Welcome everybody to our webinar, not just Disciples, but DiscipleMakers. My name is Marvin Lorenzana and delighted to be able to facilitate a brief conversation with you all about how DiscipleMaking contributes to the well-being of our local communities. In my mind, the only thing that can bring back our local churches in line with God's reconciling mission is intentional, relational DiscipleMaker. The content of this webinar is based on the Micio Day written by me and edited by James Crable. This work is part of the work I did for Mernonite Mission Network as Director for Discipleship Initiative for a number of years. In this brief pamphlet, I tell my personal story growing up as a disciple of Jesus in a morbidiente church in Tegucigalpa, Honduras. Hopefully you have been given a copy of this booklet. If not, you can get one at Mernonite Mission Network. In this work, I basically explained how after just a few years of being launched as an organic DiscipleMaking movement among young people in Tegucigalpa, the original strong impulse towards an intentional, relational and mostly organic DiscipleMaking experience began to fade away. In essence, Discipleship becomes institutionalized when it is co-opted by human methodologies. Somehow, we seem to believe that our methods are better than Jesus' methods for DiscipleMaking. I would like to suggest to you, my brother and sister, that we go back to Jesus' way of doing things. And this is why Jesus says of himself, I am the way. Meaning, not just the way to the Father, but also I am the way, the model you are to follow in the Kingdom. So in this brief presentation, I would like to suggest to you three crucial factors that will enable your local congregation to develop biblical Disciples of Jesus. Even if you are not the pastor of a local congregation at the present time, the fact that you are a follower of Jesus is enough reason why reflect on these three elements of the DiscipleMaking process. The three factors of a healthy, multiplicative and organic DiscipleMaking process are head, heart and hands. Biblical Discipleship takes place at the intersection of these three foundational elements, elements that we find in the example modeled by Jesus with his own Disciples all throughout the Gospel narratives. Let us begin with head. Head has to do with delivering the right knowledge to our Disciples. This is important because he, Jesus, was a teacher, a rabbi, to the Disciples. Someone who wanted to make sure they knew how to think rightfully about what the Kingdom of God was all about. His Disciples were so impressed with Jesus's teaching style that they were amazed at his teaching because his message had authority. According to Luke chapter 4 verse 32, in our local churches, we primarily think of discipleship in terms of head knowledge. We tend to do this well, I should say, in most cases. We offer believers biblical instruction in a systematized sort of way, and that is all good. Head is all about classroom space, sermons, seminars, even higher theological education fits in this. Head is definitely important. This is why we have the teaching ministry or the Das Kalos in the church, within the church. Head knowledge, however, will never be enough. If we want to develop effective Disciples of Jesus that know how to multiply the Kingdom of God everywhere they go, everywhere they work and where they live. Number two, heart. Heart is all about offering caution, mentoring to our disciples in the making. This is important because Jesus tested his disciples' heart's motivations by asking the disciples thought-provoking questions. Jesus knew well that the human heart deceives by nature, and he wanted to make sure the disciples' actions were driven by God's purposes and not by their own selfish desires for glory, fame, or power. So for example, in Mark, chapter 8, verse 17, Jesus asked them, why are you talking about having no breath? Do you still not see or understand? Are your hearts hardened? And in John 21, verse 16, part A, he wants to know of them specifically as the question directly to Peter.  So these are hard questions. Jesus would ask hard questions to his disciples to help them understand their heart motivations. And this is really crucial for the disciple-making process. Delivering the right Bible knowledge is truly important. Yet working with the heart of our disciples' information is absolutely necessary. Jesus knows well that he needs to intentionally work with the undergirding motivations of those he is discipling. For this formational process to take place, disciples of Jesus need to be accountable to one another in love and grace. This is part of the reason why Jesus' disciples' people are part of a community. But the question is, how are we holding each other accountable of our faithfulness or lack of it in our following Jesus? How is this happening in our local communities? Who is disciple in who? Who is mentor in who? How are we following others and imitating them as they imitate the Lord? As the apostle Paul would say. Heart then is about motivations, it's about human nature, it's about character, and it's about our personal sin. Number three, hands. Because it is never enough to have right thinking or right motivation if these do not move a disciple to action. Hands is about putting necessary traction to everything we're learning here and here in our following Jesus in life. It is not only about being good, but about being good for something meaningful.  We find him directing them in Matthew 14.16 to give them something to eat when faced with hungry crowds who had followed Jesus to a deserted area. We also learn from the gospels that at some point Jesus was baptizing more people than John the Baptist himself. But upon closer examination, we are told that it wasn't Jesus who was doing the work, it was in fact his disciples who were baptizing the multitudes who had come to Jesus, according to John chapter four, verses one through three. This is the discipling pattern that Jesus used. And it is not difficult to imagine that he also expects us to follow his example today in order to continue the ministry of reconciliation that he began. In short, to give people the right theological formation here and the brain is truly necessary. Also, working quite intentionally, shaping the heart character of those we are discipling is vital. But finally, knowing how to mobilize disciples of Jesus to their local harvest field is a must. Brother and sister, we need to learn how to use this tridimensional model for disciple making, a model that involves head, heart, and hands. All of these three are absolutely necessary. There is nothing more missional than teaching common believers how to become disciples of Jesus who in turn master the art of teaching others how to do the same. There will never be, and in fact, cannot be a missional church without reproducing missional disciples of Jesus. In the Missio Day booklet, you can also find information about MDGs, missional discipleship groups. These are simply groups of two or three people of the same gender who meet on a weekly basis for an hour and a quarter approximately with the sole purpose of sharing together in a meaningful discipleship experience. MDGs can meet on any day of the week at any time and in any place. They're completely flexible. When they do meet, they seek to accomplish three principal things. The scripture reading, individual and communal prayer and accountability to one another. When biblical disciples of Jesus are successfully being formed within the local church, the wellbeing of the whole congregation will dramatically improve. This is because disciples of Jesus are always on mission with God, looking for ways to significantly impact their communities for the sake of the gospel. Now, how disciple making has the potential for transforming your local church? Well, let me give you four examples of how this takes place. The first benefit you will find when making disciple making the mission of the local church is personal transformation. Is that simple? Yes, it all begins with you making disciples of Jesus on a regular basis. It has to begin with you. You and I know that people will not do it unless you do it. And this is why it's so important that you make it a priority in your ministry as soon as possible. The simple fact of implementing a tool that is reproducible, such as MDGs, in your local congregation, could be enough to launch your local church in a new direction. Everything, however, begins with you. Yes, with you. Missional Discipleship Initiative, MDI, sponsored by Mennonite Mission Network. Introducing Missional Discipleship Groups. An MDG is a vehicle that facilitates a discipleship experience in an intentional and relational kind of way between two or three people from the same gender who have decided to share their journey as disciples of Jesus together. Jesus said, For where two or three gather in my name, there am I with them. Therefore, an MDG might well be the most basic expression of church there is. An MDG meets any time of the day, any day of the week, and practically anywhere. This makes them highly flexible and usually meeting for one hour and 15 minutes. MDGs gather around a specific agenda that includes accountability, scripture reading, and prayer. For accountability purposes, five questions are asked every time they meet. For example, where have you seen God at work this week? Or what did you hear God say to you during your prayer time this week? Or even, did you finish the scripture portion assigned for this week? MDGs decide what portion of the Bible they want to read together and commit themselves to do it. Between one to three chapters are read on a daily basis. Prayer is supposed to happen both individually as well as communally. An MDG is made of three people, the facilitator, who is the person responsible for making sure that discipleship actually takes place. The committed is someone who is already part of the congregation but lacks experience making other disciples of Jesus. Finally, the new, who is somebody who is new to your congregation or even better, someone who is not part of your congregation yet, but is hungry and thirsty for God. Together they meet week after week for between eight to 12 months. Clearly, the purpose of an MDG is to multiply disciples that make disciples that make more disciples of Jesus. Multiplication takes place when a fourth person is invited to participate in one MDG. When this happens, together they decide how to multiply into a new MDG. Once they do multiply, roles will change yet the purpose remains the same which is defined and then disciple the new. At MDI, we firmly believe that for discipleship to be effective, three key elements need to be present. Intentionality, robust spiritual disciplines and smaller, more intimate communities. MDI, sparking the flame of an intentional relational discipleship culture in the local church. Nothing in this world has the potential of transforming your personal Christian life as well as the effectiveness of your local ministry more than investing meaningful time in intentional relational disciple-making. If you make this activity a priority in your life, you will be transformed from within and it will be noticed by people in your local church.  