Good morning, good afternoon, good evening, wherever you're healing from, welcome back to another Data Services Office Hour. I am Chris Short, host and showrunner of Red Hat Live Streaming. I am here with the one and only Michelle De Palma. Michelle, how are you today? I'm good, how are you? I am good. Before the show, we were talking a lot about disaster recovery scenarios, but like human disaster recovery scenarios. So it's interesting to be on the phone and we're on the horn with you right now to talk about, you know, data. It's kind of, you know, importance. If I had known, we could have switched to like a disaster recovery. No, I'm done with disaster recovery for this week. You don't know, like take questions down and pull the power plug. Good. So this is, there's nothing disastrous about this, except we are, it is a live demo, and it is OpenShift 4.8, which is GA. Right, GA yesterday. GA yesterday, which is good. Good. But it's ODF 4.8, which is not GA. So we're living on the edge. We are living on the edge here. You've been doing for a few days. Yeah, pretty much. It felt like I was on the edge of existence for a little bit, but yeah. So hopefully this will, I actually, I've done it a few times, but you know, it's live, things happen. So, but I at least we're not starting out with the intention of breaking anything. I'm actually like everything to work properly, but you know, but that's okay. Oh yeah, like I know where that goes. Sometimes I come in with that, like, let's break something. And now I'm like, oh, let's have everything not break. So let's lighten the burden for you because you've had enough happened to over the last few days. So, okay. So I'm going to present my screen and we're going to talk. I'm going to do the whole desktop here. Yeah, so just to let you know, people have been having some sharing issues with Zoom lately, like the tab sharing has gotten weird, I think, or something's changed there. Oh, all right. So let me know. Do you see this? Yes. Okay, font size is very, everything. Okay, so today, what was our subject today?  Oh my gosh. But we titled it... Using vault with ODF for better security. Thank you. Okay, all right. Just tracking it. All right. Sorry. You're fine. So we have gone through, this page should look familiar, right? We've done, this is our OCS training page done by people in my team, the practitioners, we kind of write this up. So I actually have only contributed a little bit. This is mostly JC and Chris Flum and then all kinds of wonderful people contributing this. So normally when I talk to you, we're up here in general deploying use and we're going through some new feature. So we did a little bit of encryption last show, maybe the show before, I don't know, but we were down here in external Canvas encryption. Did we do any of it? Anyway, it's been a while. No, we did do it. No, we definitely did do it. I was just trying to remember when it was because it seems like a month or... And that, yeah, you're right. Yeah, it was like six weeks ago. Okay, so we did a couple of these sections here. I think we did all the way up to six. So I've added this new section. I know that's why it's such a magical... Brandyler persistent value in that rest encryption. That's what I'm talking about. It just goes on and on. Okay, so I just want to let everyone know it's here. However, I have a new version of this that I haven't finished the PR yet. This is the, I think a better section on the same thing. So granular persistent volume at rest encryption without cluster wide encryption, Kubernetes, Auth methods, service accounts. That's what we're doing today, but nothing should break. So just a level set with... So are you a vault guy? How's your vault? My vault was like minimal when I went into this. I mean, I've used it in the past, but it's not like I have like a vault constantly running someplace, right? Right, and I've used vault as a user. I've never been on a vault admin team or anything like that. So this is a learning curve for me. The admin team, like trying to run the infrastructure and everything. So I mean, it's a great product. I like it a lot. And it's the first one we're going with, I guess due to popularity, I know we're doing more. I don't know the roadmap for that, but I know it's planned. So here's how this kind of flows, right? So we're under data security. We have data at rest, and we have like at emotion. We're not dealing with emotions. We're strictly talking about at rest. And once you come in, you know what you have once you're in that rest, it's like you can do the whole storage cluster, the whole thing, cluster wide, or you can do storage class. And then that would be, that would be PV. That's because then you can create a PVC that uses a particular storage class, that storage class, some crypts. So we're on the storage class side, right? We're not doing the whole cluster on the storage class side. So with both of them though, and we're only gonna talk about storage class today, you could have a vault instance running in the cluster, but chances are you don't. Chances are it's external to the cluster. So that when I say external here and external KMS, that's what I mean. It's not a service in your OpenShift cluster. It's running somewhere else. Lots of reasons for that, like it's existing and that's where your security team wanted it to run. They're doing some of the BHA that they couldn't, I don't know. So- A lot of people put their vault server on its own like VLAN and everything, right? Like it's off to the side in this highly protected environment with very granular controls. Yeah, exactly, it's blowing. Yeah, you go to that VPC and AWS and all of a sudden it's like, oh, it's magical. What's going on around me? Exactly, it's your vault universe. Run by some team you've never heard of and don't know how to contact. So for that point, there are a couple things about this. Wow, so a couple of things about this demo. So when we come in, there is obviously in this situation, I have my own vault dev instance because my 30 day trial ran out. So there's some things I can't do but I have the root token. So that is probably not typical, right? That is rare. Yeah. That is rare. And because I'm running the dev version of vault, I don't have namespaces, which I think is also rare. If you're in a large enterprise solution with another team running it, they're gonna do namespaces. So we can talk about it and I can show you it, but I can't actually do it that part. So we'll just do it kind of like I'm all powerful because I'm feeling that way this morning. Yeah, you're omnipotent, that's fine. I am, right? So here, so the other thing, so we've come down through, we're not doing the whole cluster of doing the storage class and we know we're external, but the key point in this one is that we're going to use a service account token and use the Kubernetes auth method. So if you've done anything with Kubernetes auth method, so here's our cluster, here's Vault. In our namespace, there are gonna be some service accounts, every service account has a token. This guy is gonna wake up and say to Vault, I wanna act as blah, blah, blah, Vault's gonna say, who are you? What service account, what token, what namespace? And then come back to the cluster and say, is this service account allowed or not? And we have to set up that conversation properly. And that's just authentication. That's not about writing your keys out or anything yet. So it's kind of like a two-part thing. And in that case, I will set it up and make it work and then I'll show you what it looks like when it doesn't work, because inevitably I forget something and you'll see permission tonight, but it's good to see it. So let me... You know I like stuff breaking. I know you do, I know, but all right, let's... Where am I? Where did I go?  See, a problem's happened already. It's not that. It's the, the, the, the, the. I want to kick off. It's not enterprise and amorphous. When it, when you know, like this morning, at like two o'clock in the morning. Okay. There we go. Oh, there we go. Yeah, so, but I want to run the Dev instance in particular. So this is now running on, I have a jump post. Here you have, you see my root token. I don't have to un-steal it. Like there's, if you have a real role instance, you have to do a lot of spike stuff with it. I don't have to do any of that because I'm running Dev. And on this side, just to show you that this is a real thing. We have that's my, this in the, in the document I'll show you, I show you what information you have to gather among that information. It's you have to know your vault address. So, and we're going to, yeah. So we're going to do just check out the status of stuff, that of that.  