R Slash Backrooms is a very interesting place to say the least. As the official Backroom's Reddit page, it sees a variety of different posts, cool liminal images, interesting found footages, and unique lore additions from everybody in the community. As well as some other things that are just dumb. But sometimes, amongst the noise, strange and unnerving posts slip into view. My very real encounter with the Backrooms. This was the chilling title of Reddit user's Alex Bass Guy's post to the subreddit over four years ago. In this video, I want to examine this post, read it, go over it, and share his alleged real encounter with glitching outside of our reality. There are several encounters like this on the Reddit. Some of them are fake, but some of them are what I think to be real encounters. This post was made four years ago in 2020, which was well before the mainstream popularity of the Backroom's concept, especially in the found footage department. At that point, the Backrooms was mainly a niche internet's creepypasta. You might have seen the picture, you might have seen the 4chan post. The lore itself wasn't really fleshed out, and there was no mainstream popularity. The original poster, Alex Bass Guy, shares his personal real life experience with seemingly slipping out of the reality, which is the frontrooms, and into a Backrooms-like place. I'm going to read the post to you right now, and then I'm going to examine and break it down. So sit back, grab a bowl of popcorn, grab a Dr. Pepper or something, and enjoy this story. Keep in mind, this is an allegedly true encounter. I can't verify if it's 100% true, but the OP seems to believe it is. Today, I stumbled upon a YouTube video from the excellent Nick Crowley discussing the phenomena known as the Backrooms. As someone who has spent literal decades savoring the strange, the dark, the occult, the conspiratorial, I have somehow missed out on this particular phenomena story concept. Watching his short, but intriguing overview of the Backrooms, it made my skin crawl. I had a very real, very waking experience just a few years ago, which took me to a place that is disturbingly similar to these so-called Backrooms. Imagine my surprise when the video, and most related content, described this as nothing more than a creepypasta with its roots in 4chan, and while my experience does have a seemingly innocent explanation, the similarities are far too intriguing to ignore. This is all 100% true as it happened to the best of my recollection. For background, I am a professional musician and a record producer with a career that started in 2010. Nowadays, I spend my time in the studio, but for many years, I toured the US full-time as a bass player with a wide variety of bands. In mid-2017, one of the larger bands that I toured with, 40 oz to Freedom, a sublime tribute act, was hired to play the Brooklyn Bowl in Las Vegas. This was an excellent gig, it paid great, and we were always treated very well by the staff. The Brooklyn Bowl is part of the Caesar's family of properties. As such, we were always put up in the very nice rooms at one of Caesar's own casinos on the Strip. On the night in question, we had been placed in individual suites at the Link. After playing the gig, we all went back over to our rooms, my bandmates were excited to spend the rest of the evening partying it up on the Strip and hanging with fans. However, I had a very early flight out of McCarron the next morning to play with a different group back home in Colorado. I decided to forgo the offer of a night of fun and just relax in my room until the flight left. From around 3am, I decided to go down to the lobby for a snack. So I got dressed, put on my shoes and left my room. I walked to the end of the hallway and called the elevator. Getting on, I pressed the big rounded L button. Lobby, that's when things got strange. The elevator lurched slightly, as if it didn't quite know what to do with my request. The overhead light flickered out for a split second, but after a beat, as if nothing was amiss, it began its descent without further protest. In the moment, I didn't think much of it. It was late after all, perhaps it had been sitting for a moment or just did maintenance. But when I reached my destination, I knew something was wrong. The door slid open, but where there should have been a bustling casino lobby, there was simply a large empty white room. A rusted red painted metal staircase led down from a landing in front of the elevator to the floor, opposite the staircase, an enormous red metal door. Above the staircase, a loudly humming, off-yellow fluorescent light. Initially, I was baffled. I looked at the display in the elevator. It confirmed this was indeed the lobby. My mind raced to all sorts of stories and places I'd learned about. Glitches in reality, underground cults, human trafficking rings, illicit auctions, Silent Hill, but all of that was just lore. I had to know what I had stumbled on. I walked down the staircase and approached the door. By sheer luck, it was open. I swung it open and stepped through. Around a sharp corner, there stretched a long, faded hallway with seemingly infinite rooms branching off in either direction. Aging, greenish yellow wallpaper patterned with what looked like a leaf or floral motif, dank, musty, moist carpet, all lit by humming, flickering fluorescent tubes. A sharp sense of danger and wrongness tingled through me.  How did I end up here? I decided to press forward a bit, overcoming the impending sense of doom that it consumed me. I walked up the hallway a short distance, peering into some of the rooms. Each was dark and empty, devoid of windows and covered in the same fading wallpaper. There was what looked like graffiti here and there, scrawled illegibly on the walls in black ink. After venturing past three or four rooms, each step became a dare. I knew I should turn around and go back to my room. Whatever this place was, it was not a pleasant place to be. It made no sense. And so, trusting my better judgment, I turned around, went back to the red door, up to the staircase, and called the elevator. After what seemed like an eternity, the door slid open, and I was whisked without incident back to the plush confines of the link. I had decided that I suddenly wasn't hungry. Several hours later, I readied my things to leave for the airport. I got on the same elevator, wondering if it would take me to the same strange hallway. I pressed the large rectangular L once more, no shutter, no flicker this time. Just a moment later, the door was open to reveal the bustling, pre-dawn casino lobby that should have been there all along. Now, as I said at the beginning of the story, there is a partially plausible explanation for this experience. The link was established in 2014 after a short two-year stint under the name The Quad. But prior to 2012, the lot belonged to the Aging Imperial Palace Casino. The Imperial Palace was built in 1979, and it featured an Asian-themed decor. My best guess was that I somehow happened upon a section of the hotel that was simply a part of the old Imperial Palace that hadn't been renovated. Descriptions of the interior of this old property roughly match what I saw. However, there are still key elements in my experience that made no sense to me. The Imperial Palace was destroyed to be rebuilt as The Quad in 2012, five years before I was there. How would any section of the old hotel still remain? Even if there was, in theory, still an untouched portion of the Imperial Palace left under the building that was torn down, five years of renovation were done and two name changes occurred. Why would this area be easily accessible to guests and through a strange service entrance, no less? The elevator took me to the ground floor, yet the area I was in was clearly old hotel rooms. The ground floor of casinos almost never house rooms, only food courts and gaming floors. Rooms start on the third or fourth floors. Why were these rooms seemingly on the ground? The exact button on the exact same elevator took me to the Link lobby the second time around. Did the elevator massively glitch the first time? These questions all remain unanswered. So did I find the defunct hallway buried in the bowels of a casino or did I stumble through a strange barrier into the back rooms? I leave it to you to decide. That was the full story that this Redditor experienced of slipping out of reality, glitching to the matrix into the back rooms, whatever you want to call it. The original poster then went to the comments stating that this is quote, not an ARG, I promise. I'm just a normal dude who had a very weird experience, LOL. I'll keep everyone updated regardless, end quote. So now that you've heard the whole story, let's take some of those key details he mentioned and go over them. The OP gave the brief history of the hotel and explained what the original building was and that it was built back in 1979. The original name, of course, being the Imperial Hotel and Casino. This is what that place originally looked like. So OP said that the possible explanation on what he stumbled into was that he found an old defunct part of the Imperial Palace that never got demolished or renovated and it was kind of just sitting underneath the modern day casino. I have two main issues with this theory though. One, I cannot find any underground blueprints for this building's construction that would lead to there being rooms with no windows. That just doesn't make sense. Like from a marketing standpoint, you're not gonna have a hotel room with no windows. That just doesn't jive. The second issue I have is that OP said there were lights on the ceiling in different spots inside this backroom's area. I know for a fact that businesses do not wanna keep any lights on or any heat or cool on in places that are not being used or are not making them money. So if there was truly this entire network of hallways and rooms that were just untouched and under the casino, why would the building still be paying for there to be electricity and heating and cooling and why would they still be providing those services for this untouched room? Companies don't ever wanna waste money like that. We all know, of course. They're all greedy. Switching out of reality is actually not an uncommon thing to happen. There's hundreds, maybe even thousands of experiences on Reddit alone of doing this. And with OP clarifying that this is not an ARG or a joke or anything, like you actually experience this, it just lends to the creepiness of the entire fiasco. So what did the OP actually experience? Did he wander into a trafficking area where humans get sent to to be detained? Did he get into an underground cult place? Or did he just find an old hotel that somehow survived three demolitions and never got remodeled? The place this poster described was very similar, but also not so similar to where it's a copy of the back rooms. The place he saw was greenish yellow and not just bright yellow. The lights were dim and dingy and not bright and fluorescent, but there was the familiar humbuzz that reminded him of the back rooms. He also witnessed this place before he knew about the back rooms, which lends to his credibility even more. There are plenty of strange places in hotels and casinos where maintenance staff and where people like that go that are not typically seen by the public, but this doesn't seem to be that place. If you press the lobby button, you're gonna go to the lobby, but it seems as if OP went underneath the lobby because the alleged rooms had no windows, just to dingy lights. Also, the small detail that there was graffiti on the wall means that it was accessible from other people as well. Did others find this strange connection to slipping out of reality or is this truly just an abandoned place? My personal opinion is one of two things. One, it's actually allegedly real, or two, it's an ARG and he's just lying. I know for a fact, as I mentioned earlier, that a company is not gonna pay for the electric, the heating, the cooling, and for this place to be maintained. Why would that be a thing, especially if it's these multiple rooms and hallways that the OP described? And if they did, they wouldn't make it accessible from the elevator that all the guests use. Even if there was a glitch, they wouldn't want people going there, of course. I've looked at old pictures from the Imperial Palace and I cannot find any pictures with no windows. I cannot find any blueprints of it that would lead to the underground place. The rooms themselves are very liminal and creepy, but they don't have greenish yellow wallpaper. They have tan wallpaper, so I don't know. But that was the allegedly true story of the Redditor who got lost and sent to the back rooms. Hope you enjoyed. If you did enjoy, and if you watched the entire thing, I would appreciate it if you dropped a like to push this video out to the algorithm so other people can see it as well. If you also want me to go over like more glitching out of reality and like R slash glitch in the matrix stories, I'd be glad to do so. I enjoyed it. I hope you enjoyed it as well. I know it's a little different from normal, but we're expanding this year. We're growing. We're doing some different stuff and I thank you all for supporting me through this journey. Love and appreciate each and every one of you. I look forward to seeing you in the next video. I'm gonna be honest. And on that note, I will see ya in that next video.