It will be shared in your conversations. It will be part of who you are as a leader. It is as simple as finding two or more people in whom you are willing to invest at least one hour of your time every week. Jesus said, where two or three gather in my name, there I am. Two or three gather in the name of Jesus could very well be the most humble yet more potent expression of ecclesia that there is. How about you trying this as soon as possible? Find two more people and begin a discipleship process with them. Read scripture together. Pray for one another and then try to be accountable to each other. Share life with one another and let's see what the Lord does with that. Number two, your leaders in the local church will be impacted by your tenacious, faithful example. Once you have made the disciple-intest a priority in your life, your closest leaders will follow suit. In reality, they all have been waiting to see your example all this time and surely are in most cases more than willing to follow your lead, but you have to begin. Leaders will be developed as they also engage intentionally the disciple-making task. Number three, as a natural result of people in the local church participating in MDGs actively, significant pastoral care will take place. People will be praying for and with people on a weekly basis. Imagine that. People sharing life with each other on a regular basis is how we fulfill the many one another's we find in the New Testament. Finally, when people in the local church learn how to make more disciples of Jesus, they don't want to stop doing it. There's nothing more exciting to a believer in Jesus than seeing others become followers of Jesus themselves. People don't want to stop. They want to be mobilized towards their local harvest fields. This is the way that believers impact their community by going out. This is exactly what Jesus says, go out and make disciples. For some reason, however, we tend to hear, stay here in the local church where the commandment is to go out, find them, find them and make them disciples of me. That is the Great Commission. So in synthesis, four important benefits of making, not just disciples, but disciple makers are. First of all, personal transformation, it all begins and ends with you, the leader. Secondly, leadership development. Your leaders will follow you in your pursuit of discipleship if you are serious about it. Number three, meaningful pastoral care will take place in the local congregation. And four, mobilization. Disciples of Jesus want to go out. There's a natural impulse for going out. It's a natural reflex. Moving out into the community and finding people who are hungry for God is what they want to be about. Let me end this presentation with this important video that stresses the need to go back to making disciples in an intentional relation of kind of way. I'll see you on the other side of the video. Hello, my name's Mike Breen and I'm delighted to be invited to share just a brief moment with you on the subject of discipleship. Discipleship, of course, goes back to Jesus. He called his first followers to be learners. That's what the word disciple really means, being learners, people who will learn the life of Jesus. Not just what it is that he knows, but learn to be who it is that he is. That's the key. Being a disciple is more than just information. It's also to do with imitation. When Paul was writing to the Corinthians in 1 Corinthians chapter four, he said, you have many guardians in Christ. And that word is a very interesting word in the New Testament, the word is pedagogos. It means the person that takes care of children and trains them in their letters and numbers. Paul says, there are lots of people in your life who can do the job of giving you good information. But then he goes on to say, he says, but you have very few fathers.  And so he sent his disciple Timothy to them so that they would see again in the life of another disciple what it means to be a disciple of Jesus like Paul was. So it's really important that as we look at the subject of discipleship, that we recognize that, yes, it is vital that we have the right information about Jesus. And of course, we get that from the Bible. We get that from the New Testament, from the Gospels. We have the right information. And that information, the Word of God is forming us and shaping us the way that we think. But also we have models that we imitate. Right the way through my life, I've looked at other people and I've noticed how it is that they've followed Jesus, how they've talked to other people, how they prayed, how they've had concern for the broken and the needy. And I've looked at their lives and the best that I could do was just simply imitate them. Now you might think that imitation is an insincere form of spiritual formation. You know, you're imitating the life of another person and you may not believe what it is that the other person believes. But of course, you can act your way into thinking correctly about something. That's what you do with children. That's what people do in lots of other areas of life. Think about driving a car. You train a person to drive a car and in the process of driving a car, they understand what it means to drive safely. Now if you gave them a long course on how to be safe before you actually taught them how to drive, they may never actually become a safe driver. So really engaging with the information about Jesus and allowing that to form us and shape us as it did for the first disciples is enormously important. But then having a model that we imitate, we look for other people and we look for their lives and we say, I'm gonna imitate that particular characteristic in that other person because in that characteristic, they look like Jesus. Now, of course, then it may come to us. Maybe some folks are actually imitating us. Well, the truth of it is of course that everybody's imitating you in your life to one degree or another. The way I've often described it is this, that all Christians look like shepherds from behind and sheep from the front. You know, if you look over your shoulder, you'll generally see somebody else who's looking to you for an example. There's at least one other person. And when they're looking to you for an example, they're looking to you for a pattern that they can imitate, a model that they can imitate. Now, those of you who are Wesleyans will know that this is foundational to being a Wesleyan Christian. This is the way that Wesley functioned right from the very beginning with the Holy Club and then on through the small groups they called class meetings and societies in those days. They were the places where mature Christians offered their lives not as a perfect example, but as a living example of what it means to follow Jesus. So, information, the right information about Jesus so that we can follow him. Imitation, the pattern of life that we want to model our lives upon. And then as we put that together in our life, a disciple begins to do the final step, which is to innovate. So, information and imitation leads to innovation in our lives. You know, the people in your life who are in your workplace, the people in your life who are in your immediate or extended family, the people that are in your community, they don't need a disciple that you can tell them about that lives somewhere else. They need you to be the example of Jesus among them. You've allowed your heart and mind to be fashioned by his word. You've allowed your life to be shaped by the pattern of discipleship that you've seen in other people's lives. And now your life has become the pattern that other people see. And the pattern that they see is this innovation, this new emergence of what it means to be a disciple in your own life and in your own context. Now, I think if we start doing that, the world will begin to see again what it means to be a follower of Jesus. If you ask people, everybody loves Jesus. I've never heard of anyone who really despises Jesus. Everybody loves Jesus. Some people may be suspicious of the church. Some people may be burned by their experience of the religious life. But the life of Jesus modeled by you is the life that everyone looks to and everyone longs for. So I hope you find that helpful. Try those three things. Information, imitation and innovation. Thanks for joining us in this presentation about how disciple-making will improve the well-being of your local congregation and even the city where you happen to live. I'll be happy to answer any questions you might have right now or later today or simply to listen to your comments and responses to this presentation. Let the Lord bless you with His peace and keep you safe in the midst of this pandemic time. Thank you so much.


Hey traders, this is Tosh. I go by T Bradley 90 in the my investing club chat a general reminder for those who do not know MIC is having a one-year anniversary event where bow is going to be trading live in front of our members It's coming up August 17th mark your calendars as an added benefit for our members The event is 100% and exclusively free for annual and lifetime members While lifetime on top of that get extra coaching before the event and guaranteed front-row seating While most charged for these events we show our support by making it again Free for annual and lifetime members if you are interested in signing up for this event DM T Bradley 90 in MIC slack chat and or email myself at Tosh at my invest in club calm Now we have a very special video for you guys this week as Matt who goes by Chicago trader one of our top moderators in MIC chat returns for episode 28 of his fundamental analysis series In which case this week he's going to talk about R e K R and deep dive into it And while today is just a preview of the full-length video if you want to watch the full-length or any of our exclusive Content then become a member of MIC. Hey, everyone. What's going on Chicago trader here checking in for the weekly fundamental video? Hope you guys had a nice trading week here I'm gonna go over one name a little bit more in depth and then a couple others. I'll just skim at the end But I wanted to kind of dig into this one Recourse systems the tickers R e K R Kind of just got just brought to my attention Someone in Chad mentioned it and kind of got to looking at the chart and Definitely interesting play here. So if you look at it, if you guess I haven't seen it already April, you know, this thing is down here at 60 cents and it's had quite the run All the way up to almost 550 and it's closed So once I, you know kind of started digging into it There's a few things that I thought were kind of interesting that caught my attention. So the first one was an AK From the 18th of March here. So usually when I'm looking through these AKs, you know It I don't look for anything in particular, but material definitive agreements are usually things that I just go check it over There's a lot of times it can be with raising money or reducing warrants, whatever it is So basically they I mean the company is not that large You know at this time, I think that the company is working up around 10 20 million dollars and here they basically do a They agreed to a note Of up to 20 million dollars. So, you know, nothing to see but once you kind of get the reading into it You know, they pay $650,000 in fees You know, they're going to be paying monthly installments of $40,000 each And then here on this last sentence on the earlier of the maturity date or payment in full of the obligations under the no purchase agreement The company shall pay an exit fee of a million dollars So essentially if They pay it off obviously when it's due or they pay it off earlier, they have to pay a million dollar fee So I was looking into that.  