I I feel like Amelia Fart or any of you out there when something like this happens like take a step back and ask yourself like have some personal accountability and be like did I do anything that warranted this right like it's not always about how you look it's not always about your gender it's not always about your sexual orientation like that's the thing like we need to understand like when there are certain things that we did that we need to take responsibility for again like I went into this thing just ready to you know just fight for my girl Amelia right but as I heard the story and when she shared what that guy left in his review like I was like wait like what he said matches up with what you said the only thing the only thing that was incorrect about that was that he assumed that she was a cam girl all right that was an improper assumption okay but but that was just like that was a side topic primarily that guy gave her a bad review because of the stuff that was left behind from his perception that lamp was working fine before she came you know what I mean so there should have been more of a conversation about that but in my personal opinion I do not think this was discrimination against how she looks but maybe I'm crazy let me know down in the comments below if you watched her video which I'll link down in the description let me know your thoughts on it because it sounds it sounds and I'm sorry Amelia if you ever see this but just sounds like you weren't the best guest all right and and yeah it's no wonder why like yeah Airbnb can't just take down any negative review about a person then what would be the point of reviews you know what I mean anyways anyways that's all I got for this video if you like this video please give it a thumbs up if you're new make sure you subscribe and ring that notification bell because I make a ton of videos and don't forget to follow me on instagram and twitter at the rewired soul and a huge huge thank you to everybody supporting the channel over on patreon you're all amazing and if you'd like to support what I'm doing here get access to my new book for free that already click or tap on that patreon icon right there all right thanks again for watching I'll see you next time


Hello, greetings, folks. I will be leading this one today. Fuller co-chairs are not on. If you can drop any agenda items into the meeting notes which posted in zoom. They're also in the slack channel. Welcome, folks. If anyone else joined there, please add your name and any. Please add your name and any agenda items to the meeting notes. Which I posted again. I see that you added one Jim welcome and thank you. How much time do you need. For that normally. Yeah, so we can. Depending on the other items, you know, about 10 minutes should be. Good for a quick demo. If we want to go deeper, we can certainly showcase more use cases and other items. All right. Are you familiar with the telecom music group? I had a quick discussion with Victor as we were discussing different use cases and I have looked at some of the documents and other information, but not deeply familiar, but I am at a high level. Yes. Typically for longer demos, we suggest putting them on, on that. Okay. And within that user group, but a 10 minute demo sounds good. And then. For sure discussion. That's the main focus here. Is this your first time in this group? It is. All right. So. Have you been, have you gone to the scene of working group. Repo. No, no, no. Just, I just invited Taylor. Because I guess like. It's a great tool like this. Be nice to be aware of the benefits and all the efforts that they are doing there. So yeah, it's the first time you're in here. So. I guess like, he can present that and. Just share a few, a few. I think that they have an eventually maybe we can. Do another more deeper demo in the future. But yeah, I guess for now, like, but Jim has like 10 minutes showing. It's a minimal. Or the basic ideas, I guess, good enough. What do you think? Yeah, sounds good. Maybe. I'm thinking about the focus. So just a quick overview for you, Jim. The CNF working group or it's cloud, it means cloud native or stance or cloud native network function. And the focus is on. Identifying. Best practices. And the use cases around those. Where. For networking applications so that we can. See how they can best run in a Kubernetes environment. So specifically looking for things that. Might already be obvious and other like enterprise applications and stuff. How do they get applied? So this. Run as an honor user with the pod security part of your demo. That's relevant to. A whole area on the security side that we've been looking at. Specifically within the principle of least privileges. And. One of them would be running your processes as non-root. So that's actually what we're going to be talking about today is one of them, one of the things. And that's, so that's a goal. So if there's use cases. That you. Know of that are. Would be useful that. Illustrate. Here's why. You should run as non-root. Here's why you should do these other security things or whatever. So that's a key thing. And then there's also a big. Good contributions in the working group. Also areas that are problematic. Like here's an area that. Is, you know, they're thinking about over. And the plumber's working group or sick.  