Hey everyone, welcome to this lightning talk on using Orgo workflows to curate Kios engineering with litmus kios. This is Sairna and I work at harness at senior software engineer and I'm also one of the core contributors to litmus kios. So to start off with first of all, we need to know what is resilience.  Let's say a pod gets evicted from the node. So what is its state? Is it healthy or not? So it is healthy than it is resilient. So the period, the time period between going down and bringing itself back up is called resilience. Then moving ahead, downtimes are expensive, not just in terms of money, but also there are other aspects as well. The secondary factors which are equally important as money, that is, some of them are loss of customer confidence, damage to brand integrity, loss of employee morale and a lot of others. So keeping all these factors in mind, we definitely want to avoid downtimes at any cost. So one of the way to achieve this is adopting the practice of kios engineering. So with that, I would like to introduce kios engineering, which is the process of testing a distributed computing system by injecting fault intentionally. So the goal here is to identify the weaknesses in the application through control experiments and check if it can sustain, it can withstand unexpected behavior or not. So how it is done? First of all, you need to identify the steady state conditions. Steady state conditions is the desired behavior of the application in a given scenario when it is healthy. So first of all, you identify them, then you introduce a fault intentionally, and then you check whether the SLOs are continued to be met or not. If yes, then it's very good, and if it's a no, then we can fix the issues and then come back and we can continue the same cycle again and again. So yeah, moving ahead. With that, we can introduce litmus kios, which is an open source cloud native kios engineering framework. And it also has the cross cloud support as well. And it is now a CNC incubating project with adoption across several organizations. And its main mission is to help SREs and developers to find weaknesses in both Kubernetes and non-Kubernetes applications as well. So lastly, I would like to talk about why we shifted to Orgo workflows in litmus 2.0. Before that, I will talk about what was happening in litmus 1.0, the first version. So in litmus 1.0, the kios injection was basically done by just applying this litmus CIDs such as like the kios experiment manifest and all the other components. We just did a kubectl apply of these manifests. And there was no proper visualization. And it was only one experiment at a time. The kios injection was done only one experiment at a time. So keeping all these facts in mind, we decided to integrate Orgo workflows with litmus kios. And these are some of the features, the main reasons why we decided, why we chose Orgo workflows. We can define workflows where each step in the workflow is a container. So as I said earlier, the kios injection was done only one experiment at a time, we can execute only one kios experiment. But with this, we can have multiple kios experiments spun together as a one single workflow, which is considered as a kios scenario. So each kios experiment can be a single container. Then second, second point moving on to the second point, proper visualization of workflow or the kios scenario can be done using a graph. So that is also provided by Orgo. Then next is individual template in the kios workflow can be tuned independently, like we can tune each individual template without affecting the whole kios scenario, the whole workflow. And then sequence of steps can be changed as per the requirements, such as like, let's say you added experiment one first, and then you added experiment two, but later you decided you want to alter the sequence. So you can like, we can also do that with Orgo, you can put move the experiment two in the first. So that can be done. And lastly, this is also one of the important features, that is, the experiments can be run in both parallel or in sequential manner, which was not there in litmus 1.0. So yeah, so these are some of the important features and reasons why we decided to shift to Orgo workflows. And that's it. And now Amit will be giving a small and a brief demo of how the kios engineering can be done with Orgo workflows and litmus kios. Thank you. So hi everyone. I'm Amit Kumar Das. I'm also a senior software engineer at harness, and I've been contributing to litmus kios from past two years. And I'll be giving a short demo on how we can use our workflows with kios center to curate kios engineering. So let's get started. So I have installed the kios center and banking application, which is a bank of Anthos application on my GK cluster. So we'll try to target a few of its services which are like the balance reader service, the transaction history service and some of the services as well. So if I see like we have installed the bank of Anthos application in the bank namespace and we have few services running here. So from the kios center, we'll go to create a new scenario and here we can select our agent. And in the next step, we can select the kios hub. So kios hub is basically a marketplace where we can find a lot of experiments, which can be used as per a user's requirement. So we have selected the kios option. I'll provide a name here. So I'll be deleting the balance reader service of the bank of Anthos application. And here we can add the application and tune the same. So yeah, so I have added the pod delete experiment and I'll try to target the bank namespace along with the balance reader label. So this will actually target the balance reader deployment, which will basically delete the balance reader pod. And we should see that the balance should not be displaying here. So let's go ahead and click next. So here we can add different types of probes. So I'll just go with the default configuration. So I'll click next. And in this step, we can tune our kios experiment. So I'll just make some changes. And I'll just increase the total kios duration to 60 and keep the other environment variables as it is. And I'll just click next. And in this step, we can make some advance kios engine engine configurations. So I'll just keep everything as default. I'll just finish this. And yeah, so I've made some changes in my kios experiments that should be visible when I inject kios. And if I want to see the manifest so I can see that this is a basic workflow or workflow and we have provided several steps over here like install kios experiment step, the pod delete step and some other metadata related to these steps. So if I go to this particular step, the pod delete step, I can see that we have the kios engine and we have the target application details, which is the bank namespace and the labels that we are providing to target our application, as well as the environment variables that we have provided from the UI. So I'll just continue and click next. And I will have an option to create a schedule now or we can also schedule it later. So for this, we are using the Cron workflows, which is also provided by Argo. And we have several options like we can tune the recurring flow of the Cron workflow. And for the demo, I'll just create a current schedule. So I'll be scheduling it now. I'll click next. And this is the final step where we can see all the details that we have provided in the previous steps. So I'll just click finish. And yeah, so a new kios scenario is created. And if I click here, so we can see that the run has started and I can actually visualize the overall workflow. So in this workflow, we'll be targeting this balance reader service. So if I go here, I can see that the balance reader service is up and running. And if I go back to my litmus namespace where we can see that a pod delete runner has been created, which will actually target this balance reader service. So we should see that this balance reader pod getting terminated. And yes, it is happening now. And if I refresh this page, I should see that this balance is not visible. So yeah, so we have successfully induced chaos on this bank of Anthos application on this balance reader service. If I try to add some amount like and I deposited so this will be happening, but we will not be able to see the balance. So we have from an end user side, you don't want to see transactions going on, but you are not able to visualize or you are not able to see the overall balance. So this is how chaos engineering is performed using the litmus chaos and chaos center. And we are using the basic arc of workflows to curate chaos engineering. So yeah, so let's wait for a while to let this experiment complete. And we can see all the logs over here. So these are the logs which are available with the chaos experiment. Yeah, so we can see that the workflow is completed. And we have the overall logs here. We also got the chaos results like the phase is completed and the verdict is passed. We got the probe success percentage. And if you go back, we can see that the balance reader pod is back into its ready and running state. And if you go back to the application, if I do a quick refresh, I should see the balance coming up. Yeah, so the balance is coming up. So we have successfully injected chaos on one of its services, which is the balance reader services. And yeah, we can also try to inject chaos on some other services as well. So yeah, these, these all can be performed with the chaos center of litmus chaos. And so as part of the demo, like we have seen how we are using our workflows, as well as the Cron workflows to inject chaos on different microservices. And that was pretty much it from my side. So thank you, everyone. I hope you liked our lightning talk. And yeah, thank you so much.