Oh Yes, so this is in the most recent 10 Q So under this agreement they Hey Where's that? Anyways, I'll find it. They paid 24 percent. There it is. He the effective interest rate on 20 million dollars that they Borrowed is 24.8 percent Which is absurd. They're gonna pay almost five million dollars of interest And they gave the company, you know the 2.5 million warrants at 74 cents So whoever gave these guys money is just absolutely banking So I'm gonna scroll to the top of this 10 Q. Sorry about that guys Companies got 20 million shares Pretty low on cash and one thing I didn't you know kind of right realized they have a you know $7 million in receivables and You know, you don't know when it's gonna come in how much is gonna come in so you got to kind of play that one out You know, obviously got a lot of debt now with this the company they do AI for you know, a few different industries law enforcement Banks logistics, so you know, it's not a complete fraud. I guess like business model What else was there to see in here? Yes, we'll see this is another thing with the accounts receivable You can like a lot of times I'll tell you how much they expect this, you know to receive if any of its doubtful that they don't Think they're gonna be paid and you know, it's just a little bit. You know a few hundred thousand dollars But anyway, so here's what I wanted to kind of just you know put it all together Obviously, this is an investment advice guys on my part or in my sees so do your own due diligence But the company of 19 million shares outstanding the floats about 10 million And that you know, you got to obviously this is where it comes a little bit tougher when they got these warrants and the money If they're exercised, it's about 12 and a half million shares So the if we zoom in here on the chart And just get this real quick The highest closing price I think was 536 535 somewhere around there So you can see there's pretty big difference, you know, they got the 12.5 million shares, right? So if they did exercise all the warrants times 536, which is the highest closing price in the last 60 days They can raise, you know, $67 million divided by three because they're restricted $22 million so and even if they can't you know, say, you know, if they ever Exercise the warrants then you can have about 18 million dollars. So that's why I'm sitting there thinking okay, so the cash You know, they're under by three million dollars of cash even if they did exercise the warrants So, you know, they got at least, you know, two or three months of cash Hey traders, this is Tosh. I go by T Bradley 90 in the my investing club chat Just wanted to reach out and say if you have any questions about M. I see joining M. I see maybe you're a member already You have three ways to contact myself personally and through M. I see you can hit our social media You can hit me through pms and chat or you can contact us through my email at Tosh at my investing club calm That's Tosh at my investing club calm I will get back to you in a timely manner and I'm saying this because I'm here to help and I don't want anybody to be Afraid to reach out and ask any question that they have we are here for you guys. All right. See you guys


Hello and welcome back to the craft box. My name is Brenton today We're in episode 178 of the woods of 101 death walkthrough last time if you haven't checked it out already We finished off in mooncliffs and now we are here in the last wood In between episodes I defeated a whole bunch of things that we had to I've also done a lot of side quests and got this cool new badge machine master, which was for defeating Kensington Park and Marley bone Very proud of that one wasn't actually hard, but like, you know at the time of Marley bone it would have been so yeah That's a cool badge.  So yeah, but we had to defeat four What are they called? four flame legs which are there and That was the last one and then there's the first one which is four of These guys blue razors. That's what they're called blue razors Each world has a different name for the same sort of things. So, you know, you just don't know sometimes Well, we did that Yeah, not too difficult Not too difficult at all, but we are now going to talk to Elwin Would want woodward. In fact, I can't even read And we'll see what he says now. We're gonna leave them up here because you can and go in here And see what we got to do next Hello I'm impressed by your deeds Spellbinder you have helped us strike back at the ombre legion. Thank you for that I must send you on now into peppergrass look to speak to our leader Eliza fireblade Tell him all that you told me Okay, look at that. We're gonna level up today. I think So basically the plan for this episode is to finish off this bit of the last wood So we have to come back again later, but like this but like this big chunk of the last wood We have to finish it today So it might be a long episodes a buckle in for that one Where's Eliza? This is the port back to bastion, which is cool same places where the The one in mooncliffs takes you commander all when he's told me about you spellbinder. What is your purpose? You stand against the shadow queen We will give you what knowledge and support we can to aid your quest, but I do not know how much hope is left Our spies indicate the shadow queen recently returned from a great military campaign And she seems more powerful than ever Her forces have trebled their attacks and we have been cut off from our allies in Queen Myrtle town The path between our villages has been flooded. Could you scout the route for us and see if you can divine a way through? Okay, look at that. We're getting exp like no joke Yeah, we're gonna live a lot differently There's a whole bunch of side quests here, which will give heaps of XP, but I'm kind of just working on all we have to go through the bush Yeah Secretly, but yeah I'm kind of like working up the world's going from like Wizard City all the way through. I'm currently a Marley bone Obviously not quite finished there, but I don't have many left and no, this is where the path is blocked The water has a corrupt magical radiance. It makes sense to follow it to the source What was I saying Molly bone. Yeah, I'm nearly finished in Molly bone It doesn't give much XP, but I mean any bit helps, you know You see a pair of cursed lake elementals hovering at the shoreline Diverting the lake down the path Spellbinder do not strike us down We are compelled to this action by the Shadow Queen servant a cruel death's head sorcerer Okay, then um so yeah, we I mean but any bit helps and obviously if we were that low level as We would be if we were doing those side quests when we were actually in Molly bone I mean it would still it would get us like with all of it up to like a level So, you know it will still get us to essentially Nearly leveling quickly what important that didn't even make sense to help us level a bit quicker So that's why I like doing them later because it still gives exactly the same amount of XP Except it's just that it doesn't it's not as noticeable But you can still kind of like you still level quicker And it's even quicker because you can just go through like day and night for second round and boom you go on You're finished curse lake elementals even nature herself is in for all to the Shadow Queen Spellbinder can you discover where this death's head sorcerer hides and break his compulsion over the lake elementals? We sure can look at that all of this XP is just fantastic So we're gonna need to switch to the boss stick Because he is a definitely a boss like there's no no joke about that one Yeah, yes, kind of like weird like don't actually know where I'm going, but just assuming I'm going the right way We need a potent. Thank you, and hopefully that should be good Just pass the lake elementals you pick up a trail it follows the edge of the lake Okay So yeah, that's what I've been doing off-camera a bit as well as other things, but you know just Getting these side quests down. I finished all in Wizard City and Crocs, so I'm really happy about that one I've also got quite a few badges To show before that so yeah, I love collecting badges, and I think I'm definitely gonna try and collect all of them You are not a mouse. What kind of foul creature are you?  Yeah, and that's like 8% text forever So it's just easier to do that on my death with be a night just second round at the stage and just boom you go on Eventually it will be first round because we can get an extra clip from my dick, but we can't do that yet But as soon as we can that will be lit Absolutely That's not fun Welcome to earthquake city Gosh, oh golly golly gosh didn't recognize that risk. Oh well We will probably have to crow Because there is three of them So this is really no joke 3v1 yeah, that's definitely 100% yeah makes complete sense I think I had a lot of difficulty on my life doing this I Think I got gnomes like twice and it gives up puts up life to spells So be careful of your life. I would highly seduce team up For this boss, especially if you like Yeah, there's another one later on in the last one, but I think in the second time we come back Maybe that we have to fight and he's quite hard as well or it might actually be this one I don't really know who knows we'll find out today. I suppose because we're doing all of it today. Ha ha Okay, we got a sharpen blade noise noise noise But up that sharpen if we get earthquake, I'm fleeing like we're not even like trying again We're just fleeing and redoing like we just can't I just can't deal with that especially since I've got three blades now Yeah, no, it's not not happening not happening We can put up a faint. Yes. Thank you very much. We will draw hopefully get a faint No, we got cleanse. Oh well Probably won't need that one, but we can put up a faint now and we'll faint next and then I think All should be good. Hopefully by then we have a Couple of I don't think we've got an enchant yet for scarecrow. Maybe we do. I don't know who knows Okay, I'm gonna tell you not too deadly.  Okay, all thrusters good.  So I have to use like earthquake for like the whole time and frog. I've got a myth that I'm working on but I kind of like Like I was going really well and I got like all the way through Was it city all the way through proper topia, and then I'm kind of like stuck at the end of Molly bone and I just don't have any enthusiasm to complete Molly bone really or any time but like that's the Desire to do it. So maybe later Maybe later, but not today not in the next couple of months probably It's just I don't know. It's at the point where it's kind of boring. We could like he's got 21. We also boosts. So I mean like Lego Two feints and two blades. We should be fine one's a potent as well. So we should be perfectly fine two feints and three blades In fact plus health. So I mean we nearly did and I don't want to risk dying because that would be embarrassing Because I'm better than my life so better than my life was it Boop boop boop. No crude, which is unfortunate, but Well, it's fine. Oh, that's it. Oh, yes, please. Oh, thank you. We create a he would have been dead Oh But the minions are out, which is good. So no more earthquake worry And we can just play it up for dr. Von which is not too bad We've got another faint and we've got this blade here. So might as well just slowly blade wait for pips Goatmunk, they really love goatmunk. They love it. Honestly. I've seen this so many times It's a nice spell it takes forever, but like it's a nice spell let's say um Loremaster spells, so If you want it, you got a farm loremaster for it, which is Kind of cool. I kind of like how the loremaster drop spells It's quite a cool mechanic and you can also craft them as well if you have amber and tc's Which can take a while and also getting all the other reagents as well can take a while But you know if that's