And if you point out, they're trying to work on it, but they don't, they're having some problems. Those are also area. There's kind of gaps. And then again, the end goal is to be able to share. You know, to share your best practices that we're trying to get everyone to adopt for the platform and applications. Another initiative that's related that I think. I don't know it. Enough about this project that you're going to demo. To say. But the CNF test suite. It's actually focused on. Creating tests that try to check practices. How things are deployed and how it's running, how it works and run time. So this would be, you know, deployment onboarding of new applications as well as like the second, second non-going life cycle management type items. So it goes across the board. So we, that initiative actually use various tools like Falco. If you're familiar with that and. If you're familiar with that. If you're familiar with that. OPA and other things as part of it. Okay. The testing. So this might be something that could even be used there. We could talk about that. Perfect. Okay. Does anyone have anything else to add to the agenda? I'm having. Some problems. This just came out. Bill, are you available if my screen. Dies or. Lucina, somebody that could help if, if I can't load something essentially right now, I'm okay. So the, this best practice. So we've been working on. A whole set of use cases.  I'm not going to go back through, but if folks want to look, they can go and see in the notes or links to. Documents around least privilege. And other things. We've had this best practice for a while. And then we've been going through and. Resolving issues. We're now down to a point where. Everything has been resolved. And we have. This is pulled in just because it's, it's from the, the main branch. So these are typos and stuff. So we can ignore that. Here's the. Main best practice. So. This is for the non-root. With the recommendation. That all the processes should by default be run as a non-root user. Part of the. Defense and depth strategy against compromises. If something gets through, then what do we do? So this is the idea. So here's the set of user stories. This is one of the last kind of remaining thing. Writing these up. So there's a whole set of user stories that can be used around. At a minimum, the least privilege items. There's probably other security things. But. Wherever something does break through. If it happens, which is. Likely at some point. Then how can we stop it? Well, then. The non-root user is part of it, but. So compromised updates or maybe. A central registry. Maybe it's coming directly from a vendor.  Updates, maybe the registry itself was compromised. And. We actually pull down compromise code. Maybe the images or. There's, if someone has done more of a lift and shift. And the application is not. Deploying new images for updates. Instead it's doing an update within itself. Which wouldn't be a good practice in of itself. But if it was doing that. And it. Wasn't using root and it could limit some of those things. And there's several other user stories. I'm not going to try to pull these up. Or maybe I'll. See if it loads. No, I don't think it's going to lead. So y'all can click through this. If you want to check them out. But we have a bunch of user stories written out. And. A bunch of references going to different. Places talking about why this is a good idea, including. The CNCS. Tag security. White paper and. Bunch of papers from different. Other folks. And I think that's about it. We talk about some ways to check for these things. That can happen. And it happens at the CNF test suite. So. So. Also. Can check for this one. So that's it. Wait. Just one thing about that one. It's like, at least. I noticed that you haven't raised. The latest changes. So. At least for me, it was really hard to distinguish what was. Different between. The previous or like, like. What is. So I don't know if you can, because in now it's reflecting. 70 changes. So, I mean, most of them are. Coming from. Or commit. I don't know if you could. Surveys it or we just need to focus on. The. The document that you have created.  It's having a hard time. But I'll. If someone else wants to pull it up and share, then you can do that. And I can walk through it. But the. We were actually at a point where everything was. Resolved and ready to go. Except for the. The user stories. So. Everything else that's been updated has been typos spelling. I don't know what's happening with my DNS. Or somehow I think either in a rebase or a merge. We've pulled stuff in from Maine. Yeah. I don't know what's happening with my DNS. But we've pulled stuff in from Maine. That is. Causing all of those commits to show. But those are on other files like the. Spell check file. Read the read me got updated for spelling. So there we go. So there's workflow. I don't know why it's showing here. Pulling over here. So that it should be a no op whenever it goes on to the. Shouldn't do anything on the main when we merge these in. Get ignore. So ignoring the dictionary. This is probably already on main and the rebase. Hold it in spell check. So that also shouldn't matter. This read me. That's a spelling. Update that someone did. This one is also a grammar issue on the existing process. Doc document. I'm going to skip this one for a minute. We can go look at some of the others. Again, spelling on the main read me. Glossary. This one. Is updated on the main. So that this. Is bringing this branch that has the. Process aligned with what's in Maine. It added some new, but we already have these on the