I'm Sandy Allnacht. This is Giallo in Vienna and we're going to give you a little tour today of the art in my house. I'm close to finish with, if you can ever finish with a home redecorating. I needed new carpets desperately, which of course led me to paint the walls and rearrange things and clean things up. So I thought I'd give you a tour of the art. That painting was plein air done out here in Washington, I think about two and a half, three years ago. This one was painted plein air in a park nearby and this one kind of has all of the colors that are going to be throughout the house. A gouache painting up above and down here we've got a piece that my dad did. My dad used to make wooden things, so I hang that up there in his honor. And this is this room before it was transformed. I used to have all the crosses above the fireplace, but I simplified it a bit. I've simplified all the walls actually because I used to have three times as many paintings on the walls. Because over the years I just kept framing things and framing things. And there were paintings I did back in the beginning that were not so good, but I kept them in frames anyway. And I thought if they're framed they should be on the walls. Well, I decided eventually, you know, those could sit in the garage until I have something better to put in that frame. And then I'll get it back out. So I'll keep changing the art over time. Now these bookshelves were plain old wood and they were falling apart and kind of cheap. So I thought why not just paint them so that they do a little bit of disappearing in those sections on either side of the fireplace. And I really liked how that came out because they're very, very busy and fussy. And then the simple painting it's a half page. My only half sheet painting is hanging above the fireplace, that lighthouse. But then I've got all of my books from the whole house congealed into these two bookshelves. I gave away tons of books, which is really good feeling. My angel collection from my godmother, she used to send me tons of angels. And then this is a painting by my mom. My mom's a spectacular oil, oil and acrylic painter. And there we've got more angels, more angels, more angels. On the way to the garage, there's a drawing that I did of a truck. This is the only finished drawing of a nice truck that I've ever done. And I thought on the way to the garage would be a perfect place to put it. Because there was a hole in the wall that I did a terrible job of repairing anyway. But there you can see my new washer and dryer. I saved for nine months washing all my clothes by hand for nine months. Saving up for that. That little cabinet on the right is all my tools. And on the walls in here I painted, it's hard to see with the glare of the light, but I painted bubbles. And just to the left of that is a wall that has all the dog walking supplies and the dog's paintings that you saw in the previous video. We'll link to that and everything else that has a little icon on it. There is a video for this section was what I used to think contrast was because I painted that kind of mid green. And I realized that was not dark. So you'll see more dark throughout this, the walls in this video. So I move the crosses over here instead of over the fireplace. And they're on the light wall, which really helps and gives just a little more contrast to them. So they're seen better. And then we've got a couple more pieces on this wall in the other room going around the corner. I had this weird pink color. So green in one room, pinkish in another. And I was trying to figure out what color I wanted to go with. I really wanted something more neutral. I just have been wanting neutrals around me. Just I don't need that much excitement color wise. And when I got to using this dark blue gray, I just got so happy. It just really worked. And especially when you look at it in different lights, sometimes it's more blue, like a pain's blue gray. Sometimes it's more of a gray, like a pain's gray blue gray. You know that that color can shift different ways. And I sit here in the evenings on the sofa, watch TV, catch up on the news and enjoy this little spot quite a bit. This is a seasonal series that I did of trees in spring, summer, fall and winter. There's Jello trying to steal the stage once again. And I watch TV on my old iMac. I serve up my old iMac with TV and music. The paintings that I chose for this room all have that pain's blue gray feel to them. And you can see over there on the right hand side, there's a little bit of black on the walls. Yes, we'll get back to that in just a few minutes. But yeah, I really have discovered over the years how much I love contrast. So you'll be seeing lots of that. And back around to this painting, which again has all the colors all over the house from the darks to the lights, the yellows, the blues. The hallway now has all of my family photos in it. They used to be scattered everywhere and I love having them all together. It's like my whole family reunion gathering in the hallway. This room was painted, I think, two years ago. And some of you on social media may have seen some of the steps of that along the way. But I wanted to paint a border to match the shower curtain that I found for inspiration because I can't paint a straight line. I don't care how much tape I use, it's not perfect and straight. The paintings here are by my mom again. And there's two watercolors in this room. One is plein air painted outside my house one year when we had snow outside. And the other one is painted on the beach in Oregon. So I have varying temperatures in this room. Next we go over to my bedroom and you can kind of see the contrast in the wall colors here a little bit better because they've got a big old light in there. This room just doesn't have any lights. They didn't build it with lights. So I just have little lamps. But that one wall is chocolate brown and there's grays elsewhere. I wanted this room to feel very neutral. But I really wanted this focal piece on the wall. It's a watercolor with pen and ink that I did a while back. And I ordered it as this block, these wood blocks from Society 6. And while you zoom in on it and it looks a little fuzzy from a distance, it looks spectacular. I mean it was blown way up from a smaller piece. So that's why it got a little fuzzy. I don't even care because I think it looks amazing in here. On this wall, I've got one of my drawings that I did many, many decades ago. A baby elephant surrounded by parent elephants. And then this is a drawing that I did when I was in second grade and I want to ribbon for it. It's on the very first Earth Day and it says stop pollution. And then this is one of the largest pencil drawings that I've ever done, this wolf. And you can't really tell, but there's a blue sky in there that took the longest time out of anything, trying to get an even blue sky behind it. Of course, the dogs have fallen asleep in the time it took me to walk around the room. That's kind of how the life they live goes. So there you are. My fish tank is back with having fish in it. You saw those in a recent video. These three are also videos. They're all graphite. And I wanted that black and white feel in the room. So we've got Harry Potter, a squirrel on a throne, and dogwoods. Each one of those is available in the links down below. This is the LDF flooring that is in the bathroom's kitchen, laundry room, etc. Compliments the wood floor that's in the studio and everything else. And in this bathroom, I used the same chocolate brown, but I used it with white instead of gray as the accent. Painting up there in the window is by a friend on Instagram.   In the studio, this is the desk that I use. It's a giant one that top lifts up so you can have it at all different angles. And then I just have art stuff everywhere and snacks, of course. And I rearranged the art on the walls. I put new pieces up and some pieces I just removed and put them in a different area. So it just feel very different. This one is brand-newly framed to the left. The hexagons, by the way, is alcohol ink. And the sunset is in pastels. And then this one is colored pencils. So you kind of get an idea. I kind of do all the mediums and then we've got watercolor here. So I've got kind of a whole smattering of inspiration stuff there. On the opposite end of the room are two big, long shelves. And I've just collected a whole bunch of pieces that inspire me. Some of them are ones that I did that I want to either redo something around them, something like them. The dog there is by my mom. And then this piece right here is Starry Night done in Quilling. I bought that. It was a fortune, but I bought it on Etsy. And it's so amazing. I want to do some Quilling at some point. We'll see when I have time to do that. The cat drawing is by a student of mine. So thank you for that beautiful tribute to my Punchinello. This drawing, I think I did in high school, might have been college. Couldn't remember when I did the iris. The Madonna and Child was Pyrography last Christmas. This round piece is a piece of bamboo that someone in Puerto Rico painted on. But that was a cool thing. And then we've got a print that I bought when I was at a gallery. And then above that is the Copic Hex Class piece. It was kind of cool. A card that was made by someone. I need more cards for this now because as I cleaned everything out, I realized I need more cards to put back in here. And then that one is a map that somebody did a gouache painting with pen and ink on. I thought that was a cool idea. While that was heating up, I decided to open some mail. Now let's head back to the other end of the house and pick up some things that were in the box. So thank you to those who sent me some encouragement. That window, by the way, is from the dining room looking into the kitchen. So there is that little opening. I would love to just tear that whole thing out myself and just make this all open. But, you know, sometimes you got to wait until you hit the lottery before you can do the things you want to in your house. But you can see the pathway that you can pass food back and forth from the kitchen into the dining room if needed. But let's look through some of the things that I did to the kitchen. This used to be all brown cabinets, just plain boring brown cabinets that they put standard in houses. And I painted them black, which scared everybody. I told people and they were like, you're going to do what? But I painted the walls yellow. It's the same yellow as in the studio.  I finally hung up Pepepe and Grandma. They're plates I hadn't had up in. I can't even remember how long and I painted little details onto the cabinets because I wanted something a little less, not necessarily oppressive because I don't find the black to be oppressive. It just kind of disappears and makes the yellow really pop. But I thought maybe I'd decorate them up a little bit and put some vines and leaves on the cabinets themselves and then on the knobs that I added because I used to not even have knobs or door pulls on anything but I've added flowers that have the same blue that's in the bathroom and the laundry room and the same yellow for the centers that's on the walls. In front of the sink I painted for his glory from 1 Corinthians 10.  So it's in the kitchen about eating and drinking but it says whatever you do do it for his glory and since I know I'm going in the kitchen every morning like that's what I go to the kitchen bathroom. They see me every day. I thought that would be a good reminder to myself to just keep that in mind all the time. And these are the two cards you saw earlier so thank you to these ladies for sending me a little encouragement. It means a lot. So I appreciate that. So here we have another piece that is an acrylic tray that I got from Society Six with one of my paintings and you can order all different kinds of stuff there. It's kind of cool. The things that they'll put art on. And here we have my fox painting and now we get to my favorite spot in the whole house which is the area not just this table but the area around it. And I'll show you more of how the table got made in just a bit here but I wanted to give you a preview of what it had looked like before. It was just kind of pink. Just pink and too many things on the walls and I started painting the black and I just went, hmm, can I do this? Can I do this? And I was texting a friend like, what do you think? Is it too much?  I absolutely loved it. I loved half a wall. The whole wall would have been too much but I love that great painting with the dark frame and the dark matting and it goes well with the dark table and it just, I don't know, just really works great and a drawing that I did of my kitty and then let's look at the table itself. Now this table had been painted about 25, 30 years ago. I painted it myself but I made the mistake of not using any epoxy to protect it. You can see there's dings on it. There are places where it got kind of dirty and I just could no longer wash it anymore. Like there's just, if I started washing it even stronger with more chemicals, it would just peel off the paint itself. So that's when I decided to just go a completely different direction and I painted it all black. I painted the black chairs and the black tabletop while the old carpet was in because I didn't have to worry about making messes on the floor and then when the new carpet is in which is what you're seeing under my feet there, I could just paint that center section which was much easier to do in the middle of the table. I started by using chalk to make the drawing. I combined two sunflowers. One had a really detailed center in it but the outside petals were just very boring. They were all the same shape and then I had another sunflower picture that had these really cool kind of floofy sorts of petals but it had a really boring center in it because it was so deep and dark that you didn't see any detail. So I combined the two so that I could put a really nice middle in it with a lot of these different dots of color. The green dots are actually not green paint. That's yellow paint on my brush that I've used a wet brush to pick the color up with. So it's basically thin yellow over top of brown and I got a green out of it. So I was very excited to find ways to combine some of these things or water them down so that they would turn different colors because I didn't have a huge selection in terms of colors to blend with but I may do with what I had because I wanted to use up all these paints that was one of the reasons for repeating colors throughout the house. I didn't want to buy another can of paint and have another can of leftover anywhere. I just wanted it all gone. I even have another artist friend who wants to paint some furniture black and she's going to get my black leftovers and anything else that I might have that she's in need of. So that is pretty much it for the art tour in my house. Hope it was inspirational to you.  Get a little bolder with color because, you know, you can always paint over it. No big deal. Before I go, a little heads up in July which is going to be my next video. I'm going to start posting my videos four hours earlier. Just doing a little test to see who's around when. So if you're somebody who likes to watch the premiere of a video then look for it a bit earlier. I'll set it to be a premiere so we can join and chat together while I paint because it's going to be a watercolor one for World Watercolor Month. I will see you guys then. Take care.