what you want to do you can do that Yeah, I'm so happy. I don't have to craft beer night Because that would have been a struggle Oh my gosh Pigsy on the other hand the tc drop rate at the law at law master. Absolutely terrible so Yeah, I'm gonna have to farm for pigs a lot through Lawmaster because I don't like spinning crowns on the packs like I don't have the the amount of funds to do that all the time, so Well master is a good way to do it I've got one pigsy tc, and I want to get pigsy on my life and my death, so And eventually my ice as well, so that's been take a while But yeah, I probably should also farm for another life master. It might be a good idea But yeah, anyway looking progress, you know that did a lot. Holy crab cakes Talk about credit on a half Dear night, you're cool two blades eight or He's just got four to five we might as well just wait until this for the fire runs out unless he Isn't gonna refresh it. That's fine. I mean We haven't seen that for a while. Why haven't we said when I'm side posting because like they're so easy So we're just gonna wait. We're just gonna wait. Hopefully this fortify will run off by then It's got two rounds left. So it will be finished next time And we should be able to hit next as well. So that's fine. I should maybe use a vending fossil once I always feel like Bad because I don't use it like we go through all the work to get spells and then you just don't use them, you know But there's just like better spells Like a vending fossil isn't that good because You have dinner which cost less perps and it does about the same to all the enemies I believe and you've got scarecrow which like gives health back as well So like And it also costs less perps like it's a lot of perps but it costs less Did I not kill? Oh, I didn't kill. Yes. We can use dinner. We can use my little baby Okay game I see how it is geez The death is bad confirmed. I'm just bad. I need a better pet Don't worry. I'm working on pets I'm working on pets Working on pets differently getting them mega snacks on my life. I've made a kind of okay ish Attempted a life pet, which is good ish So that's kind of cool, but like I'm working on this working progress When the next double gardening rewards comes out, whoo, I got a farm of catch potatoes that is waiting. It's waiting Waiting, I hope that comes out kind of soon Because like I always feel bad when I like don't harvest them during double gardening Rewards because like last time I did that the day after double gardening rewards came out Like I was waiting for like three months and then double gardening rewards came up the day after I harvested Like I Surrender I released the curse that held the lake elementals in my throat That was an interesting deck. We might look at that one Yeah, like the day after I harvested them it came out and like I don't have all the likes so it takes a Takes a decent amount of time to get the catch potatoes back up to mega but like Mega is that the word Alda, that's the word that growth not pets. I Get confused sometimes don't judge me Lake Elemental. Hello Belbinder, thank you for freeing us. We will leave the burrowers in peace. Good Yeah, the path is fixed fantastic Let's go this way But yeah, so I don't really I mean I harvested them a couple of days ago Probably at the start the middle of last week probably like Wednesday or something And they got up to Alda again. So Yeah, I was happy about that, but I'm probably not gonna harvest them until we have double gardening rewards next Just because a doubling Doubling them is great Well done spellbinder. Thank you for removing this great obstacle for us. We must re-establish communications post haste The path is open again to Queen Myrtle town. Can you take a message for me to the Air Force commander to buy a split sky? It's imperative that the message gets to him and I cannot trust that my men won't be intercepted by the umbra legion Okay, they get a lot. Thank you. Where are we going? Like which way are we going? Quistar over here? Oh, it is over into Queen Myrtle town. That's cool That's cool. Queen Myrtle town is quite nice and then it goes into like a really like spooky spooky place But you know, it's fine. It's fine. It's fine. Fine. Fine It's quite spooky over here This is spooky Spooky in a half look at them pink leaves. Oh, it looks really cool. I flip and love chrysalis. It just looks so nice You bear a message from Eliza fireblade Yeah, I do are you that we should trust this message Sabra says she knows you is this true Who's Sabra's? Oh this lady here. Hi. This is the spellbinder who freed Florian in me from the apiary and who helped Jalen in Bumbler town This spellbinder is good and powerful and could be a useful ally Yeah, we could That's right. I see Hmm. It takes a great deal to convince Sabra. So that is I praise indeed We know that shadow weavers and yellow jackets have been massing in Camp Havoc just beyond our borders They are going to retaliate for our attack on the Apidae village the spellbinder could infiltrate Camp Havoc to learn their plans You can sneak into Havoc via our hidden portal that leads directly into their camp They know nothing of it. So you will have surprise It's a strong idea force the night flames to reveal their leader to you. You'll have the information we need Okay, this this place is like really quick and I love it We've not got much left. So most of the quests in here are just talking and like going to places and like Collecting things. So it's like really easy Okay, so anyway, I'll be back once I've defeated three of these guys. It's two battles. Yay Fun, I'll be back in a bit. Okay. I am back just finished off defeating these guys Yes, thank you a crit. So that's why it's doing like so much double-blade crit Gallic I remember you you were annoying in a half Yeah, I love using the starter deck just because it like limits me so much So it forces me to not have as many spells in and it actually makes battles go quicker There's a whole bunch of agave around here. So I was going to town collecting this when I was here with my life that's actually how I got the basically all of the agave that I needed for the The crafting quest and as take a fur this dude for hello here So yeah, it's really good Great place to get agave. It's like there there there. It's all around the series. It's great It's fantastic and you get like two or three H. It's So good so good So yeah highly recommend coming here for agave if you need it If you have access to it. Oh wizard. This is an unexpected delight I'll enjoy shredding your skin and leaving it for warlord Cravenly. He'll be here soon Cravenly the hunter will oversee the completion of the siege engines We will fling come his fire and burn down the last wood He's also overseeing the development of wicked new arms in the weapons tent, which will crush the borrower forces Well, just tell me all your plans. That's cool. It's a great idea Okay, we are going to put on like three just because we can again life with two minions Yeah, they're kind of like stepping it up here, you know, but we should be fine. I've got a dear knight Which is good. We will keep that just in case of a free so that could be bad Luckily, they can't earthquake me Earthquake would be bad. I would Not like that. So luckily they can't do it this time, but they can probably eat free I know I've had people in the past a free me and they're like mobs and I'm what hello I'm here. I do have a feelings to but yeah, we should be fine Okay, and I sweet faint and What are we gonna do now we might go for a cheeky we blade blood a and then we'll go for another blade and And Then we should Something I Mean that two blades then I can kill the minions, which is good. I Know that because I've just been doing that for the last couple of battles Yeah Fizzle unlucky these guys fizzle Surprisingly quite a lot for like this high level like they fizzle quite a lot I'm I was kind of surprised they fizzled like three times in a row when I was in bed Oh, no, no three times two times and I'm like, well what what hello this is chrysalis not fizzle place Yeah, we did that do this sure sure why not Double blade and we I mean we could deanna and see how much it does But I don't think we should Think I'm more I mean they're not like Killing me yet. So we'll just wait until we need to use scarecrows Because that's probably a good idea. Just chill for a bit. Just chill Because I mean I do sometimes overestimate how much I'm gonna do how much damage I'm gonna do but Just kind of bad because you have like these high expectations and then you don't kill in like oh that was upsetting That's disappointing So yes need to chill a bit. I think Not get too ahead of myself decently blade a bit But I mean if we're not too low on health and we've got like Four blades. I might have if we get another blade next or another fine. I might have I Wouldn't be a nurse to the pity Because it would do a lot to the boss especially at a time which is good Blades are just so important Traps on it in my opinion if you're doing something that like does over time blades are far more important than traps so like focus on Focus on that we can enchant you. I mean we've got three blades We can probably hit to kill the minions And get them out which is probably a good idea You know what we'll do that and then we can save up for a dr. Vaughn hopefully for the boss If we need to because of my crib, and we might do a lot who knows who knows you know, I don't know In fact, we'll find out in very soon. Don't love me. You're they spam that a lot. I Mean I understand it because it's like for purpose and like why not spam something. It's four perps Especially if you get like one round you just blade and then hurt like that's a good idea Like I agree with that I would do that if I was fire I'd blade and then media blade media, maybe probably not But maybe you know is that didn't do much at all. Okay. Well, that's just to get out the minions They are definitely dead over time, which is good Yeah, so I waste the blades, but it's fine. We do decent damage to the boss how much health does he have 19,000 now? That's fine I'm Just gonna start blading a bit because obviously we shouldn't Fight the boss because that would be bad Go all this way to like Getting ready for another hit and I end up just fainting the boss and that takes it off. Yeah, not the best idea We should probably get some health back as well. So Possibly looking for a dr. Vaughn as soon as possible I think we're in that sort of situation about now Yeah, it might be noise. I Mean they're dead. So it's fine the minions did like 600. Oh, they're dead next That's fine. Um Situation Okay Six five six they are dead next. Yes, they are Then they can't do as much damage. Oh gosh, why did you quit that's a bit rude? That's a bit rude Critting is rude.  I wish that's how it went What do we put on what other blade do we have? We had a 45 and a 50. Okay, we can enshrine you We're still waiting for like our two faint.  They don't need cleanse We don't need cleanse I'm I mean we can just cut that now because they did anyway, so we just pass It's not getting anything that we need Bum bum bum unlucky Bye That's unfortunate. You're dead and you had so many tips as well.  