main branch. This is one of the good action things I think. This is more spelling on existing use case. Spelling on another use case. This is the newest and one of the older actually. Use cases, the onboarding use case. It's just a full ad. It's already been added to Maine. So again, this is something. Where the PR is messing up because it's not. It's not going to actually be an update. It's. Already there. Supply chain attacks. So this is new. This is the user stories. It looks like we have some. Spelling. There it is. I see it. I think. Victor, would you mind doing like a. Commit or suggestion for those. Yeah, I can. I can do that right now. Where it says. Con a tiner. Instead of container. But this is the user stories. So this is a defense and debt supply chain attacks. Talking about what those are. Saying you can. Have a bug. Whether it's bugs or. An actual malicious actor that's trying to get something in. There's a lot of places. From development all the way through. Production where. A problem can happen. You can have a bug that's. All the way in production. And it wasn't intentional, but it could cause some. A security issue. And then they can get in that way. And these are the actual stories about different. Different ways that this can happen. And that's the main thing. That one. And then this section right here. User story. Adding. This section with the user story. And then. The rest of the pieces within here. Were either spelling or specific changes requested by. Folks in the comments. So if I. Probably can't see it here. But if we, if we look at like the conversation. There was some stuff that granny. Suggested and those were accepted changes. So. So. Yeah. Liko. She suggested several things. Those have been accepted. Pankai. Made suggestions and those were. Included. If we show like. Very minor things on the central system. And actually this user story got deleted. So it doesn't matter. So. Essentially. Like this. Notice here's a question that shouldn't be there. Okay. Yeah, this was a comment that somehow made it in the code. So we deleted that. But these were the minor changes. Most of the, most of this was all done. All the way back in. July. July and August. And then the user stories was what we were waiting on.  Yeah. See if I can load this. Oh, it loaded. All right. And I can do. So I think that's it vector. And you can, I just refresh. You can do a. A new review. It was pointed out that it's harder to. Review because of the rebase. Not a whole lot. That we could have done on this one because it's been. Open for so long. But maybe we can figure something out next time. Any other comments. Before we merge this, we do have enough approvals. Yeah. Apparently there are a few words which are not in the dictionary, but I can just add later. All right. Right. When a squash and merge. Huh. I'm going to keep that because it's funny. That's a comment. What should we test? That happened. At a format version. And I'm going to look that's far. I think this. Was already covered. It's tagged one. Okay. Several additional terms. Bill, you want two different. Coauthored. Let's remove that one. No, it's okay. You can just do one. Okay, let's get rid of that in the sense. Wow. You can see there's a whole lot. Okay, let's see. That's. PICE. Let's forget that. Type of spelling. Fixed glossary upgrade. It's alignment. It's a whole lot going on here. Okay. Another bill, another vector. Okay. Everybody was on this. These were deleted. I just want to get in favor of taking time. I don't think I can start profanity. I mean, it's. Yeah, no problem. I will. Let's do that. Thanks. Jim. Go ahead and I'll finish. All right. Okay. That sounds good. Thank you. Yeah, let me. Just kind of do a very quick introduction. In fact, this presentation, I'll kind of just share a few slides from. It's something I did at OSS summit just last week. So on Kivarno. So just quick introduction to myself because this is my first time in the working group. And thank you for having me and being open to kind of listening to Kivarno and what we're building in the project. So I'm one of the, you know, creators as well as a maintainer on the Kivarno project. I will also act as a co-chair in the Kubernetes policy working group and a track lead in the multi-tenancy working group. So also, of course, participate in other various forums like, you know, tag security, security, et cetera. And I'm a co-founder and the CEO at Nirmata. So just a few, few things on Kivarno and I'll jump around. I'm not going to go through the whole architecture because this was an hour long presentation. I think it should be a recording up in a few weeks. If you're interested, you know, I can share that with the team. But talking about why, you know, what's the motivation for Kivarno and, you know, what's the, what's the kind of, what are we trying to solve with this project, right? So first off in Kubernetes, of course, policies are becoming critical as, you know, the complexity of Kubernetes and not just Kubernetes, but extensions being built on Kubernetes continues to grow. Right? So what we're trying to do with Kivarno is to bring a very Kubernetes native of a two policy management, right? And obviously, given that our tagline is Kubernetes native policy management, it begs the question, what does that even mean and why does it matter? So one way of kind of, you know, picturing that and thinking of that is the several tools which, you know, talk about being Kubernetes