Great. Well, first off, thanks so much for coming to the session. I do have a request before I get started. Because the confidentiality of this session, I wanted to ask that you all agree to not share any of the takeaways from this session with anyone else. I thought that would be easier than making you all sign an NDA. Is that fair? Okay, cool. Right, so my name is Laconde Mwila, and I'm a developer advocate for Kubernetes at AWS. I'm part of the EKS team. I'm also a CNCF ambassador, and I'd love to connect with as many of you as possible. And if I don't get the chance to interact with you directly here, please feel free to reach out to me either on Twitter or LinkedIn. The developer advocacy team that I'm a part of also has a dedicated YouTube channel called containers from the couch. Some of you might have heard of it, and we post a lot of Kubernetes and cloud native related content over there. I also have a channel of my own.  Great, so I don't know about you, but one of my favorite things is to hear people's Kubernetes introduction stories, how they first came to work with the technology in a hands-on way, not just hearing about it. And I find that generally people fit in one of three categories or camps. There may be more. And the first one would be the group of people who hear about it from someone else. Maybe they read an article, maybe they watched a video, or worked closely with a team that was using it, and they heard about his capabilities, and so that's what got them into it. So if Kubernetes was a destination, they willingly buy the bus ticket to get there. The second group of people are those that don't really have much of a choice. So it's kind of like being told, hey, here's the bus ticket. I'm gonna drop you off at the station.  Third group of folks, the K8s chose me is a little bit of a conspiracy theory. But I believe it, because I think I fall in this category. And with this one, some of you might relate to this. Everything was a blur.  So a couple of chuckles, I think some of you can relate to that as well. So not so much of a conspiracy theory. Now, I think you'd also agree with me that when you just get started with Kubernetes, or actually with almost any new piece of technology, you're excited to, and eager to be an expert. But when you look back on your journey, you'll quickly find that you were quick to come to certain conclusions. And one of the conclusions we came to too quickly was, okay, so this is basically just about figuring out YAML and we're pretty much set. That's half the battle. Time would eventually reveal that we were very wrong. Right now, so a little bit more about the context, right? So I was part of a team, and we had been on a couple of adventures together, and this was at a financial institution. And we were the platform team responsible for migrating a particular microservice based project into the Kubernetes environment. And so we were dealing with a number of microservices that were all going to run as stateless applications in the clusters environment, but they needed to connect to a bunch of databases outside of that particular context. So we needed to find a way of storing the sensitive database credentials. And so that's how we came across the concept of secrets. So we were going to use these secrets in Kubernetes in order for our applications to be able to connect to the relevant databases. Now, if you'll indulge me just a little bit, I want to cater for people who may be completely new to this concept. For those of you who are very familiar with this, the more exciting stuff, as it were, will come a little bit later. But just so everyone's on the same page and we're tracking together secrets in the context of Kubernetes are one of two types of resources that are used to store application configuration data. The other resource type would be config maps. Primary difference between the two is the fact that secrets are used to store small pieces of sensitive information, like database credentials, OOF tokens, and TLS certificate data as well, among other types of data. And over here is just an example of a manifest. And you'll see over there some usual suspects like API version, kind metadata. Those are things that will be universal to your Kubernetes resources. Unique ones in this particular case would be type and data. So data you will also find in your config maps. And these are the key value pairs that point to the sensitive pieces of data that you have. And the type essentially dictates the kind of sensitive information that you'll be storing inside of your secret. Now, when we came across this concept, we had some short lived joy. There was joy because we thought, OK, well, we now know the component that we need to make use of in order to store our database credentials so that they can so that relevant applications can connect to the DBs. But then that bubble was burst really quickly when we found out the secrets are not so secret. They're not encrypted. Now, before we lost all our hair from it being pulled out from our heads, we thought, OK, let's take a step back and let's understand how secrets are actually stored inside the context of a cluster and the flow by which they get mounted into a pod. And so secrets are stored inside of the SED data inside the SED data store or database and they're stored there in a non encrypted format by default. And then as for the flow, the cubelet, which is an agent running on the node or the host inside of your cluster is going to make a request to the SED data store through the API server and then is going to mount it on the relevant host in the temporary file system, specifically on the hosts where there are pods that are trying to consume these secrets. And then finally, our pods can either mount these secrets either as environment variables or volumes. So this was a good starting point for us to figure out how this flow worked. The next thing was to go back to the panic room and figure out, OK, what exactly are the red flags? What are the main risks and vulnerabilities that we need to be aware of? And so we got it down a couple of them. And the first one is probably the most obvious. That is the fact that secrets are stored in a non encrypted format in the SED data store, which was obviously a very interesting conversation with the cloud security team. Again, maybe some of you can relate to that. And then the other thing was the fact that we were used to working with Git and a lot of our Kubernetes configurations were stored in Git repositories. But there was obviously a challenge now when it came to secrets because there would be sensitive values in those particular manifests, which at most can only be base 64 encoded, which isn't actually encryption. And that was going to present a challenge for us and I'll elaborate on that a little bit further in the in the presentation. The next thing was the fact that we were concerned about mounting our secrets as environment variables because the values would be exposed to every single process inside of the pod. And they'd also be a very high chance of the sensitive values being logged at some point. So we considered the option of mounting our secrets as volumes instead. But then even with that approach, we still had to consider, well, how safe are the volumes that these secrets are actually being stored on? So we'll still need to think about security pertaining to those specific volumes. And then lastly is root user exploitation. So if you think back to the flow by which secrets get mounted into a particular host, those secrets are stored in temporary file systems. Now, these file systems are managed by the host. And so if at any point you have an attacker or a malicious user that gains privileged access or root user access, then they could easily have access to those particular secrets inside the temporary file systems and that would give them access as well to the API server. So leaving the panic room, this was pretty much the thinking of everyone. So working with secrets and Kubernetes is not going to be as simple as we thought it would be. Nonetheless, this is the quest that we've chosen to go down. So we need to figure out how we're going to address each one of these particular red flags that we had come across. And in this particular process, the reasoning that we basically followed was let's take a step back and consider how you would keep a secret safe in general, even outside of the context of technology. The main things that you'd be concerned with is where is the secret kept to begin with or where is it stored? And the next thing is who needs to know about the secret? And from there, you start thinking, OK, great. So how is the secret then shared? In addition to that, how is it going to be consumed by the relevant parties or entities that need to consume the secret? And then we also have to think about in the case that something goes wrong, which is not a fun conversation or an interesting thing that you actually want to do. But you have to think about it nonetheless. How do we prevent our secret values from being easily interpreted in the case that something does go wrong? And then lastly, are there any additional guardrails that we can put in place to dictate how our secrets are used to prevent to prevent things from going wrong? Basically, how do we detect violations that put us at risk? So the first thing that we had to consider is where are we going to keep our secrets? Where are secrets going to be stored? And to begin with, this was the platform team. The secrets were kept up here in our heads. Maybe some of you can attest to that. I won't ask you to raise your hand. You might get in trouble if you get seen. And so one of the reasons we delayed, though, was because we wanted to fit within, we wanted the secret strategy to fit within our GitOps approach, which I'll get to shortly. But because we were storing the secrets in our very secure heads, this did mean that there were some bad practices taking place. If you needed to share the secrets with someone else in the team, then let's just say there was sensitive information being shared over Slack, over Microsoft Teams. This isn't being recorded, is it? And of course, this was happening quite a lot for different environments. Now, I'm going to speak a little bit about GitOps, because this is what we had decided on for our change control process for our workloads and our infrastructure. And for those of you that may be new to this concept, it's basically a paradigm or a model that brings together Git and DevOps workflows and allows you to essentially extend the source of truth for the desired state for your cluster's environment. To a Git repository or a home repository, and specifically in the context of Kubernetes, you would have a GitOps operator like Argo CD or Flux or Fleet. I'm not sure if there are more tools out there. And the role of this GitOps operator is it's an application that's essentially watching the source of truth where your desired state is defined. So that could be a Git repo or a home repository, and it will continuously compare that to the destination, which is the live state of your cluster. And in the case that it picks up on any deviations or any differences, it will then attempt to reconcile that either automatically or simply notifying you depending on how you configure it to work. And just real quick, so in our case, we were using Argo CD, and I will speak a little bit about Argo CD applications a little bit later on. So I just want to make sure we're all tracking an application in the context of Argo CD. It is a custom resource definition that defines a connection between a specific source like a branch in a Git repository and a namespace in your specific cluster. So just keep that in mind when I do speak a little bit about them later on. Right, so now I'm going to speak a little bit about secrets in Git. So we've got our GitOps approach, and we know the vulnerabilities that exist around secrets. And I want to elaborate on them a little bit further in case someone here may be thinking, well, I still don't get it. So again, the easiest one is the fact that secrets are not encrypted. Your manifests are only going to mask those values with base 64 encoding. And remember with Git, it's essentially a collaborative tool. You have a lot of people that will continue to be coming into the project accessing