Oh, well, what a shame Hopefully he doesn't like it because that would be bad. We Probably should get some health back because I am slightly worried. This is a slight situation He's got a lot of perps Four five six seven eight you could forest lord. I just want to escape or just to get some health back It's not going to do much unless we crit and then that would do a lot. He also put up a 45. That's fine. We should have fainted Oh, well, it's fine I never know what he's going to do next. He could have used that faint against me. So we'll just do that No crit that's unfortunate. We'll just Triple faint into a dr. Long. That's a bit much Just slightly annoying but we're half health now. So that is good Um Yeah, we'll just triple faint I suppose Yes, it'll be fine. We'll be fine. I'm not worried If we have to reshuffle we have to reshuffle, you know, this is going to just a bit just a bit slightly worried Oh, hello That's a little bit Cheeky no, at least he's out of pips now or nearly out of pips for what can you do? He can serif Or five what can you do with five pips? You can't do anything with five pips. There's no five-pip life spell. That's good What is the five-pip life spell? Six pips he can send or five pips he can Yeah, I don't know what the five-pip life spell is. I should know this I've got a life. What's right?  I know that it's not a damage spell I've got so many things on me like as soon as he hits. Whoo. That's bad If I could heal that would have been nice if I kept sacrifice, it's fine, right? Um, okay. We're just gonna continue passing.  Please Fizzle I know life might need your business. Oh gosh. He loves this one doesn't he? This guy's gonna do it Oh, he's got a belated and four traps. This could kill me This could kill me. He didn't crit so that's good. Let's see if this resist works enough.   That would be bad. Okay. We are going to hit next. Oh, he didn't hit That's good next round. Please don't hit I'm like This resist works. So that's good Pass Yes, you can get all of our health back if you didn't fortify I mean, I'm kind of happy fortified, but also I'm happy at the same time. We won't be nearly dead. So that's good Oh my gosh, 59 seriously.  That's like nothing I'm impressed with myself Correct. That would be cool. No, okay. That's just too much to ask for apparently He's so dead. Yeah We've got four health again. So that's fine. If he isn't dead, we'll get dope. Yes That fortify saved him. Yeah, that fortify saved him a bit And so did the other fortify. He loves fortify. Um, We're gonna wait until we can reshuffle and then I'll probably just dare not Reshuffle dare not. That's probably a good idea Battles are starting to get longer. So I'm gonna probably skip the next couple battles that we have to do Just because they're Like quite long now Hello, okay If he didn't have that fortify that would have done a lot more or not a lot more, but like would have been good Would have been good at least would have been good But maybe I should have scarecrowed the minions so they didn't do as much damage. Maybe Yeah, and then Hit with dr. von and then finish with dare not maybe Because I really do like finishing with dare not because it's like no pips Well, it's like five pips, but like Like three rounds. So Finishing with dare not it's just pretty good But I mean we're not dead at this stage. So fine We survived with 59 health So I'm impressed with that one Um blade dare not blade blade dare not we've got a one of you Okay, we're just gonna discard you because you can't do anything too bad to us.  I think we can put that faint on Um just before we or just after we've hit so there Dot does a lot He'll be a big dot centaur good spell Overused but life doesn't have many good spells to use. So I mean why not use it? It's good Just use it that did a lot 1,300. Whoo Okay, and dare not Yes, very good very good This won't do much damage, but like we'll be fine. We can put a faint on and we should be good Oh, I crit as well now I can crit. Okay game. That's cool I see how it is. Oh, he's so dead. He is so dead. I don't even need to put a I can just pass. It's got 5,588 Yeah, fine. Okay, there we go. That's that done. That's probably a while. We've been longer than I thought You like child curse you and your pet in your mount too Maybe you should look around and see if you can find the weapons tent and see what they are up to Okay, let's find the weapons tent. We also need to get a bit of health back would be nice noise um, and I think I think it's like the nearly the end of this area, which is kind of a surprise because we've even actually been here much Um, no, I I know a galve which is a shame, but there's no that isn't a health worse. I saw a red. I'm like, oh health But that wasn't the health Um, let's get some of this If that's appropriate. Thank you Um This one here. Yeah, I think it is. There's a boss in here There are some ominous sounds of weapon grinding and fitful whines coming from this tent Oh, actually, maybe there's no boss. Maybe it's just a mob fight. I get really confused and chrysalis because like New enters to jail and it's not always um, um boss fight. It could be like mobs, so Yeah, kind of weird, but we'll see Either way, I'll probably skip this battle Night bringer, I sting your heart. Yeah, so I'll be back once I've finished off this battle Transforming bumbler drones into goliaths here Oh, um, anyway, I am back. Oh not that one. Oops cancel. Um So yes, that's interesting. Let us go and talk to tow bias once more And we'll continue on because we are finishing this area today no matter how long the episode is Um, I don't think I think we've got like one quest left and one of them or two quest left And one of them is like just I'm pretty sure one of them is like just talking to people. So we'll find out I don't think there's a lot left Um, but yeah, we're gonna talk to to bias now. Hello Spell binder, what news have you brought us? You defeated a shadow weaver lord. That's excellent news Ah, but the information about them expecting a war lord and creating new forms of goliaths is most worrisome Talk to sabra. I think she has worked out a new plan Oh that xpedo level up. Yeah boys. I believe I've come up with something My sister sidra was sent to scout tirian gorge, which is where the arachna mine the kermis fire They intend to use against us when we returned from the apiary sidra had not reported back So we sent florian sun flare out again to find her But now he has also vanished. We think he may have been taken by blue razors near the flower meadow. Can you help us find him? Okay more of these um So, yeah, we level um 93 now, which is fantastic. I think we've got a new deck here. We do So we were using this deck as our kind of like boss deck, but now we can use this one which is I mean it has its give and take we can only fit um eight copies of death spells instead of nine The sideboard is one smaller, but it gives more health and the damage. So overall, I'm thinking that will probably Head more to this one just because of that one damage and I mean one percent incoming is like nothing anyway Especially if we don't heal but like the health is good. So we will probably use this one Empty deck. Yes. Okay um So, yeah, oh there we go. Copy that over fantastic. Uh treasure cards included. No 123 and storm for cleanse We've only got one. Okay um, but yeah, anyway, I'll be back in Just a bit once I've defeated a whole bunch of these guys Okay, just finished off defeating those we found out that um, they he's kept over in this little dungeon thing here So we head on in there. There's obviously a boss in here Um, that's basically what he said as well on this speech. So you finished after I defeated it So we skip that one as well just because we're getting a bit long on the episode front Outsider why do you intrude on my lair? I am a devotee of the shadow queen and have traveled from far Zafaria to serve her Do you think a petty magician like yourself can hope to stump me? Yeah, I do kind of um, we need Prisms Uh, yeah three We'll be good. Sure. Um, so yeah, I'll be back once I've finished off this Okay, I am back That was the worst battle that I've ever had and I don't want to be here anymore Um, I got him cabled four times Four times Magician you have unraveled me. I will tell the shadow queen of your intrusion and she will deal with you herself I was furious Two times just before I hurt Spellbinder, thank you so much for freeing me from grim Mimo The blue razors wounded me and I feared I would not see home again I cannot continue my quest to Tyrion gourd. I can just about make it back to queen myrtletown Meet me there So yeah, that was um, not fun. I'm gonna say that the Boss herself doesn't have that much health. So like she's not a worry And she's also death. So like nothing to worry about that But the minion holy crab cakes it enfeebles so much Like enfeeble is such an op spell like honestly I Strongly dislike enfeeble. It's only three perps and like it removes all your blades Like I can I can understand if it was like a part of like a hit Where are we even going this way like if it was part of a hit? Yeah, fine But like just on its own.  I just strongly dislike it so much um Like if it was pvp only like yeah, I would understand that but like I know I hate enfeeble. I hate enfeeble makes me angry Florian what happened to you well done spellbinder will get florian to rest and recover Spellbinder would you continue to help us and take up florian's quest? Fly to Tyrion gourd and search for my sister sidra You'll have to pass through bastion, but I don't know how you'll open the silent market gate to tyrion gourd You know of some people in bastion who might help you do grand Once you get there search for any signs that sidra left. Let me teach you our signcraft Okay, so um next time we will be hitting over into the tyrion gorge most likely Um, so yeah, thank you for watching room to leave it. I can subscribe and if you've already subscribed Pris will bell soon or exactly when I post another video and remember craft outside the box


Welcome, everyone. I'm Surya Sitaraman. I'm an engineer working on the OpenShift networking team at Red Hat. I'm also a contributor to the SIG Network Policy API working group. Welcome to our talk on the Admin Network Policy API. It's a new Kubernetes native API that is designed for comprehensive, cluster-wide network security. Hello, everyone. My name is Nadia. I'm a senior software engineer at Red Hat OpenShift networking team. Hi. My name is Yang, and I'm a senior software engineer at VMware working on container networking and security. And my name is Andrew Stoikis. I'm a senior software engineer at Red Hat in the office of the CTO. And we are all part of the Network Policy API subgroup to SIG Network. That subgroup is fully devoted to the future of upstream policy-based APIs. Today, there's a lot of downstream variants of policy-based APIs. We're trying to consolidate everyone to increase portability and help the whole ecosystem. We additionally have a maintainer-track talk on that subgroup tomorrow afternoon, so please come check us out. OK, so hopefully everyone heard the theme music as you were walking in. We're really excited today to go into a little Hogwarts story. Who here knows what Harry Potter is? Hope to see a lot of hands. Who here would classify themselves as like a Harry Potter fan? Some good hands, some good hands. OK, awesome. I'm a huge Harry Potter fan, so I forced everyone here to kind of go through the Harry Potter story, so bear with us today. For today, we're going to have a Hogwarts Kubernetes cluster. At the head of that Kubernetes cluster is going to be Albus Dumbledore, of course. So he's going to be our cluster admin. We're going to be telling this story from the bottom up from the perspective of the cluster admin. So just try to keep that in mind. It's going to be really important to remember throughout the entire story. We also have some really important namespaces, right? So we have the Forbidden Forest namespace. Ooh, scary, right? We