So that is unusual. Yeah. Also in a, in a real setup, you wouldn't have to do this at all. It would only be set up and they would just tell you, this is your vault address, so here we are. I want to go back to the document for just a second. So the vault instance is external to the OpenShift cluster. We're going to use a service account token. You can use a namespace that as I said, I can't show it, really demonstrate that. I'll just talk about it. And I'll show you some other stuff about some optional things we have. You can have a really complicated vault setup. And I'm interested in from anyone listening, what is a typical vault setup? If we have anybody out there who's like, are more on the security side. I'm just, I, I definitely, I work for the client where the authentication to vault happened on one endpoint, but then the namespace was something else, which I understood because as a team, you would want to be able to control authentication in one place, maybe, but then you could, right? Like I could, I'm like, okay, so I'm learning a little more about vaults. I'm interested in that. Like, what is a typical setup for vaults? And I believe that we are already pretty much set up to handle that from the ODF side, but I want to see it in action so that we can show people like, oh, you need to set the blah, blah, blah in order to make this kind of scenario in vault hack. Does that make sense? So anyway, you'll see more. So let's go down. So here we have, please gather the following information. I've got my vault address. You saw it over here. This is it, blah, blah, blah. And I know my cluster endpoints. You can get it from OC config view if you need to, but we are generally, you know, your cluster endpoint. And then number three is important. If you don't have the root token for vault, you need someone who does because we're gonna have to set up some policies. And we're not doing this, but I can talk about that if, sorry, the vault CA certificate.  Exactly. It's a lot of work. Yeah, it is, a lot of work. So, okay. So the first part of member, we talked about this conversation, the conversation around authentication. So we're gonna set up our site first, which means I'm gonna need a service account. It's set up here. This is the, I'm just gonna call it token review because it's too long. I'm gonna have a cluster role, and then we're gonna bind some other services accounts to it. So down below, here's your look, here's your provision and your stuff. So you can cut and paste it. So let's apply it. I've got it in here already. It's the last way to do it. I do, uh-huh, uh-huh, uh-huh. Right, so here it is here. And just before I, let me do this before I forget because I often do. Oh yeah, good point. Yeah. Okay. Oh, yeah. I see, are you all ready? Oh. Yeah, that'll do. All right. Oh, okay, there we go. Hang on a second. It's number one. I labeled them for review. Oh, sure. So these get created. Nice. Right, like I was trying to make it easy for you, right? So that was all this. That's all that was all that in there. And then the next piece is to, we're actually setting up the vault side, but we're going to, again, you would not normally do this because you would have a team that does this, not have the token, et cetera, et cetera.  I think it depends on size. So maybe you are cluster admin, open chip cluster admin, and you're the vault person as well. So anyway, in order to run this job that I have below, I have to set up some pod security policy stuff, what have you. And that's all this is. This runs once, and then it's done. So that's what is in two. And this is all about setting up the job that I'm going to run right after. So you do it once, you don't have to worry about it yet. Okay, so. Created. Right. The centers here are. But you did get, okay. You did get my favorite deprecation warning and one, two, five PSPs are going away. Remember that folks, this was announced a little while ago. So PSPs will only work. But you know what? We're not going to change until they really, really make us vote. I know. And one, two, five isn't going to be out until middle of next year, I think. So you've got some time, right? But then I'll forget that they've even told me. Okay. So at this point, our side is, should be set up, but the vault side is not. So if you have a vault team, what you would do is you'd bring them right here into the documentation and say, okay, I won't wait, I got to go down. Look at this job. And this is going to set up policies. Can you do this for me? That's all. So we're going to do it here, but very, exactly. So it's provided, I thought about maybe pulling this out of YAML and just have it as a like, cut and paste this in an email to your vault admin team, maybe, but yeah, I'm just making it so. A copy of it, attach a text file or something, anything. Exactly. So in here, once this, you see these little numbers here because it has not been rendered by Intori yet, but it will be as soon as I submit it. There are a couple of things you have to change. Okay. So. At least the vault token, that makes sense. So what happens is that, hang on a second. Here we go. So up here, actually. So the vault address you would put in your vault address, the sample root token, actually, I'm going to show you the one I have because mine is set up properly. And notice I have another one there for namespaces, we'll go over that after. Okay. So let's go to the bottom. Okay. So I happen to know that my sample root token is root token ID and you can see it here because I made it that way. And then I've got my vault address. I've got, I didn't change anything else. The only other, it's like three things literally change. And then it's your endpoint right there. Endpoints matter. That's it. Endpoints matter. So what this is going to do is it's going to run this job with this in its script. It actually uses the vault image to run it. And it's going to run hopefully these policies up here. This is the vault piece. So all you vault people speak up if anything looks in this. We log in, we enable the Kubernetes authentication method on the path and then we do the policies below. So if you actually look, you can see here it's going to take in the service account token path and use that token. That is the token. That's that RBD, blah, blah, blah, token review service account. This job runs as that service account that we created. It doesn't run as this job does not run as the root plugin or anything deeper inside of the ODF service accounts stuff. So we're setting ourselves, because the idea is that you have this SA account, you have this service account that you're going to thank you, that you're going to masquerade as. So if I come in as the root plugin, it's basically saying, am I allowed to authenticate? I'm bound to this role. So anyway, this gets all set up here. You can go through it. It's pretty nice. Also of note to vault people out there, the dev vault instance is already KV version two. So apparently that matters. Yeah. I don't know why. No, I mean if you want to version two. Yeah, it's like your new version. So it already is there. So if you have a look at this, some people need to change this because for instance, the cluster identifier, I believe we have is like CSI Kubernetes or something like that. And it actually has to be different. So your vault team would know that. They would say, no, no, no, you can't do this here. You have to do this over there. Also, I just wanted to show you, I'm not going to run it, but I want it for vault namespaces, which I really think everyone probably uses, it would look like this. So when you go down, sorry, when you go down to these vault commands, everything's got some namespace attached to it. Namespace, namespace, okay, cool, yeah. Right. So one thing, not on the namespace. So someone can correct me if I'm wrong. Can you hear me? You froze for a second there. Am I bad? Just like say the last sentence. So this vault enabled piece can happen. It depends on how your vault is set up. So if you have been given a namespace and it's totally yours, then it makes sense to enable Kubernetes authentication method on your Indian namespace. But I did work with someone who didn't have that option. Authentication happened in another area, even though they had a namespace and they were writing keys to that namespace. So does that make sense? Separation responsibilities, that makes sense, yeah. Yeah. So I understood it from the vault team's point of view. They're like, we wanna like corral all of you to authenticate here. So we have this point of control here about who's even talked to us. But once you've been authenticated, you need to go right over there. So this is where I had to like actually read the documentation. Yay, distributed systems. Oh gosh, how does this work exactly? So just know that that is available to people. I don't go through all of the different things, but you can do it and I've done it. You can do a lot of different things with off-in vault and making that kind of. Exactly. That glowing to VPC we were talking about earlier. So I am interested in what is common. Like if you're a large institution enterprise with very particular security controls, what is the common setup for vault? What about how many, how large does it get? That's all. I would like to do more common setups. Those are good questions, right?  