that repository and that lifecycle continues. So you're essentially exposing these sensitive values to a host of different people that will be able to clone these repositories and commit to them on and on. In addition to that, there's the challenge that you can apply fine grained access control to like a subfolder in your Git repository. So that means just about anyone that has access to that specific repository, they'll be able to have access to the relevant files in there. And then there's the issue of commit history, which isn't actually an issue because we love commit history. However, if you were to commit a secret into a particular repository and then realize actually this is risky and you remove it. Someone that gains access to that repository later on can still make use of the commit history to check out at an earlier time and get access to those sensitive values. So considering these different things and we basically came to the conclusion that we're not going to force gets to be something that it's not. We're going to use it for what it's actually made for. And instead we're going to use a managed secrets solution. And that's what we did. That was something that was going to give us the encryption of all of our sensitive data at rest. We'd be able to apply the relevant fine grained access control. We'd also be able to check out the logs to see how they were used for auditing purposes. In the case that there was something, a red flag that had come up, so to say, for how a certain secret was being used. Now, the next thing was to consider how are we going to get our secrets from this external source into our clusters environment. And that's when we came across this particular tool that we used, the external secrets operator. And so I'm going to elaborate on some of the components in the architecture for the external secrets operator. And so I'll start with the secret store. The secret store is a namespace resource that defines how your secrets are going to be accessed from the external source.  Now the secret store needs to reference something that will allow it to authenticate and authorize successfully against the external API. Now, one approach is to store your credentials in a Kubernetes secret, as you can see over there. But the problem with that is it kind of takes us back to square one. We're trying to move out of that particular model and how are we going to manage that secret? So now, thankfully, I would say though, if you're just trying this out with a POC and you just want to see how the external secrets operator works, then sure, you can follow this approach, but I wouldn't advise it for production. Now, thankfully, we were doing this in an AWS environment. So instead we used IRSA, which is I am roles for service accounts, which allowed us to essentially make use of temporary accession tokens from an OIDC provider. And that was bound to a specific service account. And the service account was the one that the external secrets operator was using. And that service account would then assume a role in the AWS environment so that it could access the secrets in the external source. The next component that I want to cover is the external secret custom resource definition. So where is the secret store defines how secrets will be fetched? The external secret deals with what will be fetched and what's target secret will be created. So this is where you would define the specific values that need to be fetched without actually putting the sensitive values in there, of course. And then this is where you would specify the secret that should be created. So the external secret is then going to create what is known as a target secret. Now, some of you might have already picked up on this. So what do we do about that target secret? The good news about the target secret is that, well, we don't have to keep it in our Git repository. So we're safe on that front, but it kind of takes us back to the issue with the lack of encryption in the SED data store, because that secret is still going to end up over there. And so to address that, we used envelope encryption with KMS. And so thankfully, with this particular approach in the AWS environment, the data, the data keys that were used are not necessarily retained or managed from that context. It's only available to the user. And you can have a custom user, you can have a custom key for that as well. And the data is then stored locally as well as the data keys which get encrypted. And that'll be important for another component later on. I also want to mention that on that front, that was us partially taking care of what happens in the case that there's some exposure of our secrets. How do we prevent it from easily being interpreted? So that dealt with it in part. But then the next thing was who needs to know about the secret. So for this, we had to consider how we're going to protect our secrets from two perspectives, users as well as workloads. That was helpful for us that with the particular model that we went with, we were using Argo CD. And so there were lots of cluster personas. Of course, there were the platform engineers who would have access to the API server directly. But we also realized that, well, there are some cluster personas in this case that should never have access, direct access to the API server. Like your application developers. Like solution architects that wanted to have visibility of components inside the cluster's environment as well as QA testers. And so in this case, Argo CD does expose a UI where you can see what's running inside your cluster's environment. But you can narrow that down to specific applications. And applications would then fit within a particular project. And so we were able to apply role-based access control on Argo CD's front. And there were some cluster personas who would only have access to the cluster as it were by seeing what they need to see through Argo CD. And if you see this line right at the bottom here, it's just to represent the fact that none of them would have direct access to the API server. So that was one approach of, so this is an approach of protecting your secrets so that some folks just never have access to the API server to begin with. But then we also have to consider workloads, which is a very important aspect of course. And the first layer or the foundational layer that you have to consider is the namespaces. And sometimes namespaces get a bit of a bad rep because they don't have hard or strict isolation. So for example, with network traffic, you can have easy network traffic between pods that are in different namespaces unless you apply network policies or MTLS or authorization policies with a service mesh. But by default, there's back and forth network traffic. However, in the case of secrets, it actually is a good foundational layer to have your workload separated in the relevant namespaces because an application in namespace A, for example, is not going to be able to mount a secret in namespace B. Now the next thing that we had to consider obviously that each workload should make use of its own distinct identity, which is provided to us by service accounts, and then binding each service account to a specific role. And in that role, defining the relevant permissions that are only necessary for that particular workload. Now roles do not allow you to have explicit deny rules. You can only add allow rules. And so that's one approach of having the implicit deny rules to make sure that some workloads are not allowed to access the API server to carry out certain permissions. So if you see this diagram over here, you'll see with both the top and the bottom there are not allowed to run get secrets or list secrets or watch secrets. And so here's an example of a manifest with a role and a role binding. So at the top over there, we have a role that is explicitly adding allow rules for get, list, and watch only on pods and services. And right below it is a role binding that references this same role and then adds a service account as the subject, binding that service account to that particular role. So this is just an example of that. And then a really good exercise that you can run in addition to this is to actually use the kubectl off command and see whether or not a certain service account is actually able to get secrets or list secrets or watch secrets. And you can see over there, you'll notice that right beneath each one of those commands, there's a no being returned because those permissions have not been added to the specific role that the service account is actually using. So here's another thing that we can also another step we can take to protect our secrets from our workloads. And this will depend on the version of Kubernetes that you are running. So if you're running a version before Kubernetes one dot 24, then highly advise that you disable the auto mount service account token. And this is a specific token that gets loaded into a secret. And that secret doesn't this token does not expire. And the reason why this is important is because if you think back to the temporary file system where secrets get stored, should there be a an attacker that gets access to that temporary file system? This is probably one of the first things that they would want to go for because that token is what is going to give them access to your API server. So you essentially want to lock that down by disabling this where it's not necessary. And if you do want to make use of token approach, then you can consider looking into bounded service account tokens, which if I'm correct would function similar to the OIDC approach where you get temporary session tokens. So this is another angle that you can protect your secrets as well. Right. So we've considered where to store our secrets. And now we're going to look at how is the secret shared and how is it consumed? So I've already covered this in part. And so this is just a map of what our GitOps diagram or overflow kind of look like. And you'll see right at the top over there ESO, which is just standing for external secrets operator. So we were using Argo CD to deploy the external secrets operator into our cluster's environment. And then as for the workload, that is what would have a specific secret store CRD and an external secret CRD. Remember the secret stores what is used to define how the sensitive values are fetched and the external secret defines what gets fetched. And from that, the target secret would then be created and finally consumed by the pod. Next is consuming the actual secret. And so you'll see over here, so we went with the approach of consuming our secrets using a volume mounting approach. And you heard me mention earlier on when we were considering the different red flags, one of the things that we were concerned about is how do we actually secure our volumes. And so similar to what we did with the etcd data store, we used KMS envelope encryption for that as well to protect our volumes. In the case that there was some breach of a kind. So this is the second part of how you would deal with the issue of how do we prevent our secrets from easily being interpreted in the case that there's some kind of a breach or exposure. Right, so the last leg and probably one of my favorites is how do we manage violations that risk secret exposure. And so for this, I'm essentially advocating for dynamic admission controllers. And first, I just want to go through what the API request path would actually look like for some people that may not be familiar with this. And so these are the different steps that take place when an API request is actually made. And before something is actually committed to the state in the etcd data store. And so the reason I've put Argo CD on the far end over there is because that's what was managing our change control process. So first step is authentication and authorization. So role based access control would fit within the authorization module over there. And then next we've got mutating admissions. So in the case that you actually want to make changes to a particular resource before it gets committed to the state, then there's schema validation.  