don't like it, just remember that. The Professor's namespace, obviously, that includes Professor McGonagall, who is an important developer. Now, they're a namespace with some developers, but those developers have slightly more rights than the rest of the developers, right? They're professors, so they're kind of important. And of course, we have Gryffindor and Slytherin with our favorites, Harry and Draco. This is what makes up the Hogwarts cluster, and it's going to be integral to the rest of our story. So let's hop into kind of ground zero. Today in Kubernetes, the basic networking model is every pod can talk to every pod, right? And I think most of us are pretty familiar with this, but we wanted to start from ground zero. So here you can see Gryffindor namespace pods can always talk to Slytherin namespace pods. Everything is kosher. By default, everything's allowed. So let's look at a little bit more complex case. Not that much more complex, right? Harry doesn't love Draco. Harry's like, ah, Draco's a little evil. So we're going to block traffic from the Slytherin namespace. What do they use to do that? Today, they really only have one tool that's part of the core Kubernetes API, and that is network policy, right? Most of us here know what network policy is. It's been around for a long time. It's a stable API. It was originally made explicitly and only for the application developer. And I want everyone here to remember that. And it was also explicitly made to be namespaced. It was not cluster-scoped, and it was only for the application developer. So one other funny thing I want you to note here is that when Harry creates a network policy in the Gryffindor namespace, it implicitly isolates the Gryffindor namespace from everything. On this slide, we're just seeing from Slytherin, but on the next slide, we'll also see, oops, kind of accidentally, kind of not accidentally. We also block traffic from professors. But wait, shouldn't professors be allowed to talk to every student namespace? This is kind of a problem. So let's look at that a little bit more. So now, what do professors do? Even if they really want to talk to student namespaces, they might try to use those existing tools that we have, right, network policy. But that doesn't work very well. As you can see, even if professors try to write and allow in their namespace, that arrow is still red. We have some major problems. So this is where kind of the work we've been doing comes in. We're moving away from the application developer role and looking at the cluster administrator role. And Nadia's gonna kind of take us down that journey of some of the new stuff we've been working on. Thank you. So we've seen how professors try to solve their problems themselves. That didn't quite work. So now they go to cluster admin Dumbledore and ask for help. And actually, Dumbledore is able to help thanks to the new API called admin network policy, which is created specifically for cluster administrators. And it lets you enforce security policies that can apply to multiple namespaces and that cannot be overridden by any other personas. So Dumbledore actually agrees that professors should be able to talk to all houses and he creates a cluster-scoped object admin network policy that explicitly allows that. And you can see the arrow is now turned green. But let's take a deeper look into how it works. So we have introduced three layers of precedence. They are evaluated top to bottom. And you can see that the first one is admin network policy. It is managed by cluster admins. And as soon as admin network policy has a decision on a connection, it will be applied and nothing else can change it. But if admin network policy didn't match your connection then the network policy is the next layer that will be applied. It is managed by application developers and that will take effect. And you can see there is one more layer that is called baseline admin network policy. It is also managed by cluster admins and it is evaluated last and we'll talk about that in more detail in just about a couple slides. Okay, so let's go back to our professors and see how it actually works. So you can see that admin network policy has the highest precedence so it will be evaluated first. That means that when professors are trying to connect to the Grifendor namespace, this connection will be matched by an admin network policy and the connection will be allowed. But for Slytherin namespace it is a bit different because their connection to Grifendor namespace is not matched by an admin network policy. That is why the Grifendor namespace network policy actually applies and that's why this connection is still denied. You can also see one more detail. It's a little field called priority and admin network policy object and all it says is that different admin network policies are prioritized and this field basically defines in which other admin network policies will be applied. So let's keep this picture in mind as Yang will show us a little demo on that. Thanks Nadia. So as you look at the admin network policy in CYAML form, you can see that it is really kind of like similar to the current Kubernetes network policies but there are some key differences. We wanted the API to be explicit first of all and second of all, we're seeing some fields that are new to the admin network policy which we highlighted here. First is a priority one. The priority field actually signals the relative precedence of this admin network policy compared to the other ones but admin network policy objects in the cluster will always be evaluated before the namespace Kubernetes network policies. So that's why we can achieve something like strong allow that we're demonstrating here. And the second one is for the rules which is in the ingress, the ingress section, there is a explicit action field that says I want this to be allowed or denied and it actually comes really handy with the priority model so that you can do a denied rule underneath and then some allow rules on top of that which we'll show later. But for the purpose of this demo first, this is a strong allow story which we just showcased here in this diagram and we want to dive in to a pre-recorded live demo. Let's see if it works. So we're showing this on a cluster that's running and share as a CNI. And share is open source CNI based on OVS and along with other Kubernetes are two first implementers of this admin network policy API. So you can see that in the cluster we have entry running as a CNI and we are actually also showing all the namespaces that are in the cluster which includes the Forbidden Forest, the Gryffindor and Sres ring houses that we just seen and the Professor Namespace. We wanted to make the demo a little bit easier to read. We wanted to, sorry. We are actually looking at the Gryffindor namespace and there is actually the network policy that we just talked about which says I don't want to allow any connection coming in to me. And this network policy actually does that. As you can see it allows nothing as an ingress traffic and it's applying the Gryffindor namespace. So for the purpose of demo, we're first of all exporting the IP of the Gryffindor a Harry Potter pod in the Gryffindor namespace which serves as our Harry Potter IP. And then to demonstrate the network policy effect we can see that the Dracoal pod in the Sres ring namespace cannot actually connect to the Harry Potter IP because of the network policy that are in the Gryffindor namespace. Similarly, if we want to initiate a connection from the Professor Namespace to the Harry Potter IP it will got denied for the same reason because of the same network policy that's in place. Now let's look at the admin network policy that I just showed you guys which is we have the Poverty 11 admin network policy which is applied to the two houses and it has a strong allow rule that says the professor should always be able to talk to the houses. Now if we do the good old Kupkado apply of this policy and then we try the connections again now you will notice that the professors are now able to talk to Gryffindor because the admin network policy has a higher precedence and overwrite the network policy implicit isolation behavior. On the other hand, Dracoal will still not be able to connect to Harry Potter because of the network policy that Harry Potter has placed. So this is the first part of our demo and in addition to something like strong allow, oops, we also wanted to show another use case which is strong deny. This is a totally different storyline because we're now looking at the forbidden forest. As Andrew just mentioned Dumbledore comes in and say forbidden forest is really dangerous. Like nobody should just be able to talk to them forest but people like Dracoal and the professors they are actually having their own allow policies they are trying to talk to the forbidden forest. So as an admin how can I lock this down completely? Well the answer is a strong deny admin network policy. So right here we have a admin network policy that's really like the one we just showed before with a slightly higher priority but instead of allow rule we have a deny rule for the egress. It's selecting every namespace in the cluster and basically says that nobody in the cluster should be able to talk to the forbidden forest. And we also has that as a demo so you guys can better understand how this works. We have the, oh, wait a second, is it? Can you guys see that all right? I think the resolution is a little bit low for that one. Okay, cool. All right. So yeah, we have the same cluster as before. We have the four namespaces. This time we're exporting actually the forbidden forest pod IP so that we can refer to it later easily. Then we're actually looking at the admin now policy that I just showed which is a strong deny one. And as I said it applies to all the namespaces, has a higher priority which is trying to deny people to talk to the forbidden forest. And as we showed before, we wanted to do a Kukalo apply for the policy so that we created a cluster level. Okay, now it's created. What it does now is that if you try to make a connection from Draco in a certain namespace to the forbidden forest IP, it will get denied. It because the admin now policy is taken into effect. Similarly also like for the professor namespace, if you initiate a connection to the forbidden forest it will also get denied because of the same admin now policy that's applied there. The important part though is that we are actually also gonna try to put a now a policy in the professor namespace which basically says that as a professor I wanted or as an application developer I want to put a now a policy that actually allows myself to egress to the forbidden forest namespace. Well, this now a policy has been already created in the professor namespace and that's allowing egress traffic to the forbidden forest. But does it work? Let's find out. So we're having a connection from the professor namespace to the forbidden forest and it's timing now because the admin now a policy strong deny is actually taking effect before the now a policy evaluation. So that's how as a cluster admin or demo door you can ensure that if you have a strong deny rule it's always gonna hit before any developer tries to do anything different. So that concludes my part of the demo. And I'll hand over to Nadia. Thank you, Yang. That was a nice demo. Let's get back for a second from Yamal's two pictures. That is what we've just seen on this demo. So we have a cluster why deny everyone to the forbidden forest policy. No one can talk to the forbidden forest even though they have their own