Do you run it on cluster? Do you run it on another cluster? Do you run it on another cluster? You know, some server in your private cloud or whatever, right? Like there's a lot of different ways to run vault. There's open source vault, there's enterprise vault, there's all these different options too. Yeah, and like not even thinking about that. There's tons of ways you can run vault in your environment. So we try to say, hey, this is how we would do it, but that doesn't often meet everybody's needs, right? Everybody has their own requirements when it comes to security. And a lot of that is driven by regulations. So, you know. Exactly. So I'm like, if you're in this industry, you are kind of brilliant. And also, what about vault HA? Like I would like to, do I need to know anything from the OD? I just don't know. So I'm definitely- Yeah, I need some HA for everything over the weekend. Yeah, yeah. Sorry. Okay, so let's run this. Let's see. Okay. All right, so. These, see the vault, I'm gonna just, sorry, I had to make my- Oh, I know. I'm not sure if you can- Okay, so hopefully there. So we've completed. So- Nice. Let's see what the job did. And also, we can actually to some extent see it here. Okay. Oh. Ta-da. Everybody was happy. Okay. So, yeah, but normally, so someone doing this probably wouldn't have access to the logs from vault. It's actually really nice to do, but- That's pretty weird. Yeah, but it's good to show off it. Okay, so just- Pipeline. Okay, so I just looked at the logs for the pod that ran the job. So it's showing you the output of the script that ran and da-da-da-da-da. You're now authenticated. You don't have to log in again. I'm looking for failures. Here's my keys. Nothing failed. Everything looks- Yay, exclamation point. Okay. Yes. So at least now, the kind of the off part should be set up. Right? Should. Right? So we're, okay. Should. All right. And let's go then here. And here, commands for how to look at what you need to create a storage class. Aha. Okay. Here's the fun part. Yes. Let's do, you've done this before. It looks like your video first. I can do the canvas detail first. There we go. Again, can you hear me? Yeah, we can still hear you. It's- Can I make faces so you see me? I'm like- Oh. Okay. Hang on. This is a, my video is a little weird. Let's talk about, let's talk about please this config map first because it's kind of an important one actually. All right. So now that we believe, we believe authentication is set up properly, we're moving down into how keys are actually gonna get stored, right? And where we need to go. So we need to, so ODF needs to know this information. It needs to know where's your vault, what's my path to login, what's my role. Like so as you, there's a config map called, where is it at the bottom? Yeah. CSI, KMS connecting details, which contains exactly that. So it's actually in the OCS training doc earlier and it looks a little different. They changed the format. But basically this is everything you need to set up this connection. So I'm gonna take out, I was messing around with this yesterday. I'm gonna take out the namespace and I'm gonna take out the rest because I don't need it. We're not gonna do it today. So that's a vault. Oh, I see what I did. Up, up, up, up, up, up, up, up. Let's keep it simple. We can break it after. Okay. So this is it. This is all I should need to connect. And what I wanted to point out here is this. So I'm going to create a storage class. The storage class is gonna have an entry called encryption KMS ID. This is where, it's all in the document that's to show you. That ID will map to something in this config map. It's gonna map to, I'm gonna put in vault test. You'll see that in a second. In turn, vault test has a KMS type. And this is, you can go look at the code to see what this maps to. There's actually a vault.go file. It goes in, it does all the things it should. So you have two mappings to kind of pass through. But this is where that information is contained. So I could have multiple instances, multiple vault instances I want to connect to. I just cut and paste this, change the information. And I'm often running, but each one would need a new name so that I can look it up here. This will become more clear in a second. You've got the look, you're like, what is she talking about? No, no, no, I was gonna, I was pausing to ask, can you share with me, just drop it in Zoom chat here, the link to the repo. Yes. And I'm sorry if you shared that beforehand. No, no, no, it is what it is. Okay, hand. Oh, you have this third, where are you guys? Okay, there we go. Hang on, I gotta bring it back, chat. I'll take it to you here. Ta-da, there, did you get that? Yes, I'll grab that and share with the audience. They always like to phone along. So all of this, it does get a little hairy, like it's a little like, okay, we're down in the weeds, like it's very, but once I have it going, it'll make more sense. Oh, sorry, hang on a second, see? I need to do my own, I messed it up, hang on a second. Then it's just kind, let me, let me look at my own. TVK is always gonna get you. Group version kind. Yeah, here we go. Let's do this instead. Let's do CMKMS, I need to take a second, let's just play this part. Okay, I just want to get rid of these. My little documentation notes. Does everything else look good? Wanna try it? You need the vault address. Thank you. That would not have been fun. Okay. It would have been an easy find though. Okay, let's do this a little over far enough. You know, when like the, hang on a second. There we go. Okay, zero, comma, and that's not comma, that's a comma. That's it, that's it. Oh, and I'm not gonna verify it. Let me turn off this true business here. Oh yeah, that's right. Okay, so, oh, sorry, that's not what I want. I changed it tonight. Oh, you changed it, yeah. I changed it because I didn't want to go back. CMKMS, there you go. Are we happy? Okay, so let's just, I just want to look at it, make sure it's okay. It's going on. Details. Yes. Okay, we like it. All right, okay. So this is where the information about connecting to our vault instance is contained. We look it up by referring to whatever the key is here. So, let's see what I have in number five. New storage class. I'm calling it external vault SC. Nice. And this is what I want to, is it encrypted? Yes. Here's my lookup, vault test. So KMS ID is a lookup into CSI, KMS connection details. That entry should have everything I need to connect to my external vault instance. Nice. Let's see if I actually did it right. We'll go back into that in a second.  