And this is where we can essentially tap into the validating admission aspect via the web hooks using different tools. You could do this with caverno. You could also do this with OPA gatekeeper, which is the one that I'm going to focus on. And you could essentially define different policies that are specific to your company or your context that allows you to manage how secrets get managed in your cluster's environment or how you want them to be used for the different workloads. So here's another diagram just to depict what that would actually look like. So these requests before they get committed to the state would be intercepted and then would be checked by OPA gatekeeper, which would essentially be enforcing whether or not certain things can actually be committed to state depending on whether or not they align with the policies that you've defined. And another thing that I like about OPA gatekeeper is the fact that it also has an auditing feature. So it's continuously copying the resources in your cluster's state and checking those against your policies. And in the case that it finds that there's something that goes against the policy, it will flag that as a violation and you'd be able to quickly detect that issue as well. And this is useful because maybe you're upgrading OPA gatekeeper or maybe you only implement gatekeeper after you've already deployed workloads that would go against certain policies that you come up with later on. Right, so another thing that is useful, and this is not just specific to OPA gatekeeper, you can do this with other policy enforcement tools. Other cool ones that I'd encourage you to check out would be Detree and Coverno as well. Those are some of my favorites. And you don't have to wait till you get to that API request phase for your cluster. So you can shift this left and inside of your CI stage what you can do is you can essentially run tests based on your policies against the different Kubernetes manifests or Kubernetes resources that you're attempting to create. So this would be a stage before your resources end up in the branch that your GitOps operator is actually watching. And so here this is just a screenshot of one example from GitHub Actions and you'll see I'm running a conf test command. You can also use the OPA CLI in the case of gatekeeper. And I have a specific policy that I'm referencing and in this case I would be using the, as it were, raw rego files which is the policy language that you'd be using and testing it against the different resources that I want to merge into my branch that the GitOps operator is watching. And if there's any violation detected at least I can see it here and it never even ends up in that particular branch so we don't have to wait till we get to the API request phase. Great so what I'm going to do now is I'm just going to show you Argo CD with a couple of translations of what I was covering so you can see how it looks like in reality. Is that big enough? Okay cool, I'll see a couple of nods and thumbs up. Right so first off over here this is just to show you that the external secrets operator is being deployed by Argo CD. Lots of resources not too concerned about you memorizing this so I'm not going to get into detail of that just to show you. And then over here so this is an example of one application and I'm calling the e-commerce app and if I scroll down here you will notice the e-commerce external secrets and you'll also see the e-commerce secret store. So these are the particular resources that we're actually keeping inside of our Git repository and none of them necessarily have any sensitive values so you can see over here with the secret store the alternative approach of course would have been to actually store the credentials in a secret that we'd be referencing and like I said that's not something that we'd advise for as a best practice. And some of you might be seeing well what's going on over here we see a sync failed and there's an error and that's coming to the example that I actually want to focus on. Whoops. So this particular e-commerce role, click on that. And you scroll down and you'll see over here that it is giving permissions to get secrets now this will obviously depend on your context and what your use case is but in this case just to demonstrate it is to show you oh this is the same resource so I'm going to come here. Right so here's our error and I'm just going to zoom in a little bit more so it's clearer for everyone right at the back. I meant a bit much. And you'll notice here that this request was denied you can see that our admission webhook specifically with Gatekeeper is at play. And the message here is that roles should not have get list or watch permissions and you can see that over there. And of course you can define this for specific namespaces so it doesn't have to be something that you do for your entire cluster. And lastly I'm just going to show you an example with the auditing capabilities of OPA Gatekeeper. So if I scroll to the top let me actually come out here. Come out here. Do that. So we've got two constraints here and these constraints represent the different policies. The first one over here is for preventing pods for mounting secrets as environment variables. And the second one over here is actually related to checking roles to see if they have elevated permissions for secret access which is the one we just looked at.  And you can see over there there are two violations detected and it lists the specific pods. Mounting a secret as an environment variable is disallowed and it points you to the specific pods. So this is useful like I said in the case that these things happen to have crept in into your environment. And because OPA Gatekeeper is continuously watching your resources it would be able to pick up on these things and then notify you so that you can deal with them appropriately. All right so that's the entire flow. So I think I've got about five or four minutes left so if there are any questions I'll happily take those now. The silence may be an indication of clarity or it may mean that everyone just went to sleep. All right there's some questions here. And something I didn't mention is kind of looking at it from the perspective of having measured risks as it were. Because one could still argue that even following the external secrets operator approach is like leaving breadcrumbs right. Because the sensitive values may not exist specifically in those resources but if someone if the wrong person looked at your external secret operator your external secret resource they'd be able to see references essentially not the explicit things. But specifically to your question I would definitely think it's safe enough to actually have those definitions in your in this case OPA policies or Arrego files because the beauty of that is you're creating custom resources with OPA and so you can be as specific as you want to be for your particular environment. So if it's checking those annotations checking labels etc. So I definitely think that that's a great guard and the beauty with that as well is like I demonstrated you can have that both in the CI stage by shifting left to actually test before things ever end up in the API request path but also you're protecting your runtime environment as well when you have them deployed. Yes absolutely yes you mentioned the envelope encryption do I understand correctly that the application at runtime will use KMS with an IAM role to decrypt secreted receives. Yes exactly so there would have to be a specific role that has permissions to even fetch the key to begin with before it can decrypt. All right thank you a question about HCD encryption like there is a default setting you can activate to have encryption address so why did you use KMS and additional to that. Yeah right so that was because with KMS you can also manage the keys and so that was just more of adherence to internal policies as well so we went entirely with the approach of we're going to use KMS and we want to be able to have customer managed keys but I'm glad you mentioned that so people know that it's not like there is no setting in HCD to just enable so yeah definitely that that's another approach yeah mentioned is it working I don't care yeah you mentioned the data interface storage interface right so at the time that that wasn't actually released as yet but I'm again I'm glad you mentioned that because that's another excellent alternative the secret store CSI driver if I remember correctly yeah that's another excellent alternative and another tool that you can look into if you haven't already heard of it is bitnami sealed secrets and again this is going to depend on your context so in our situation it was not really going to fly with with the cloud security team but there are certainly scenarios where using options like that can be super useful but the one you mentioned is an excellent alternative Hi so I wanted to ask comparing for example external secret operator with things like helm secrets and integration into deployment like with operator you also have to rely on an additional component or van the deployment it can break it can have sync issues isn't it better to have everything as part of the singular deployment process the integration with secrets with home secrets now with valves you can also reference for example the secret stored in AWS or GCP and external so how would you compare those two options yeah absolutely and I like what you mentioned and have a good friend who like because they were prioritizing for the deployment strategy as well that's why they went with helm secrets instead and so this was specifically based on what we did and not necessarily completely that this is exactly what you should do but enough to just give you good takeaways to consider but helm secrets is an excellent one and helm secrets if I'm correct is actually based on Mozilla sops so Mozilla sops is also a good alternative as well that if you're looking for managing external secrets as well so I think there's time for one more question if there any that's one right at the back in your external secret store you can easily end up with lots of secrets how do you track them how do you back up them and how do you bootstrap them in case your store fails right so I just repeat that let's say you have in your external secret store 2000 secrets just to have a number is this is this store fails at any point how do you have your values back up or if somebody does changes to the store I'm quite sure you want to track this yeah right that's a that's a good one just firstly would those 2000 secrets for example be for one specific namespace yeah okay okay that's a lot of secrets for a single namespace I'll make it 200 just too much to handle it manually yeah yeah and that's still a lot so I honestly haven't looked into that in detail I think it's something worth looking into definitely and I do not want to lie to you so definitely I'd say like it's probably worth it considering the scaling capabilities in that case and looking at what kind of synchronization would work for you obviously because external secrets operators continuously synchronizing based on what the external source is and in the case that there's a crash as it were at least the synchronization covers that to some degree because you know that when your your relevant pods are back up there's going to be a synchronization that takes place but as for the scale of that I'd yeah I'd have to look into that further for that many secrets thanks I think that is it but if any of you want to chat further I'm happy to spend some time with you thank you so much for coming to the session


A prayer vigil was held in honor of Ambrus Bradlin on Saturday, August 19th. Tonight was a prayer vigil just to keep Amber's name out in the community until we can get some answers for this terrible tragedy that has gone on, but just a chance for everybody to get together, let everybody know that we're still fighting the fight and we still want the answers. Amber's family is adamant about keeping her memory alive and despite having no updates in the case, they are hopeful that justice will prevail soon. Yes, there is a brutal murderer out there. We don't know where they are, but everyone needs to be aware of that and to be watching themselves and be very vigilant about everything around them. Many friends, family and community members came out to remember Amber, donate to the Floyd County Animal Shelter in her honor and bring awareness to the danger still within the community. For Mountain Top News, I'm Kelcie Dean.