native. But what we mean by this is being, you know, fairly deeply plugged in into the control plane, being able to not just talk to the Kubernetes API server, but also understand Kubernetes API schema, understand custom resources, and be able to work with Kubernetes patterns, idioms like pod controllers, you know, things like knowing what pod admission controls means and how do we complement that and extend that to provide better security and automation tools. So that's kind of what we're trying to solve with Kivarno, make it really simple to and very native to Kubernetes and how policies are written, how policies are managed, and even how policy reports are visible, you know, in Kubernetes itself. And we'll see that in a quick demo that I'll do, right? But just to quickly explain, I'll kind of skip past some of this. Feel free to let me know if there's things, you know, if you want, if there's questions, et cetera, we can go back. But just how Kivarno works, it works as an admission control time webhook. So it integrates and I'll go through a quick install. It's very simple to bring up on test clusters or production clusters. It supports full HA mode for, you know, if you have larger clusters. But it's very simple to get started and install. It plugs in as an admission control mutating, as well as validating webbooks.  And based on your configured set of policies, which are just Kubernetes resources themselves, it will either validate block or mutate as well as it can generate, you know, new resources on the fly, right? So brings up quite a lot of interesting use cases.  Could be like injecting sidecars. Could be even changing things like network settings, except around the fly or creating completely new resources. For example, if you're running a service mesh and every time a service is created, you want to generate search and create an Istio service, right? Those type of things are common use cases we're starting to see in the community. So just to explain how a policy works and there's different kinds of rules in Kivarno. So every policy has a set of rules. Each rule has a match or exclude block and that lets you do some fine-grained logic on which, you know, resources to match, which namespaces, even you can match by user roles, labels, things like that.  So I think earlier, Taylor, you mentioned supply chain security. So that's, of course, something that requires admission controls to complete that end-to-end security in a posture and some of the work that's going on with other communities like SixTor. We're integrating Cosign with Kivarno to also be able to verify image signatures from any OCI compliant registry. And then you can, of course, validate which can either be just blocking. So if something's non-compliant, you can block in production clusters, or you can report and audit in DevTest clusters. And you can have a mix of this based on policies or even based on namespaces as you wish. And then, like I mentioned, another powerful use case is generating resources itself, right? So this allows you to automate a lot of things which previously required custom admission controllers. We're seeing more and more use cases.  So with that, let me dive into the demo and I'll show, you know, some on the Kivarno IO website.  Today we'll just look at the pod security policies. And, you know, but there's several other best practices. For example, using immutable label tags, right? And not using something like latest. Now, it seems harmless to use latest. And of course it gets used quite a bit in DevTest. I do that. Everyone does that. But if you're running in production, you want to use a version, you know, software. You want to also do things like replacing your image tags with digest. All of these are best practices. And there's 80 plus policies driven by the community. And this, this keeps growing with every release. So certainly several to kind of look through. But just focusing on the pod security. And we talked about running as non-root as one of the policies, but there's several other policies. And all of these are, you know, as per the definition of the pod security standards and Kubernetes. So this, if you're not familiar with, is a very key document, which is driving. So PSPs were one implementation of pod security standards. But now there's other implementations like Kivarno, Opah Gatekeeper, as well as the upcoming pod admission controller, which will be, you know, doing label based settings on a namespace level granularity, right? So that will be, I believe it's targeted for version 1.25. But if you're using something like a policy engine, like Kivarno, you just get a lot more flexibility in how you're managing these profiles and how you're applying them across your workloads, namespaces, as well as you can do, of course, you know, security, not just for pods, but for other things like making sure other best practices like running a read-only root file system is not one of the PSP policies, but that's also, you know, considered a best practice and a good security standard to apply. So anyways, what I'm going to do first is I'm going to start by installing Kivarno, right? And I want to show how easy it is even to get started. So we'll jump back into the documentation or go to the installation. There's several ways to install Kivarno. I'm just going to use the, you know, command line option through YAMLs. So this will, you know, pull down a set of YAMLs and it will run Kivarno. Just to kind