Let's see it again. Well, I was just, I was just looking at the various values there. The parameters, especially, right? Like, We will, we can change them for some, yeah, yeah. So there's a lot of options here. You can kind of step your toe on or configure to your delights. Either way, you want to rephrase to it. There's some yummies in there. So for instance, if we, if you, if you want to verify your vault CA certificate, you actually do have to change some things. You have to go in and you can't use the different secrets. You create a new secret and that secret has a couple of entries. Like it starts to get a little, you can do it. Yeah. I was like, this just works fine. Typically you wouldn't do that. So maybe you would, but I have done it with a client. So that was kind of in the weeds. Fine. That's okay. We like weeds. Yeah. We like weeds. That's what we do. Okay. That should be created just fine. Okay. So now let's switch to, so I like to switch to the console. Hang on. I have to, do you know how to make that there? It goes away by itself. It's something that I want to push it out of the way. So. Yeah. You can actually grab the toolbar thing and move it off screen or whatever. Okay. Did I offer proof of what I'm running here? That I was on Odia. Yeah. Bleeding edge right here. It's got things going on. We're not going to deal with the problems. Yeah. Like these we're not dealing with that. Sorry. But here it is. 4.8 to 2. Nice. Nice. And then on this side, here we are. 4.8. So it's there. Yep. Now remember, 4.8 for ODF is not out yet. It's not out yet. Flash that future thing again. Real quick. Future thing. Okay. We've got our new storage class here. Right? That we just created. That's got our details. Just so, sorry, I'm sure this font is too small. Here. This is what matters. Can you see it? Yeah. Okay. If you can't see folks, let me know we'll increase the font size. Right. And this ball test, we can go up into the config map. Have a look in our CSI, KMS connection details. And there it is. All tests. All right. So if I, if I didn't forget anything, which we know how, and I can be in any way. So I do this. Let's just do it here. Cause it's easy. So I select this new empty, this new storage class. Let's call it external SC. Just do whatever. See what I felt. Oh, I didn't forget anything. Cause it's bad. So now we will break some stuff. So. All right. Yeah. So man, you can look at the events if you want. So this is what it looks like. Well, here's the thing. Like even with explaining it, this only took you 30 minutes. Right? Like, it's going to be a lot of back and forth if you have a security team that's managing your vault instance, but in general. Absolutely. Yeah. You know, once you have the process down, you can kind of, you know, do some automation around this. Maybe, right? Like, if you're using something like ServiceNow, just put in a ticket, I need a new key, automate that process somehow, maybe with Ansible, a little, you know, my mind is just wandering off. Sorry. Yeah. So what's also interesting is that I believe with this particular customer, the plan was to have a, for every namespace in OpenShift, they were going to have a vault namespace. So this opportunity, yeah, so you could, I thought, oh, well, that's actually really organized. So, and then they were the ones who had authentication happening at a different endpoint than where the namespaces were. And I was like, that's actually really organized. I get where they're going with that. So you can do your own application tokens, you can store stuff in it and you can encrypt your own PDs if you create a storage class that does that for you. So that was kind of nice. And they wanted all of that automated. So this is what it looks like working. If we were deeper into vault, we could see keys being created and all that kind of stuff. And the document actually goes through all of that for any other ways. So I didn't want to do that here necessarily, but I just wanted to show you this is what it looks like working. So now let's break it. My favorite part of the show. All right, let's see what we could. Well, so I want to show you some errors, but that's really kind of like, I felt like, do I have anything that I can edit? No, not you. Do I need, no. Okay, so the first thing that goes wrong is this. So let's look at our, this was what was a cluster role binding. If this isn't set up properly, you will see a permission denied error. So let's have a look. Let me edit right here. I forget what the, there we go. Okay, so if I go to the bottom here and let's just say I remove something. Well, so let's create a new PVC. Cause I'm doing torturing us today. We've created a new PVC. I should see, I'm gonna be upset if it works. It shouldn't work. It shouldn't, no. There you go, call it what it is. Yeah. Okay, so you saw how quickly it bound. Nothing should be, this should be fast, fast, fast. So here you see permission denied. Anytime you see any sort of, yeah. And, and, there you go. You can see it right here as it retries to see, yeah. So it's telling you, open shift, Rook provisioner cannot create resources because it's not bound properly. This is the point in time where you should expect your phone to rain. Cause someone's gonna see this and be like, huh, I wonder where this is coming from. I wanted to show this because also when you're dealing with another team and everybody's busy, maybe you're doing something email, right? And that's life, right? I get it, but you should, but this is so you can say, no, no, no, no. It's, it's not the vault side can go, it's you. It's not us. See, look, we're asking and we're getting the permission, getting that you're not allowed to be here. So that, that's something to see. Like, and that's the authentication conversation. There's other stuff with the CA and all that other, that can go wrong, but that's just making sure the authentication pieces is okay. So we can add a fact. Yeah, it was this, right? This is what I'm gonna add. Yeah, you just took out the last one. Yeah, okay. Wow. Okay. Do, do, do. Oh, there we go. Got none. All right. Let's make it. Oops. Oh, nice. For my own. All the spaces. Okay. All right. So now, do we have to create a new one? That I don't remember. I thought, or it may have backed off at this point, but if I go and do a new one, but I expect it's just, I suppose it backs off for a little bit. And then once, let's see, we'll leave it there. See if it comes back after. Right? It's not trying. Let's see. Oh, it's not trying maybe. There it is. Yeah. It's something just got out of that. That was me. That was me. Yeah. See now it's found. It backs off a little bit and it tries again. So it's just like, yeah. So there we are. So our bad PVC is now fixed, but permission denied is generally the cluster role bindings on the open shift side. Let me think. What else was in here? There's lots of good stuff. We can talk about creating, I create the PVC here. There's some troubleshooting stuff you can do, but if you have access to the logs of vault, it's much easier. Right? Like I included this just so people can, yeah. Yeah. You are kind of dependent upon an administrator of that vault server or system at that point, right? And aren't you busy enough? Aren't you busy enough with your own open shift stuff? You need to run home. I think it's like that. You should have encryption at rest flow, please. No. I don't want hundreds and zeros out in the breeze. That's all I know. Oh, and here is, I can't do names, but I wanted to just show you what, if we were dealing with namespaces, all that would change here is I would have to add another entry in that config map that has same connection details, but then it has a vault namespace as well. So for instance, here it is. So again, your storage class is using encryption KMS ID to look into the config map, CSI KMS connection details to get information about how it's supposed to connect. So you can run many of them. You can have a nice mix and match kind of thing. And if we look at this, I move the other one, but you could have another one. There would be, it's like, I think it's actually just vault namespace here and works exactly as you can give would, right?  