Molecular Marker Technology was developed in the 1980s, which revolutionized plant breeding by providing new tools such as genotyping by sequencing and association mapping. These techniques have enabled the identification of novel genetic markers for complex and unstructured populations, thus enhancing our understanding of the diversity available for crops and complementing traditional breeding strategies. This article was authored by Mohammed As-Hanadim, Mohammed Amjad Nawaz, Mohammed Kaseem Shaheed and others.


Record It Books and One Click Digital present A Place of Greater Safety by Hilary Mantell, narrated by Jonathan Keeble. One Click Digital provides free audiobook downloads in partnership with thousands of public libraries. To see if One Click Digital's extensive catalogue is available to you, visit your library's website. This novel opens with the following author's note. This is a novel about the French Revolution. Almost all the characters in it are real people, and it is closely tied to historical facts, as far as those facts are agreed, which isn't really very far. It is not an overview or a complete account of the Revolution. The story centres on Paris. What happens in the provinces is outside its scope, and so, for the most part, are military events. My main characters were not famous until the Revolution made them so, and not much is known about their early lives. I have used what there is, and made educated guesses about the rest. This is not either an impartial account. I have tried to see the world as my people saw it, and they had their own prejudices and opinions. Where I can, I have used their real words, from recorded speeches or preserved writings, and woven them into my own dialogue. I have been guided by a belief that what goes on to the record is often tried out earlier, off the record. There is one character who may puzzle the reader, because he has a tangential, peculiar role in this book. Everyone knows this about Jean-Paul Marat. He was stabbed to death in his bath by a pretty girl. His death, we can be sure of, but almost everything in his life is open to interpretation. Dr. Marat was twenty years older than my main characters, and had a long and interesting pre-revolutionary career. I did not feel that I could deal with it without unbalancing the book, so I have made him the guest star. His appearance is few but picant. I hope to write about Dr. Marat at some future date. Any such novel would subvert the view of history which I offer here. In the course of writing this book, I have had many arguments with myself about what history really is. But you must state a case, I think, before you can plead against it. The events of the book are complicated, so the need to dramatize and the need to explain must be set against each other. Anyone who writes a novel of this type is vulnerable to the complaints of pedants. Three small points will illustrate how, without falsifying, I have tried to make life easier. When I'm describing pre-revolutionary Paris, I talk about the police. This is a simplification. Sample complete. Ready to continue?


This is stock number 21J115. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used Jeep and Jeep Grand Cherokee headquarters. Today we are excited to show you this brand-new 2021 Jeep Grand Cherokee Overland High Altitude Package. This vehicle has the 5.7 liter V8 Hemi motor, which pumps out 360 horsepower and 390 foot-pounds of torque. It's going to get you 22 miles per gallon on the highway. 14 city for an average of 17 miles per gallon. Slate blue is the color. PBF is the paint code. And we shoot all of our videos in 1080p, 60 frames per second. So if you have HD capabilities on your computer, tablet, or smartphone device, turn them on right now because it is definitely your best way to check out the looks, styling, options, and color of the vehicle before seeing it in person. And if you'd like to check out more photos of this vehicle in the upper right-hand part of your screen is a link to our website. Click that and check us out there. This one comes with the low gloss 20 inch granite crystal painted alloy rims. Part of that high altitude package. And the Pirelli Scorpion Verde tires. These are 26550R20s, all season tires. And you'll notice on this vehicle the high altitude package. The main thing that you want to note is that everything is accented in this granite crystal. So the lower valence, the lower bumper piece there. The grille inserts are all granite crystal. The Jeep lettering is granite crystal. You get the dark headlight and tail lamp bezels. And this one does have the HID headlamps, the LED running lights. And then the LED fog lamps down here. And then these are kind of a running light as well. It does have the protect 2 and all the safety equipment. So the forward collision warning plus, the adaptive cruise control, perpendicular and parallel park assist. It has just about every option that you could get on these vehicles. Enter and go system. We're going to take a look at the original window sticker. I'm not going to go through everything, but and I know this isn't the original window sticker, but it's a copy of it. The 2021 Jeep Grand Cherokee High Altitude, slate blue pearl, Napa leather 5.7, Hemi 8 speed automatic transmission. You get the Jeep wave membership, the Quadra Track 2 system, select terrain, Quadra lift system, the park sense or park view backup camera, park sense rear park in front parking assist with stop, blind spot and cross path detection keyless entry and go remote start system. And on the interior features, you get the Uconnect 4C Nav, Serious XM for six months, five year Serious Travel Link and Traffic Service for five years, Serious XM Guardian for a year, and then Apple CarPlay and Android Auto capabilities. And then right here is your optional equipment where it starts with the blue slate blue paint, which is 245 customer preferred package, 22S package is 2945. But look at all the stuff that it gives you, it gives you all those granite crystal accents, the 20 inch rims, the bright pedals, the Napa leather trim bucket seats, the leather wrap steering wheel adaptive cruise control, advanced brake assist, those headlight bezel, the full speed forward collision warning plus, lane departure warning plus, perpendicular and parallel park assist, protect to and then it gives you the receiver hitch and all the stuff that goes with the towing package. 5.7 liter Hemi is a 3395 option and you get the 19 speaker high performance audio system, which is the Harman Kardon system with 825 watt amplifier, which is 1495. Total MSRP is $59,290. If you want to get your summit price in the upper right hand party screen, there's a link to our website to get that price to see all the rebates and incentives, 3 year 36 bumper to bumper, 5 year 60 powertrain, and then your miles per gallon are here, 14 city, 22 highway, 17 combined. Safety ratings on the Grand Cherokee is amazing, 5 and 4 stars up and down the board including a 5 star overall crash test rating. So, very safe vehicles, definitely a vehicle that you'd want to haul your family around in. It does have four wheel disc brakes. Notice you get that gloss black trim around the windows, the granite crystal roof rack rails. On the back here, this is all outlined in granite crystal, as is the bumper trim towing package, which includes that receiver hitch 4 pin and 7 pin wiring. You get the black kind of chrome looking tailpipes. Power lift gate, Jeep lettering and 4x4 lettering is granite crystal. Factory subwoofer, here's your receiver hitch cover and you do get the sun shade back here, which is really nice system, just pull that like so and it keeps the sun out of your groceries or if you've got valuables out in back, keep some out of sight out of mind. And you do get storage under here with the full size spare tire and jack tools.  It'll beep at you three times and then come on down, actually beep sets you a total of four, but on the third one it comes down. Those tail lamp running lights are LEDs as well, does have the capitalist fuel fill. You do get blind spot monitoring, heated mirrors and directional signals in those mirrors, entering go system so you just have to have the key fob in your pocket. It'll automatically unlock. Inside you get that Napa leather, black interior. Now on the over lens, just the over lens you'll actually get over lens stitched into the backrest, but when you get the high altitude it's just all leather on the backrest there, so one distinguishing feature. Both these seats are heated, cooled and power with driver side lumbar, auto headlamps, you get those bright pedals as well, power tilt and telescopic steering wheel, get the nice dark wood grain trim on the doors, the anodized black trim around the door handles and vents, power windows, power locks, power mirrors, and then you get the power folding mirrors as well, but the vehicle's got to be on for those to work. Memory driver seat, Harman Kardon sound system, it'll hop inside and take a look at the options inside the vehicle. You do get that digital speedometer and you can switch that if you want just the numbers up there, if you want the classic dial. You get a compass, you can do temp, outside, mileage, miles to empty, you can change those corners to read whatever you want in the screen setup. You get the heated leather wrap steering wheel, cruise controls and adaptive cruise controls on the right, Bluetooth and information center controls on the left, you get audio controls on the back of the steering wheel. This one comes with the 8.44C radio, AM FM and Sirius XM radio capabilities, it also does have the factory navigation system and remember you get serious for six months, traffic and travel link for five years and then you get serious guardian for a year. There's your AM, FM and Sirius, your heated and cooled seat button controls, this is also where your backup camera shows up. Those grid lines are dynamic, meaning that they turn as you turn the steering wheel, you can do your climate controls here and then you can have all your different apps and you do have projection manager on here where you can project your cell phone to the screen via Android Auto or Apple CarPlay, so if you have a different navigation system you like better than the one on the radio, you can use that such as Waze or Google Maps and then it also has the off-road pages which are pretty cool. I always like showing them just because they're a little different than anything else that's on the radio and while that's loading you got more tactile controls on the bottom here including volume and tune controls and your dual climb controls here.  So here are the off-road pages, they take a second to load up, that's why I always show the other stuff first, but you have your vehicle dynamics including your steering angle so that it'll turn as you turn that steering wheel and then you also have your latitude, longitude, your altitude there, you have your suspension, this one has the quadrilift system so as you raise the vehicle it'll actually tell you what mode you're in right now so we're in normal and you can lift it up, vehicle's got to be on for that to work, but you can lift and lower the vehicle which is pretty cool. You have your pitch and roll, your accessory gauges including coolant temp, oil temp and battery voltage and then you have your select terrain so that's part of the Quadra Track 2 system which is this system right here, snow, sand, mud and rock, you also have a neutral setting for flat towing and then you have four-wheel drive, low and downhill assist control. This is where you can raise and lower the vehicle and when you switch that it actually changes up here in the EVX, sometimes they change on the radio but you can see I put it in the sand mode, it turns the traction control off, you go in the snow mode, sand mode, auto, mud and then you've got to put it in four-wheel drive, low to get it to go into rock mode but you can change that all with the turn dial down there. Anyways that's the whole off-road pages there and then you'll get your keyless entry with your remote start and the rear gate button and you get your eight-speed automatic transmission and that's the mechanical shifter, I like how the Grand Cherokee wraps around the dash and the door and everything's very seamless. This one also has the panoramic sunroof so the second-row fixed glass power sunroof in front, home link buttons for your garage door security systems and lane systems, map lights and your power rear gate button. You also get the system SOS buttons in the mirror and we'll take a look at the back seats and then we'll actually start it up. I've had requests before to start up the Hemmys so start that up.   So we'll start it up, take a quick look under the hood. It honestly isn't that much louder than the 3.6 liter. I think some people think it's going to roar or just be extremely loud but it's not too loud. 5.7 Hemi, 360 horsepower, 390 foot-pounds of torque. Everything you need to know about is labeled in yellow. I think that's your oil check, coolant level, windshield washer fluid, power steering fluid and so on. That's where your oil goes in and you have about the same engine cover they've had for years. But really not that much louder than the 3.6 liter. You get those HID headlamps, the LED running lights and LED fog lamps and they are super bright and just a really good looking vehicle, Slave Blue, one of my favorite colors once again. And to see more pictures of this Jeep or one of our other 450 new and used cars, trucks, SCVs, minivans, Wranglers, Cherokees, Grand Cherokees. You name it, we got it. Go to our website www.SummitAuto.com Full pictures and descriptions of every single vehicle from two locations all at SummitAuto.com. There it is. And thanks for checking out the video and to see more videos like this one you can go to www.youtube.com. So at SummitAuto remember to like, subscribe and share on this video and all the videos that you see there. In fact in a second you will see a link to subscribe to our YouTube channel on your left. A link to more Jeep Grand Cherokee videos like this one on your right. If you have not been to our website on the bottom, a link to this vehicle on our website, click those, check us out. And we really look forward to helping with this brand new 2021 Jeep Grand Cherokee Overland High Altitude with the Hemi and Slate Lumetown. Thanks again for checking out the video.