of show, I just brought up a new mini cluster and I have, I think one namespace, you know, that I created. Oops. Let's say get namespace. I created a test namespace, which is running an engine export, but that's all I have on this cluster, right? So the first thing I'm going to do is just pull down these YAMLs and install Kivarno. And it comes with a set of, you know, custom resources, which allow you to define policies, which also, and then there's a policy reporting resource, which is, by the way, which is also now being used by Falco, by Kubebench and a few other projects. So more and more projects are generating, you know, policy reports in the same manner, which allows for some standardization and reuse. All right. So if I do get namespace, now we should see Kivarno running. If we do minus N, Kivarno, and we do a get, you know, test, or let's just say get pods. I don't know why I keep saying get test here, but so we have a pod which is up and running and so Kivarno should be ready at this point, right? So like we can, if we want to make sure, we can just check the logs and we'll tell the logs of this. Whoops. We can just do it based on the deployment. Get rid of that. Okay. So everything's good. It says it configured its own webhooks, which is what it needs to start receiving policies and things like that. But if I now do, you know, get cluster policy, I don't have any policies installed at the moment, right? So it's saying, you know, so if I do, so this is the resource which has, you know, which we will now install some of these pod security policies, but at the moment there's no, you know, policies running on this cluster itself. So let's go back to the policy repo. I'll pull, you know, here, this is a command, which will apply all of the pod security policies and it's going to apply a customization. So what this customization will do is it's going to actually set these pod security policies instead of audit, which is the default mode that they're configured in, it will set them to enforce. And this means that now if I try to create an insecure pod, that should get blocked by default, right? So to test this, what I'm going to do, you know, one site that I use for testing some of these insecure pods is there's this site by a company called Bishop Fox in the security space. They have the site called bad pods, which shows you, you know, like pods running with the host name spaces, which run as, you know, root like several other things are not configured correctly in the pod, right? And you can grab like a deployment or a demon set or things like that. I'll go with the deployment in this case, we'll go for the raw YAML and I'll grab this one, right? So if we, by the way, if we do that same command again, we should see there's several policies configured at this point, right? And I'll show what one of these policies looks like in a second once we finish this. But now let's try and run, you know, this pod. So if I do kubectl create minus F, we'll just give it the YAML. And I see a bunch of errors which came out right away, which are saying I can't run on the host name spaces. And this is the one that we were interested in, to making sure that it's checking not just the pod, but like the containers, but also the net containers. And one thing if you notice is when I install this policy, let me actually show what this policy looks like in Kiverno, right? Because when I installed the, or when you write this policy, the policy itself is written, you know, just on the pod resource. But Kiverno automatically knows again, since it's designed for Kubernetes, it can automatically now apply these policies and deployments, demon sets, any pod controller which you run, even if it's a custom, like something like, you know, Argo deployment, which is a custom pod controller, it will recognize and it will apply the policy correctly to it, right? But this is, you know, what the policy looks like. There's just some, you know, again, we're matching on the resource pod. And then we're checking in the security context and we're saying run as non-root. So if security context this, this means this declaration means that if security context is configured, run as non-root should be true. And similarly, we're checking, you know, for init containers. And then we're also doing the checks, both in the pod spec as well as the container spec, right? So that's really, you know, how simple it becomes again to configure and run these policies. One other thing I can just quickly show is if we do get policy report, minus, minus all, or let's try minus a, I can see that for my existing, you know, you know, pod, which I was already running. Now it's generated, you know, some policy report. And if you look at that, you know, let's just do minus O YAML. I'll see all the details of what, you know, past and what failed, right? So actually this is in the namespace tests. So I need to do that. And it shows me every workload where, you know, which and every rule that it applied, which ones passed, which ones failed. And of course all of this can be collected. There's other open source tools. There's ways to get this into Prometheus. You know, so there's several ways to kind of report this information. In fact, I think I have some slides on that here, which I was showing the default dashboard, as well as there's, you know, a policy report or project, which can show this information graphically as well, right? So lots of interesting things, but, you