So that works. I tested it. It just, you have to worry about it getting more complicated where you authenticate. Do you want me to talk? Is there any questions? Does anyone want me to go over? Any questions? The audience is kind of quiet and that's fine. Okay. Maybe they don't have power. Maybe they're like, Oh, you're doing this all wrong. Who knows? Who said a vault like that? What is wrong with these people? And that's entirely possible because this is a demo, right? Like, Okay. So let's get a little more real world. If you had to verify your vault CA, you need to do a few things. First off, you have to have it and you have to set the time file and you have to, we're going to put it in a secret, but it's a special secret. And it's going to be a special secret. I sort of get complicated. Okay. So let's, if you have a look at, where did I put it? Oh yeah. Oh yeah. You actually mentioned it when we were looking at these storage costs under normal circumstances, you leave all of these secret names alone and you just don't bother with them. In our case, when we're going to have to verify the CA we need to keep it somewhere. We actually have to create a secret and we have to name it here and it's going to have a few things in it. So it looks like this. All right. So three important entries in our secret that we're going to name in our storage class. First one is this user ID and this user key. I'll explain how you get that in a second. That actually allows you to talk to the sub cluster. And then there's this, the OCS KMS CA secret. This is your base 64 encoded CA. You don't have a choice about this. This is how it has to be. That's the name of it. That's how it goes. If you need, every time I create a cluster obviously the keys change for this. So there's, what is it? Is it no? It's a, is that it? Yeah. You can get them like so. I believe I put that in the documentation. If I, it will be, if it's not, but I think it's there already. So here's the user ID and key that I'm going to use in this secret. Below it, I'm going to put that entry for OCS. Let's go up a little bit. OCS KMS CA secret. And here's my encoded CA. And then I add it to the storage class. By saying, I just say vault CA verify truth. Does that make sense? It's tricky. I don't want to, it's actually something. So, it's cryptid, sorry, I meant to say, but even I said this wrong. What, I will put that secret name here, because I've created a new secret with that information with those three items. And then in my KMS ID, I'm going to name a KMS ID that in it has vault CA verify truth. They're trying to keep the configuration around, the information around connecting to your sort of vault is completely contained in the KMS ID. It's not intermingled with the storage class itself. They want to keep it in that, config map, the KMS connection details. So, you just name it, you put it over there. So I could have, here, I can have more than one, I haven't done that, but I'm sure you can. And then here, you could add another one below this. And underneath here, I say false, I say true. And then I think, there's a, you can add the name for it as well to be specific what secret you're looking at. And it all kind of flows from there. But that's like a whole nother layer of getting in the week, just so you know. So Chris, just for CA verification. Oh, which, I know this first. You know this first. First, he says, you're doing a great job. I enjoy this. That's why I'm being quiet. Oh, here it comes. But did you talk about why we need this and why this is better than doing it another way? Here's another way. Any other, well, I mean, well, so I actually like the storage class level, encryption, PV method. First off, I understand, and I hope anyone listening understands why we want to encrypt sometimes, right? I think it's actually, I personally, I love the, I like the flexibility of it.  Here's where, here's how it encrypts and where it connects to, I think gives you like a lot of flexibility. So for instance, if you're doing some secret of stuff, or if you have a particular namespace and project where they need to encrypt things, it's available to you. You don't have to do it for the whole cluster. And I also like that you can do it after the fact, right? So when you go to encrypt your whole cluster, I believe that's only a decision when you go to install. When you create the storage cluster, that is where you make that decision if you're going cluster wide or not. So if you do it at the storage class level, you're okay. You can say, well, no, I'm not encrypting yet, but we'll get there. Like you can do it later. So I like options. I like all that flexibility. So in addition, I like using an external vault because of the, it's more flexibility, right? Like it's even, you can have your, the Holy Grail of setups that we've talked about before. You can have the AJ. And I like how you're not really managing tokens. You're not really managing your octopons. You're kind of letting OpenShift manage them, right? Vault is just saying, so OpenShift, is this service account allowed or not? So you don't want to deal with expiration. You don't want to do it with recycling them. Like you just don't. That's a good point. Like doing this manually, right? Like, oh, no. Don't drive people crazy. So why do you need somebody like an FTE to just manage your certs and stuff? Yeah. Right. So you could set this up so that you have the tokens that are managed by OpenShift per name space. You've got them. You can have storage classes associated with them. And you're never going into vault and saying, you know, do we delete it's part or whatever it is? Like it's all like nicely managed. It's just, I just think it's a better way to manage at scale. Is that, do you know what I'm saying? Like, I didn't think of when I think of managing vault, I think of like door keys.  Oh yeah, like changing locks on doors? When you put it like that, that's kind of brilliant, right? Like, all of a sudden my house has a thousand doors and I have to go change the locks by myself. Right? Right, right. And then you can go like, well, I want to delegate, I want to delegate the kids rooms to them. I want them to be able to manage their own keys or whatever. Or maybe you don't, maybe some kids you don't, I don't know. But so if you think of it that way, you're saying, oh, I could see why they would want to have you authenticate over here and have name states over there, like that's all. So, but more importantly, you really want to do it with service accounts and you want the Kubernetes authentication method so that you're not in the business of normally doing any of this stuff. You're managing it within. So, is Chris like that? Well, so, yeah, I mean, I'm assuming he does, he hasn't said anything and we've got another good thumbs up to another audience member. But like, so you mentioned you can do your whole cluster like this, right? Like, you can have every source class everywhere encrypted at rest, no problem, right? Like this, but this layer of flexibility does give you, right? Like, I would do this in dev maybe and stage and then that prod environment would be that fully locked down everything, some encryption at rest kind of deal. That way I can say, hey, listen, I know these keys and vaults and stuff, everything else is good to go in dev. I know it's good to go on stage. Let's make it happen in prod. And that way, you could do both, yeah. For the really power, yeah, you can. Tell me more. Well, so as long as you decide when you go, when you create your service cluster to actually encrypt, it's like a little button, quick. And then, and you can do both. And then later on, you could do, do per name space and stuff like that. So the dev encryption, I guess in that scenario, you think of it as you're just trying to keep others from looking at your stuff. I think I haven't met any kind that wanted to do both yet, but I'm sure they exist. Or maybe you have to just, maybe there's a regulation you have to meet or something like that or an audit requirements. But personally, I like to stay with the not close to wide and just do the PV. Flexibility. That's really nice. Yeah, yeah, yeah. Option is great. If you're mandated, you can mandate it as well. Yeah, good call. I'm thinking, what else could I ask here? And I'm gonna change the document to, I would like to, I'm going to run with what I think is a common setup, what I learned from this client as a common setup for both. So I am gonna do how you verify the CA, I am gonna add in namespaces. But again, I'm really not sure that that's actually the way most people are running it. Maybe there's a better way, or maybe someone can point me to a vault enterprise, best practices stuff that isn't like 18 pages long. So I'm interested in like, what are the common things you need to see in a typical vault setup for sure? 18 pages is a lot. I don't know. You just read a number didn't you? I did, I was like, I should have said 180. No, no, I'm sure there's a tutorial that takes you through it. But then there's also that, like that practitioner's knowledge, right? Like kind of what we bring here. It's like, oh, okay, you read this, but then how we really do it is, da, da, da, da, da, da. So I'm kind of looking for that kind of vault practitioner's knowledge. So there is a run vault on OpenShift doc from the vault project itself. So that's internal. Right, like they're using a how to install, they're using a home chart and all that fun stuff, but it's like running it on OpenShift. Yeah, that's actually