File Type Selection in Moodle 3.4 When selecting the types of file learners are allowed to upload, teachers are now presented with the Choose button offering a helpful list of suggestions. Our teacher here is creating an assignment for a group project. Learners must submit their project as a word-processed file. Our teacher clicks the Choose button and then, from the accepted file types, locates document files. He can allow all file types or can expand the link to choose the specific types he will accept, for example, open documents, PDFs and word documents. This list of file types is also available when setting up workshop activities. To summarise, teachers now see a list of suggested file types when specifying what their learners must upload in assignments and workshops.


Sweet Melissa, calm me down. Share yourself with me. I'm nervous and I'm restless and I long to fall asleep. Your lovely tasting leaves of mint. I'll pick them fresh today. They stimulate my appetite and relax me on the way. If one should have an outbreak of herpes down below, a poultice of Melissa would make those symptoms go. Should I fall ill and need to sweat? Here's the plant for me. No side effects that I'd regret is tasty lemon tea. So when I need to find some calm, I'm depressed and overtaxed. I plan to take some lemon balm that I might feel relaxed. In this poem by Dr. Sylvia Chantreau, you get an overview of a modest mint whose attributes are welcomed during such times of stress, anxiety, and illness. Melissa aficionalis, or lemon balm as it's commonly known, is a leafy shrub-like perennial in the Le Mansier family. You can tell by its square stems that it's a mint. All mints have square stems. Native to Europe and Asia, lemon balm has naturalized in North America and is easily grown as most mints are in zones 4 to 8. For that reason, it's best to plant in containers or areas where you don't mind it taking over your garden. You can start it from seed, cuttings, or fine plants already started in your local nursery. Pollinators, especially bees, love it. When it begins to flower, you can pinch back the flowering stalks to encourage new leaf growth. For thousands of years, lemon balm has been used culinarily and medicinally. Its lemony mint flavor is pleasant, making it easy to use with children. But the older leaves, the less tasty it becomes. Culinarily, it's wonderful in salads with chicken and fish dishes, desserts like fruit compotes, and as a tasty beverage, hot or cold. And since it's what we call a comminative, which means it aids in digestion, it's a great add-on to meals at the end as an after-meal beverage. During times of excessive stress, Mary Melissa comes to the rescue bringing calming and soothing support to the nervous system. She improves our moods, relaxes our minds and muscles, and helps us sleep when we are restless or with anxiety. She can even soothe the gums of a teething child, and the tea can be used as a mouthwash. Got a bug bite? Chew a few leaves and apply them directly to the bite to soothe the pain and decrease the swelling. If you find yourself falling ill and needing to sweat it out, make a hot tea infusion and drink it. Melissa is a diaphoretic. She'll make you sweat. Lemon bombs other attributes include being antiviral against herpes simplex 2 and has long been used with other viruses in the herpes family. It works wonders on cold sores. It's antibacterial, which is why it makes an effective and tasty mouthwash and fights inflammation of the mouth. It's a mild astringent and can be used as a pleasant skin tone. Lemon balm is also very high in antioxidants and studies have shown it improves oxidative stress and DNA damage, including x-ray damage. This modest garden herb does so much for us and is so easily grown. You can see how she will not only be of great help during times of stress, but also a tasty companion in the kitchen. I hope you enjoyed learning about Melissa today. So now that you know a little bit more about Melissa aficionados, better known as lemon balm, let's make the perfect cup of tea. I like using the mason jars, herbalist style. We've washed the Melissa, given a good washing, and we're just going to take, this is a little bit bigger than a pint jar. We're going to cut up some of the leaves. The more surface area that you expose by cutting, the more flavor you're going to get out of it. Put that in there. You can put some stems also, that's fine. And since Melissa is energetically drying but cooling, we want to watch out with that drying part, right? We live in a dry climate already, so we want to think about what else we could add to it. If we just want Melissa tea, then we could use honey, a nice raw honey. If we wanted to add other herbs, we might add a little marshmallow root, which is moistened, or some plantago, which grows in your yard most likely. It grows just about everywhere. I'm going to make a nice strong infusion. I like to have some flavor. I'm going to pour that tea with hot water. I'm going to fill that jar. It even smells good over here. I'm going to put the lid on to let it steep. You don't want to put the lid on too tight because it is hot boiling water with just one in there. And we'll just loosely put it on there and let it steep for a few minutes, and then come back and drink it. Okay, we're back, and our tea has been steeping for about 10-15 minutes, and it looks really good. Smells amazing. So let's pour a cup of tea. I have a strainer here for the leaf. You don't have to do a strainer, but you don't really want to have green tea, so use the strainer. Pour it in here. It's still pretty hot. You might want to use a hot mitt. Some of that delicious raw honey, local raw honey, right here in Longmont. Once again, you don't have to add the honey, but it's a good idea if you feel like your system is dry anyhow. So you might want to use it for that. So you don't over-dry your system, but you don't have to use it. Sometimes I drink it straight up like that without any sweetener at all, or without any other herbs in it. But today I feel like having a little raw honey. My gosh, that is so delicious. It doesn't get much better than that fresh out of the garden and right into my teacup. Good stuff. Now, you can also use Melissa medicinally in tincture form, and you could add tinctures. I don't know if you know this or not, but if you're taking tinctures, say you're taking this for medicinal reasons, say you want to have some calm or sleep at night or something, maybe having some sleep troubles and you want to try Melissa because it's so gentle. But you don't necessarily want to make the tea right before you go to bed because you don't have to make a million trips to the bathroom. You can do it, you could do it just a little, maybe a few ounces of water, either room temperature or you could add it to a little hot water. I feel like it kind of burns off a little bit of the alcohol, not burns it off, but makes it evaporate quicker. And you could do that as well. It still tastes pretty yummy. It retains its flavor pretty well, I have to say. So you could do that. You don't even have to make the Melissa tea to do that. You just make the hot water and add it that way. You can control how much water that you want to intake before bed. And the other way that we use it is in essential oil. I'm strangely out of essential oil of Melissa right now, but it comes in a very tiny bottle and it is very expensive. Five mils can cost you over a hundred dollars, but if you need it, you need it and it's really wonderful for if you deal with cold sores and anything in the herpes family, herpes virus families. It's really a good medicine, good strong medicine for that and you would do it dilute. You can find it in so many products, lip balms or gels or salves or what have you. You can make your own. And if you wanted to find out more about that, I'll think about making an aromatherapy video for the next time. So you learned something today about lemon balm. Melissa Fish and Alice, I hope you enjoyed it. I hope you learned something today. And yeah, put her to use. Let her grow in your garden, but remember, put her somewhere where she doesn't take over your yard. I look forward to having a virtual tea with you again soon. Bye for now.