know, let me pause there, I think, and see if there's any questions. Otherwise we can, you know, keep the demo short for today. And certainly happy to follow up with more details. I have a question. So very interesting stuff. And of course, I'm always supportive of anything that brings us to policy oriented orchestration. I really think that is the future of, we'll keep seeing more and more policies being used in lots of areas. I'm thinking of the topology operator for Kubernetes as well for policies for placement. But my question is maybe if you want to talk more about how this would directly be related to CNFs and where you see it in telco being especially important. Right. Yes. So one quick thought is just making it easy to automate, you know, as you're doing testing, as you're doing validation, certainly this can be also integrated in your CI CD pipelines. So that's a very simple, you know, simple set of policies, which can be managed through GitOps or any other, you know, solution you wish. The other thing which, so one, by the way, you know, something which may come up is of course, and we often get asked how does this compare to OPA gatekeeper, which do perform a similar role, right? So the main difference is how do you author policies, but then other powerful use case that Kiverno enables, which OPA gatekeeper doesn't is to be able to generate resources. And that is also another, you know, area where if you want to create policies for workload, you can in fact have policies to generate policies, you know, policies to distribute common, you know, elements to set up different things, which helps, it really helps in decoupling, you know, creating that separation of concerns, decoupling what the developers have to do, from what the operators have to do, which is a fundamental problem right now in Kubernetes and scaling Kubernetes, right? In fact, in this, I think I have a slide here where Richard talks about, you know, just policies acting, using those as a contract and helping decouple what developers care about, what security cares about and what operations cares about, is where I think Kiverno can help quite a bit. So one area that you could probably help with in this scenario is like we have policy on networking and similar, and I know you can help in that, if that networking is through a Kubernetes based, and Kubernetes aware CNI. But one of the things that we see within the networking and telecom service provider space is that there are secondary networks that may not have the same set of policies, or may be unaware of Kubernetes, but end up as secondary interfaces within pods. And if you have a way to help with where the policies that are there can be rendered into the appropriate SDNs so that the policy can persist, regardless as to whether which direction it's, that information is coming in from, or to help with the control of that, I have to say like what systems should be able to connect to each other or not be able to connect to each other based upon a set of rules could be very valuable. Yeah, in fact, Victor and I were discussing that use case, right? So from my understanding, it seems like what's necessary is, based on the cluster configuration, your developer or the author of the CNF may not know how the cluster is configured to operate. So you probably want to inject some of these settings and add admission controls. And it could vary based on where the CNF actually ends up running. Victor, not sure if you want to add anything else to that or? I don't know, you're very correct. Yeah, one use case that we were talking about was the usage of NSM. But yeah, for example, MULTUS and Dannon can also include a few modifications or validations in the creation.  And I guess it's proposing another cloud native way to do the things or more like Kubernetes way. So I don't know, you mentioned like there are a few default policies that can also take advantage of them. Yeah, so this policy library, so there are the pod security policies, but there's also like policies you can have for, you know, generate, mutate, validate. Like we, of course, with every namespace, you know, it's always good to have a default network policy. But these can be also customized based on the deployment or whatever needs to be done. Like we were talking about like injecting a secondary network and, you know, configuring the pod for that, right? So I think there's a use case. Let me see if I can find that which it's kind of similar to injecting a sidecar in some ways, right? So it's a fairly elaborate sort of in this case here. We're, you know, kind of checking for certain things and creating a new container and as well as an innate container based on, you know, the policy setting itself. So, but yeah, in terms of defaults would highly recommend if, you know, and I know the team has already been looking at the running as non-root, but starting with pod security, there's several other controls which are, you know, part of the pod security standards. So certainly enforcing those because there's no typically, you know, most pods don't need to run with higher privileges. Most pods don't, you know, shouldn't be using non-default volume types, shouldn't be using host path, privileged, you know, kind of having again requiring escalated privileges, host namespaces, all of that can be blocked by default, right? So starting with this set of policies is always a good best practice and then auditing for that in your CI CD pipeline, reporting