a little easier. Yeah, so it's, we have, they are in tech for dev preview, I think, I forget which, it's from the future. So in the future, you could have a single node OpenShift cluster running your vault and it could just be off to the side here and running other services, hopefully too, that your security team might want. You can give them the option to have that OpenShift experience as well. That way, everybody's playing on the same playing field, right? Like OpenShift is the underlying infrastructure. It's not like we have a VM over here of a certain version running a certain OS that needs patches and everything else, right? Like you can just change the underlying image and run it like that. You could run vault in your dev cluster just to make sure that this all flows properly. And then when you go and let's say your production vault is external, then you're just dealing with that office, right? Like it's sort of, it's just a simplifying in dev and stage and how you want to lay it out. But yeah, so I'm interested in common vault practices. Yeah, I mean. I had another question for people. I don't know if I've seen the same vault practice in practice, like from business to business, it's business, right? Or organization to organization. There's always some wrinkle of difference, right? Okay. I mean, the most common scenarios are the ones like this that you describe here where there's some trusted CA in the organization that the vault server uses and so forth, so on. But that's for big words, right? Like most people that need, you know, the open source version of vaults at least are probably not thinking massive, right? Or at a scale beyond a certain number of clusters. So, you know, on the open source side, I think there's a lot of different ways to run vault. On the enterprise size maybe less, but you know, I'm curious, you know, I might dig into it myself now. Like what does vault enterprise give you? Is there any difference? Does it simplify anything? Are there different endpoints or something? I don't know. I'm used to the open source version of vault, yeah. So, I would look into that, Docs, but I'm sure they have like, wouldn't they have like some reference, like architectures or something? They do, I mean, okay, I look at it a little, but it's like- So, super simple management, data encryption and identity. Right. And the multi-tenancy, like, okay, that obviously can happen. Like it's just an understanding more about how they manage that. So, yeah. No, I'm definitely interested in what, I just feel like sometimes a practitioner, they know. They're like, oh yeah, we tried that. We do it differently because they didn't see it. Like that kind of thing. So, yeah, yeah. So, once this document is fully out, it would be nice to see some comments from people saying, can you please do the following use case because we run this in our organization and maybe we try it, right? We try some else out there. So, anyway, cool. Cool. Well, this is awesome. So, can I break something else? I don't think I, yeah. Like I- I wouldn't have you to break whatever you want. I'll give you extra time to break stuff. I mean- I was just gonna say, everything that does break here tends to be about, it's just configuration. It's really, it's a typo somewhere. It's a miss, it's all about this config map. Once the office setup, it's just very, it's super precise. You just have to like, flow through it. And it's easy to do that if you have access to the vault logs for sure. But that's it. And knowing that the vault site has been done already, right? I expect a lot of time back and forth just making sure that the whole policies are set up and that you on your side understand what your namespace is and instead of that of us. So, yeah, that's it. And in the document, I was gonna say the, the troubleshooting piece at the end actually has you drop in to an image and try and curl the external KMF. Yeah, yeah, that's a real test, right? Yeah, like just get in there and go see and you wanna run it as one of the service accounts that's supposed to be able to authenticate. So that's this line, right? Like this is- Yeah, you've got to make sure you do it too. Become that thing that is allowed to- Yes, right, right, right. That's the full test. Accessable. So you could run this and when you curl it, if it doesn't work, send it to your vault team and work it out. There it is, ta-da. Look, oh, here, when you're in your pod, this is where your service account token is. Every time. Just so you know. Do you know how, like how that, not that so it's there, it's, what else? Any more questions from anybody? Anyone want to chime in? No, no, no, no questions. Hi. Good, okay. There is meeting of people. I do like the locks on doors analogy. Like use that one in the future, because that's a good one. This is why you want to use vault, because you don't want to have to go change a thousand locks at once. Right, right, imagine walking around. Remember how I remember seeing people in buildings with like a key ring, yay big, and a thousand keys off of it. And I'm like, oh wow, how do you manage that? So you can think of vault the same way and as well as like passing cards and everything else. So once you have that image in your, that model in your head, you can see why they, why they have namespaces, why they have you authenticate in one place, but don't give you full access to your namespace to do it, et cetera, et cetera. So yeah, thank you, that's what I've got, Chris. Cool, now that's great. Thank you, Michelle. That's a wonderful demo. And you know, tons of people use vault and tons of people should be using encryption at rest. So great show today. Really, really appreciate those. And it's awesome that we've got this out there for folks to consume on their own. So if you have any feedback, how would you like people to give feedback to your scenario here? Do we have an issue or email you? That's fine, yeah, open issue, yeah, yeah, yeah. And certainly comment on the video. Yeah, I'm interested in what would you like to see? What's the missing scenario here? What's the missing use case that we should be doing to make it easier for people to understand? It's involved, it's just got a lot of detail and it's involved. So I would like to do the most common one and help people up first, that's all. Yeah, that's it, it's great. Fantastic, thank you. Cool, awesome. You've had power. I have power, I had internet the whole time. I didn't know. It's a miracle almost, modern technology. So thank you, Michelle. Thank you. Later today on the show, calendar don't freeze on me now. We have it in the clouds. We are going to be talking about DevSecOps and shifting the left, what that means. Part two, by the way, because we did part one on the level up hour last week. So we're gonna do part two on in the clouds this week. We'll have Kirsten Newcomer, security extraordinaire and Jamie Scott on board to talk a little bit about shifting left and DevSecOps. DevNations on tap today. And DevSecOps is the way, we'll be talking about data controls. So similar vein as what we started with today. That's pretty cool. And then of course everyone's favorite get-ups guide to the galaxy. We're actually gonna be interviewing Dan Garfield from Codefresh. And we've got some really cool stuff that we're cooking up with get-ups, open get-ups. There's a get-up today coming. There's all kinds of fun stuff. So yeah, full lineup today for you folks. So let me know if you need, if you wanna see it for yourself, you can go get it by looking at the calendar. And please don't forget to like, subscribe and share as you see fit this video because I think it was helpful for folks and might that repo itself might make life a little bit easier for people. Like to get the concept or at their mind around the concept, right? Sometimes you need to see the config to actually get it. And BaconFork says, thank you, thank you. So thank you, BaconFork. You're doing it. Oh, you're welcome. And we'll see you all soon, I'm sure. So stay safe up there, Michelle, out near your neck of the woods. And I'll try and stay safe here. We'll keep on pushing. So thanks, folks. Thank you.