allow network policies in the namespaces. But at some point professors decide that they actually do want to go to the forbidden forest. Maybe they need to feed the giant spider or they have some other business there who knows but they go to Dumbledore again and say that yeah, we want to decide by ourselves and actually Dumbledore thinks yeah, professors should be an exception to these strong deny rule. I want to delegate this decision to them if they want to allow themselves to go to the forbidden forest or not. And that is now possible with a new pass action. What it does is it basically skips all the following admin network policy for the matched connection and jumps straight to the namespace network policy layer. So let's try to see what happens here. You can see that pass action admin network policy has higher priority than the deny one. So it will be applied first. And then when professors are trying to connect to the forbidden forest, pass action network policy will be applied. And the network policy in the professor's namespace will be actually the one that decides if the connection is allowed or not. So now you can see that professors can connect to the forbidden forest namespace because they have this allow network policy. It is again different for the slithering namespace because their connection to the forbidden forest is not matched by the pass admin network policy but it is still matched by the deny one. So this connection will be denied without even looking into what slithering namespace has in it. Okay, now keep that picture in mind again as we go to Surya's demo. Thank you, Nudu. So like Nadia mentioned, we have a pass action and a normal traditional firewall usually allows you to do deny or allow. So the pass is our shiny new feature that is a part of this API. And this is that feature that lets admin network policy interact with the network policy. So this is exactly how you delegate to the network policies in your namespace. So this is how the sample demo looks like of kind admin network policy. And here we are trying to pass all the egress traffic that's coming from our subject, the professors and going towards the forbidden forest. You can see that it's created at priority three, which means it's higher compared to the strong allow and deny admin network policies that Yang created on his cluster. And we can also see the explicit action pass, which is different from what you've seen before. So I know I'm the last to present, but I wanna make sure everybody is with me here. So how many of you use network policies? Can we have? Cool, that's a lot of you, I'm happy to see that. So this is the one thing that lets your admin network policies interact with the network policies, right? So literally if you figure out that your network policies are not working as expected, you might wanna open a ticket to your cluster admin or I'll be stumbled on, right? Trying to figure out what's wrong. So let's look at the pass action demo that we have prerecorded here. And like Yang mentioned, I'm gonna show the demo on the OVN Kubernetes CNR cluster. So here we have a kind cluster with three nodes, one control plane and two worker nodes. We also have our OVN cube agents that are running on each node in our cluster. And then we have our demo pods, right? So these are the four namespaces that we've been coming back to again and again. So we have the forbidden forest namespace, which has the forbidden zero pod. We have the Gryffindor namespace with the Harry Potter pods. We have the professor's namespace with the Milvano-Gonagal pod. And then we have the Slytherin namespace with the Draco-Malfi pods. The ones that we care about in this story line in the demo are the professor's namespace, so this one right here. And the forbidden forest namespace right here. We also have a network policy that is defined in the professor's namespace like we saw earlier, so this is namespace scoped. And this one is allowing all traffic to go to the forbidden forest. And this is, I'm just taking it from the same spot that Yang left in his demo. We also have the two admin network policies in our cluster at priority 11 and five. So this is the strong allowing the strong denying cases. And I think you've already seen the strong deny Yang that looks exactly like that. So we have basically denied everybody in our cluster from being able to talk to the forbidden forest. So all the egress traffic is denied. So clearly when Milvano-Gonagal tries to talk to the forbidden forest, she gets a tie knot. So this is where our Albus Dumbledore comes in and he says, okay, I wanna delegate, right? So I wanna create a pass action admin network policy at a higher priority number three, which allows Milvano-Gonagal to be able to talk to, well, not really talk to, but to allow Milvano-Gonagal's network policy to take effect. So the pass A and P that you see here is exactly the same thing that I showed on our slide deck. So let's go ahead and do a clip cut to create of our pass action, sorry, pass admin network policy. Let's also do get admin network policy command to make sure it's created and that we have all our three A and P's in our cluster right here. And now when Milvano-Gonagal tries to connect to the forbidden forest, you can clearly see that it passed, right? So it actually worked as in it was successful. The reason is because the network policy in the professor's name space is what took effect here, not the strong deny, not the, it was actually the pass admin network policy which first took effect and then it actually delegated it to the network policy in the professor's name space and that took effect, right? So that's two matches that happened there. So going back to our picture, so this is the same thing that Nadia explained and this is exactly what you just saw in our demo right here. So we have the professors who tried to talk to the forbidden forest name space. It worked seamlessly because we have a priority three pass action admin network policy that took higher priority compared to the deny admin network policy in our cluster, which was a priority five. So we keep coming back to this diagram because it is kind of important and this is how the interaction works. So from the admin network policy layer, so let's say you have an admin network policy where you passed the traffic which is what we saw in this demo, you fall down to the network policy layer, right? But let's say you have no admin network policies on your cluster, in which case, there's nothing matching that layer, right? So then you evaluate the network policies anyway. That's the two conditions for you to fall back to the next layer. And then if there are no network policies in your cluster, then you fall down to the third layer which is the baseline admin network policy. So this is the second resource that we ship as part of the admin network policy API. It's also a new one and one of the use cases and one of the main reasons why we shipped this API is for you as cluster administrators or for Albus Dumbledore in this case to be able to define default guardrails in your cluster. So maybe there are no admin network policies and network policies in your cluster and maybe when you delegate stuff, it doesn't really hit any network policies. Even in that case, you wanna have a zero trust policy sometimes, right? So the baseline admin network policy which is a singleton resource in your cluster allows you to do that. So let's also come back to our storyline here, right? So we had a pass action admin network policy at priority threes, that's where we left off. Now we are creating another resource which is the baseline admin network policy and this is saying I wanna deny everybody from talking to the forbidden forest. So this is the default guardrail that Albus Dumbledore is laying down. In case professors don't have any network policies, you don't know, right? They could just delete it for all you know. So you wanna have the default guardrail layer on your cluster and that is what this shows but still we still have our admin network policy and the network policies in our cluster at this stage. So right now the pass action admin network policy is what is taking effect right here in this picture which is why you still see the arrow being green which means it's passing it to the allow to forbidden forest network policy in the professor's name space. So that's what's taking effect right now in this instance. Like I mentioned, what if you delete the network policy, right? What if the professor's name space has no network policies present? In that case, that's when the baseline admin network policy fondly known as BANP kicks in. So now you're gonna deny all the egress traffic from everyone to the forbidden forest based on the BANP. So it's the point to note however is the admin network policy at priority three is still being hit and then you are passing it. It's just that there's nothing on the network policy layer right now. So you're falling down to the baseline admin network policy and this is how a sample YAML for a BANP looks like where you have, like I mentioned it's a singleton resource so you can have only one BANP in your cluster. So BY is to define it, right? In our subjects part of the API we have selected all namespaces in the cluster and we are saying we're gonna deny egress traffic from everyone to the forbidden forest. Let's also look at our part two demo for the BANP on a OVN Kubernetes cluster. So just recapping the whole thing we have three admin network policies on our cluster right now. We have a network policy in our professor's namespace and this is how our baseline admin network policy looks like which I showed on our slides here. And so let's go ahead and create our BANP in the cluster right now. Let's also try to get the BANP to make sure that it got created correctly. So we have our default BANP right there and now when Minawama Garnagal tries to connect to the forbidden forest she's gonna get connected because we have not really, because we have not really had the BANP take effect, right? There's still the network policy in the professor's namespace that's kicking in. So we have created the baseline admin network policy but the reason why the connection still works is because you have a network policy in the professor's namespace. However, if you delete that network policy, any pass action that's happening from your admin network policy layer is gonna fall down to your third layer BANP and that's why the connection doesn't work anymore. So the key takeaways, right? So let me try to recap it. I'm sure that was a lot of information in the short time that we had. If you are a cluster admin persona, please check out our admin network policy and baseline admin network policy resources and you can clearly see that if you define A and P's, you can either use the pass to interact with your network policies or with your baseline admin network policies if there is no matching network policies, right? And then if you have no admin network policies and no network policies, you can still fall down to your baseline admin network policies. So these are the three layers to keep in mind and the three takeaways of our presentation. Over to Andrew who will talk about how to get more involved in our project. Yeah, so thanks, Surya. I think this was our first introduction to admin network policy at our main CUBE contract. Our overarching goal is to consolidate on network policy APIs. We know in the ecosystem today, many CNIs implement their own sort of global network policy or cluster scope network policy. We wanna bring it back to the upstream and we wanna make it portable for everyone. So