and then of course enforcing in production. And also, Freddy, the use case that you are also mentioning about producing multis, maybe another possibility could be adding validation which ensures that you have redefined the additional network in multis. So if someone is trying to use an unexisting network, yeah, you can, I'm pretty sure that you can catch all these things because at the end it's just like a single annotation. So I'm pretty sure that Kiverno can catch and do some logic to ensure that that network is. Yeah, and it's an issue not only in multis, but it's like you land an interface and I could even use network service measures as an example. You land an interface here and both of them have some level of control as to like who's allowed to put the interface there. There's a portion there that could be bound against. There's a little bit more flexibility in network service mesh in terms of how the policy can get injected and enforced, but neither one of these has the component that's already built in that is how do you actually program the SDN itself? Like maybe you have certain rules that need to be within the SDN when something is set up, how do you ensure that those rules have been rendered into the SDN itself? And so those particular types of things would be useful in both the NSM and multis solutions because then if you could define what those rules look like here, then you can render them into each environment and ensure that they're getting applied consistently across the board. Are those rules expressed as a Kubernetes resource or are they through a custom resource or a config map or something like that? They're not expressed at all is the point. Being able to, like there was some literature, I don't know if it ended up in the CNTT path where if you are adding a secondary interface, you have to make a decision. Are you respecting a Kubernetes policy contract or are you not?  And that distinction was made necessary because if it's non-compliant, then you have to rely on the SDN and additional configuration. And yet you want to make it explicit to the person who's configuring it that they have to pay attention to this. If it's compliant to Kubernetes, you're just providing a faster path. Like maybe I have a web application that needs faster access to a storage system. That storage system is exposed in Kubernetes and that you're basically providing a faster Kubernetes path. Then what you're doing is you're saying the SDN has awareness of the cluster and is able to monitor the policies and is able to render those policies regardless as to where the, regardless as to whether you're taking the slower path or the accelerated path. But that was a distinction that was added at that particular level, but there's still that issue about what rules do you want to apply to the secondary networks that are non-compliant to Kubernetes policy. And being able to just to match, like I have these particular things that I want to have these type of connections with and being able to then set something up where you could eventually interpret that into the appropriate SDN. Like this, I would not provide this with the full set of that, that full path to get there, but it could be that first initial step as to like, here's the first half of the problem where we could even express that. And then how do we render that into the SDN is still an exercise that needs to be done, but we'd be a step closer. Okay. Yeah, so happy to, you know, again, help explore and write out some of these policies. We are fairly active, of course, within the Kivarno community, helping users with different use cases. Like we are also like, for example, here you see policies for CERC manager. There's domain specific and other policies. Flux, one of the GitOps controllers is also using Kivarno for multi-tenancy. Open EBS is using Kivarno as well for pod security. So several projects are starting to adopt. But so, yeah, if it would love to kind of work on CNF specific policies, explore some use cases and help kind of advertise what Kivarno can do. All right. Thank you. Any other comments, questions, or other topics? I guess we only have two minutes, probably not another topic. Thank you, Jim. You're welcome. Thanks, everyone. Yeah, please reach out. I'd like to talk to you about how you can, I guess, get more engaged for writing up some of those best practices that you're showing in the baseline maybe. We could talk about use cases that would be, make it relevant to the folks in the networking, communication service provider space. And I can talk with you maybe about the test suite. Sounds great. You see my email in the Google doc? Yes. Contact me that way. We're on Slack. Thanks, everyone. See y'all next week. Thanks.


For the last 60 years, the Navy has relied on steam-powered catapults to launch our aircraft. The electromagnetic aircraft launch system EMALS has been installed and tested on the first two catapults onboard Gerald R. Ford. EMALS greatly expands the limited ability of the steam catapults in terms of being able to launch heavier aircraft, but also lighter aircraft with a linear acceleration curve that will reduce the wear and tear on the aircraft. EMALS is built much differently than the steam system, so it's designed and built with maintenance in mind, so the maintenance requirements of this are reduced. EMALS will revolutionize the way that we launch the aircraft today and into the future for this new class of aircraft.