to present to you the President of the United States. Thank you very much. Thank you. Thank you. Dr. and Mrs. Cheek, Raleigh Warner, Nancy, you ladies and gentlemen, Nancy and I are very happy, delighted to be here with you tonight. I know the generosity and the feeling toward this school that has brought all of you here, and it wouldn't be possible to name all who have been so generous. But maybe I could say that Mr. Raleigh Warner, I think he epitomizes the kind of spirit that is so supportive of this school. His contribution tonight was $25,000 and rich divorce, $20,000. And I know that there were others that, as I say, were worthy of mention, but I will just stop with those. We've been looking forward to this evening or this afternoon, whoever you want to describe it. Nancy was lucky enough to get Dr. Cheek over to the White House for lunch last fall. Then he returned the favor and had her back here for a tour of the campus and the activities of the hospital center, which, being a doctor's daughter, she's very much interested in. And of course, Mike Dever's been personally involved in Howard's fundraising drive. So we couldn't be more pleased than to be here and lending a hand if that's possible to all that you're doing. And now Dr. Cheek, as I look around, I must say this is a pretty impressive group that you've brought in. In fact, you're all doing so well for Howard that I just have to wonder, how would you like to organize a little fundraiser to help us whittle down a trillion-dollar debt? Now, don't anybody be frightened. If I may steal a line and paraphrase it a little bit from Shakespeare, we came here today to praise you, not to bankrupt you. We came to praise you for joining Howard University in an important step forward. This university has offered all Americans, and particularly our young black Americans, invaluable opportunities to develop their talents and skills, training them for service to their professions, their communities, and their nation. Howard is widely recognized as the largest and certainly one of the finest black universities in the world. Our administration is committed to the future of Howard and to the other historically black colleges and universities throughout our land. We must never forget that when educational opportunities were denied elsewhere, these institutions offered hope to our fellow Americans, young black Americans. James Madison said that a well-instructed people alone can be permanently a free people. Well, it wasn't until 1867 in the aftermath of a tragic and violent war and Lincoln's Emancipation Proclamation that America gave birth to a new era and to Howard University. This would be a center of learning to fulfill the promise of Lincoln, serving the people who had waited so long to enjoy what was theirs by birthright. Lincoln was a simple man, but he spoke great truths. He said, No man is good enough to govern another man without that other's consent. This expresses my idea of democracy. Whatever differs from this is no democracy. In the years that followed, Howard has fulfilled its mission, sending its trained graduates into the world to practice professions in all walks of life. 15 years ago, President Lyndon Johnson came to Howard to mark the celebration of the university's 100th anniversary. And he told the students, The task is to give 20 million blacks the same chance as every other American to learn and grow, to work and share in society, to develop their abilities physical, mental, and spiritual, and to pursue their individual happiness. His was a message from the heart. And his answer was a program of political action and economic redistribution to lessen the plight of those who had not shared equally the blessings of freedom. But as the wrongs were gradually redressed and barriers broken down more and more, people began questioning whether big government could guarantee economic abundance. It's one thing to ensure everyone's right to buy a ticket on the train and that government must do. But that ticket isn't worth much if the train then can't leave the station. Government has an essential role to protect those in need, but it's self-defeating to keep cutting smaller and smaller slices of pie from an ever-shrinking pie. It is time now for all of us together to make a bigger pie for all our citizens and everyone having a bigger slice. And that's what we're determined to do. Howard University, under Dr. Cheek's strong leadership, not only understands this need for a new direction, it has laid out a parallel mission of its own. It's called the New Direction Fund, and its goal is to raise $100 million in the private sector within the next five to seven years. The funds will go for endowed chairs and distinguished professorships, increased student aid and scholarships, research, library resources and other capital projects not funded by the federal government. Howard University seeks to excel to be the best. There are so many potential areas for growth and development. I spoke a moment ago of Nancy's visit to the hospital center and I can tell you she was impressed with what she saw being done there in pediatrics and other areas. Some people see Howard fulfilling a unique role. They see this university as an ideal orientation center for citizens and leaders of third world nations coming here to learn about democratic institutions and our enterprise system. And let me say a word if I could hear about my first real attention to this university. I was governor of California and this has to do with the traditional function of any educational institution. It was back in those riotous days when no one was bragging about only living a stone's throw from the campus. When the buildings were being burned down, rioting was the order of the day. And then the surveys began to come in that were taken on campuses of very distinguished, prestigious universities in our country and the huge proportion of the students and it must have been disturbing to everyone in that generation gap period. Anyone of another generation to read of the huge numbers of students that denied there was anything good in America, that denied there was anything worth defending in America and who pledged that they would not, if called upon, defend this country. And then the surveyors got to Howard University and suddenly there was great disappointment for those who had cheered the results on other campuses. But great joy for a lot of us on the shady side of the generation gap. Because on this university campus, the overwhelming majority said yes, this is a country to believe in. Yes, there are opportunities that we look forward to and yes, if need be, we would fight and die for this country because it's our country. Each of you I know shares my belief in the principles of the free market. Personal initiative, competition, responsibility, reward and stewardship.  We can't thank you enough for that. And let's remember that we're working as partners, the public and private sector together. Our administration, I like to think, is also doing its part. On September 15th, 1981, I directed federal agencies to increase the ability of historically black colleges and universities to participate in federally sponsored programs. We've made significant progress. Today I'm pleased to announce the award of ten grants from the Urban Mass Transportation Administration for almost $800,000 to black institutions for important research projects. Two of these grants for a total of $142,000 are being awarded to Howard University. This university also received a grant from the Urban Transit Agency to conduct an extended seminar for 15 professors from black institutions to prepare them to undertake research projects on transportation problems. Well, I think now I've taken enough of your time. I want to thank again Dr. Cheek and all of you, and let me just say I hope we can meet again and again in furtherance of this very worthy cause. Thank you all. Thank you for being here and God bless you. Mr. President, on behalf of the entire Howard University community, we thank you from the depths of our heart for your statements. You have inspired us by your words and by your presence to continue our efforts begun in 1977 to develop our New Direction Fund campaign. We are deeply grateful for the actions you have taken on our behalf as well as for your continued support. Our profound thanks also are extended to everyone present who has supported us in our challenge to American and international philanthropy. The response from private individuals, corporations, foundations, our alumna and long-standing friends has been most generous. And we look forward to reaching our goal because, Mr. President, we have you with us and because we have all of you joining in this noble effort. Thank you so much.