how to get involved? I kind of split it up into a couple different levels here because we want everyone. Like we truly need a lot of help. We've had some exciting new contributors recently and they're able to kind of hop in and take some big roles. But even before getting involved, if any of you maintain a CNI or know people who maintain a CNI, we wanna get the message out there. We wanna work together. We have some really exciting new features that are coming in with the admin network policy API that we didn't talk about today. That'll be for another talk that kind of make it even more useful. But for getting involved, I've laid out a couple different layers here. You can kind of be completely new. Start at some of the generic Kubernetes documentation. You also can be a little bit more advanced with that. Hop right into our documentation and even further if you're sitting here and saying, oh wow, I'm a CNI who has a cluster scope object and we are implementing a feature that we haven't talked about here, we wanna hear that. Like we want everyone to get involved. We wanna create new NPEPs which is kind of our version of a KEP. We've designed it after the gateway API's GEP and it is way less painful than a KEP. So it should be a lot more enjoyable process to get done in my opinion. So yeah, I think that's all we have today. Thanks so much for coming and please leave us a review if you'd like to. Take some questions now. Shem, but I did just wanna let you guys know how much I'm looking forward to trying this out. It's gonna make my life so much easier and I just wanna tell you guys so much I appreciate your work. Thank, we appreciate you. That's exactly what we wanna hear. Thank you. For the baseline, you have a rule in there that says you can deny or allow or whatever. What's the default from that? So if you say you're forbidden from talking to the forbidden forest, is everything else then allowed or does it, how does that work? If it doesn't hit a rule at baseline, it falls down to the default stance of the Kubernetes cluster which is always allow today. But what we kind of foresaw baseline is being as a way to kind of flip that, right? So network policy, it's implicit. Whenever you make one, it blocks that pod off in the namespace. We wanted to make everything in this API explicit. So if you wanna do that at a cluster scope, you can basically create a baseline admin network policy that says don't allow anything to anything and then developers and admins need to work together to whitelist or allow list the things that should be allowed for the cluster to function. Right, so I think the major thing is usually the baseline policy is supposed to be used for denied rules. Though the reason why allow action is in there is because we have power these, right? So it's really hard sometimes to make a whole lot of a bunch of denied rules where you can now with the baseline admin now with policy, you can actually stack an allow rule which is really narrow and then we have a universal deny everything rule below and then it would just work as expected but it's just a way for you to more easily apply those kind of policies. Yeah, but you can only have one BANP so you also wanna be a bit careful with how that's defined. Sometimes you can shoot yourself in the foot and deny everything to everything. So yeah, that's also why we don't have priorities on that API, yeah. Or if you have a very nice use case while you may need more than one BANP reach out to us, we're happy to discuss. Okay, it's not a question, thanks for the sessions. So I'm part of the maintenance Andrea projects that you saw here. You're all invited for the dinner tomorrow, food and sweet dinner on here, free dinner, free drink, two, two, one, six, sour, Michigan, jet and cherry. That's awesome. Two, two, one, six, sour Michigan, four PM tomorrow. You're all here, invited for dinner and drinks. Offered by VMware, Binance and Google. They're three talks. We have a speaker here. He's one of the speaker. Go deep and do this. Thank you. We'll talk about admin or posse, yeah. Yeah, so thank you. This is actually very good. I think it's very needed. So I had a question about your earlier comment about user versus admin. So how often do you actually see actual users, quote, users? What scenarios do you see users writing to the Kubernetes API? Because something I've seen in the industry, and I just like to see your input on this, is that there are people who talk to the Kubernetes API and then there are the containers running in there. And a lot of people like to force users to be just in the containers and not know anything about Kubernetes. But clearly this is, you have to know quite a bit about Kubernetes to do it. So I just, as far as that line, I don't know if you have any inputs or thoughts on it. I mean, basically a person making a home package. You might consider that a user, right? Because that's what that is really applying to. But the question is how often, like is there a particular workflows that you've seen where they're like more other than that? I mean, I guess because like a lot of the GitLab stuff and the bunch of stuff I see out there, it's a clear wall between Kubernetes API and the actual application running in the cluster. I think like that's kind of an interesting case for us as core developers versus what's going on in industry on the ground, right? And to be honest with you, like we're thinking of it from when we say a developer, it's sometimes lumped in there synonymously with something that you might wanna call a namespace administrator, right? So someone who's in charge of a namespace and who gives pods or resources to someone who can't talk to the Kubernetes API, right? Does that make, does that clear it up a little bit? Yeah, that's to me, I guess that's kind of like there's one level of cluster admin and then there's maybe some sort of another level of admin. Right, there's like, and the personas are, they do are a bit flexible. And like if we need to be more clear on that, please, please come talk to us. And that's, I mean, it's a great question, really good question. I think a lot of times we have the cluster admins define our back roles for the namespace resource in general, and then each namespace owners can do their own thing is what we actually intended, yeah. Okay, so this stuff is really cool. My question revolves around that new priority that seems like adding a lot of complexity. First question is, do you foresee that adding quite a bit to what CNI providers have to implement? Do you see issues with having to implement something like that where before it was, hey, I defined one set of white listed rules in order to evaluate a policy and now I have a chain to filter. So I think today, different CNIs already have their APIs proprietary and one of the goals that we have is to be able to commonize all of that and be using the Kubernetes native API. So for example, Calico has their own global network policy, CLAIM has their own, so today implementers already have an extra layer, right? And we are actually trying to make it simpler by having just that one API that they have to implement. So almost all CNIs today, like most common ones have it. As it pertains to the data plane, it depends, right? CLAIM already has priorities. That's one concrete example, whether it's easier for, or sorry, I misspoke, Calico already has explicit priorities in their global network policy. Is it hard for CLAIM to do it? Maybe harder than Calico, but it is on a basis level. I think the other part of that question is complexity and use, right? It's gonna be tricky, right? We're gonna have more priorities, more objects with different priorities. You, as an administrator, or even as just a viewer, observability viewer, how do you understand the relationship between those objects? We actually have kind of a commitment to create some really nice developer tooling along with this API. And we have a cool tool called Cyclonus that we've kind of been building off of in the upstream that gives you a really nice table output view of the relationship and what's going on with your cluster. That's a place we need help. It's gonna be really exciting. I think it's gonna be cool for the whole ecosystem, so. And I think if the concern is on the poverty, the scale of poverty, know that right now in the API, it's not unbounded. I think it's like a hundred, zero to a hundred something. Like we can't think of a use case where people will create 90 different priorities in the cluster already, not to mention like say 10,000. So there's not going to be too much of a data-playing trend, in my opinion, for most of the CNA implementers. We just want to control it so that people write policy that are actually making sense, right? They're not tries to put every rule in every namespace as a different priority. That just doesn't make any sense, so. And I think it's kind of like, what I've seen in production today is the proliferation of thousands of network policies. Like customers are rolling out entire systems just to manage their network policies. And we want to cut that down. One more detail to add to that is that it's a bit of moving the complexity to the implementation from the customers because it seems like it is actually easier for customers to use priorities. They are very used to it. They know how to write their policies in these terms, right? So that's another reason to do that. My second question regarding priority is priority unique. And if it's not unique, how do you handle two policies that might conflict or do you have to leave space in order to and plan out eventually what could be, if there's changes and you reorder, you might have to reorder all of your priority numbers? The API today itself is actually, if you define two admin network policies at the same priority, it's undeterministic. The definition, so it's a great question. However, implementations sometimes take over and they do the implementation specific stuff. So the way we did it in the OVN Cube CNI is we say that you cannot create two admin network policies at the same priority. We do not support it. If you do it, it's at your own risk. So we call that out. I wanted to add on that. It's only undeterministic if you sort of like step on own toes because there are use cases where you have to admin now policy, create the same power, but they're regulating completely different traffic. And that's fine because you will never have a conflicting rule with each other. But let's say, you know, cause a pod can have 10 labels, right? So if you are writing different labeled rules, which are essentially selecting the same traffic, but one is two at the same priority, one is allow and one is deny. Well, you kind of like step on own toes. And that will be undeterministic. It really depends on how the implementations choose to write data pass rules for it. But in general, we just advise against doing that. And it's important to remember that rules are also ordered within a single admin or policy. You can write multiple rules at one priority level and they're explicitly prioritized in that single rule. So we hope to avoid that as much as possible. And we hope to write really good tooling, really good user documentation to avoid it. Thank you. Great questions, by the way. Thanks everyone, that was awesome. We have the SIG Network Policy API intro and update stock at 3.15 central time tomorrow. So please join us if you wanna come and know more about that. Yes, we want contributors and help and implementations. A lot of cool proposals that we are trying to add to the admin novel policy. So thanks everyone. Thanks. Thank you.