In all previous lectures, our interest has been to consider heat and mass transfer close to a wall, whether force convection or natural convection. In this last lecture of this course, I am now going to consider a flow with heat mass transfer and chemical reaction in which no wall is present and that is in everyday language is nothing but the combustion flame. And my task is to see how we can apply the knowledge we have gained so far to predict the length and thickness of a diffusion flame. So, I will proceed as shown here. I will first of all define a flame and then I will set up the governing equations. Then first consider laminar jet whose velocity would be predicted and then flame length and shape would be predicted of the laminar jet flame. And then likewise, we will do the same in for the turbulent jet flame. Remember again that the word jet implies that there is no wall present and it sometimes also called a free shear flow. So, let us look at the definition of a flame. Here is the definition. The most commonly encountered diffusion flame is the candle flame that you can see here. In diffusion flame, the source of the fuel and the oxidizer are physically separated. So, the candle flame is an example in which the combustion of gaseous hydrocarbon fuels, sorry the candle flame is an example in which the melted wax here evaporates. And so, the fuel alone arrives into the flame where the oxygen required is gathered from the surroundings. So, fuel itself does not have any oxygen in it, but the oxygen required for burning is obtained from the surroundings by process of diffusion. Gaseous hydrocarbon fuels are often burned in the same manner. So, here is a typical burner and the fuel is carried through an inner pipe and air is carried through an annular pipe. Sometimes, this air may also be swell to enhance rate of mixing here. The air entrains inside the burning zone and a flame is formed. So, this is a typical laminar diffusion flame where the velocities are low. But if the velocities were high, you will get what is called as a turbulent diffusion flame with very jagged edges unlike the laminar flame which has a nice smooth edge. So, gaseous hydrocarbon fuels fuel flows through the inner pipe of the burner where the air flows through a concentric pipe. This is the situation at hand and essentially you have a free shear flow. There is no wall present across the thickness of the flow at all. So, what is the main objective? Now, here I am defining the fuel which is coming in through a pipe of diameter D. The jet spreads along the dotted line if you like whereas, the flame radius varies with x. It is highest at the beginning and goes on decreasing. When the radius goes to 0, you essentially say well that is the flame length L f. We are assuming stagnant surroundings completely stagnant surroundings and this is essentially the burning zone of the jet. The temperature profiles across any cross section would look like this. So, here is the radius and you can see that the value of the velocity there is 0 at the edge of the somewhere of course, the exact location where it will be 0 is not known and that is what we wish to find out. But, at the edge of the flame the velocity would be 0, but in the center it would be high. So, that is the velocity profile. The oxygen profile would go like that. The temperature profile would go something like that and the fuel profile would be as shown here. It will be highest and the edge of the flame is shown somewhere here. So, the fuel would be high at the axis. The oxygen would fly high at the edge of the layer and the temperature would be low in the environment, but would increase to a peak value somewhere and decrease a little in the core region. So, the main reaction actually takes place at the edge and therefore, you get very high temperatures there. So, the main objective is to predict the flame length L F and flame shape which means function R F flame as a function of X. In order to make life simple, we are again use the simple chemical reaction as the combustion model. So, in stagnant surroundings and assuming simple chemical reaction, I can write 1 kilograms of fuel plus R S T kilograms of air, oxidant air. R S T would be the air fuel ratio gives me 1 plus R S T kg of product. The postulated chemical mechanism is simply simple chemical reaction mechanism and our interest is to predict L F and R F as a function of X. So, now because this is an axisymmetric case, it is a round jet and therefore, this is an axisymmetric case.  Of course, in a free jet like that the pressure gradient term is 0. So, therefore, in the momentum equations you do not see any pressure gradient term. So, you are simply convection term and a diffusion term according to the boundary layer approximation. This is the equation for the fuel, this is the equation for the oxidant and this is the equation for the energy or the enthalpy H m and I would source term as r times r f u multiplied by heat of combustion. So, H m would now be simply represent the sensible enthalpy H m equal to C p m t minus t r f that is what H m would represent. So, these are the equations to be solved for this problem. So, first of all let us solve the velocity problem and we are going to make the very drastic assumption. We are going to say that the properties of the fuel or the properties of the mixture inside the flame zone is constant. So, properties are uniform. Then you will see that all these rho m's will come out and so would mu would come out here. So, I am now taking laminar flow.  The continuity equation would look like this.  Now, the boundary conditions are since at the axis there is no v is equal to 0 you have f 0 also f dash 0 is 0 and f dash infinity is equal to 0. So, these are the boundary conditions for the similarity variable f. The substitution gives similarity equation. So, if we make substitution for u and calculate d psi by d y and so on so forth if we make these substitutions here.  So, if I integrate this from 0 to eta that is going from axis of the jet to some radius and noting the boundary conditions are f 0 and f dash 0 are 0. We get simply this will transform to f f dash equal to f dash minus eta f double prime and the solution then is f equal to eta square over 1 plus eta square by 4 f dash which is of interest. This is the velocity in the jet f dash equal to 2 eta over 1 eta plus eta square by 4 and f double prime is so on so forth and therefore, we can interpret u which is which can requires f dash and v which requires f dash and f in the following manner. So, u would be c square nu m divided by x into 2 over 1 over eta square by 4 square and v would be given by this expression eta minus eta cube by 4 1 plus eta square by 4 square c nu m by x. So, our next task is of course, to estimate what is c to do that if you multiply momentum equation by r and integrate from r equal to 0 to r equal to infinity then you will see that the momentum equation that we have this momentum equation you multiply by r and first of all write it in conservative form and then integrate from 0 to r then you will get d by dx of 0 to infinity rho m u square r dr equal to rho m v u r infinity minus rho m v u r 0 and likewise the gradient terms. Now, you will see these terms are absolute 0 because at r equal to infinity u is 0. So, that is 0 at r equal to 0 v is 0. So, that is 0 at r equal to infinity du dr is 0 because u itself is 0 and at the axis symmetry du dr will be 0.  If I now multiply this by 2 pi then you will see this is nothing but the jet momentum rho m u square r dr into 2 pi r and integration. So, substituting for u which is this expression in here I can show that the integration would give me 16 by 3 pi rho m rho nu m square c square and that would equal since this is constant with x it will amount to rho naught u naught pi by 4 d square which is rho naught and u naught are the density and velocity at the entrance to the jet. This is a constant and therefore, I can now determine c in terms of jet momentum or I can also determine it in terms of Reynolds number. So, c is equal to root 3 by 8 Reynolds rho naught by rho m raise to 0.5 or in terms of jet momentum where Reynolds number is u naught d divided by nu m eta likewise remember what was eta eta is c into r by x. Therefore, if I substitute for c I would get eta equal to that definition u star which is and I can write u also as u star equal to u x by nu m in this manner in terms of Reynolds number and u over u naught would be 3 by 32 d by x r e 1 plus eta square by 4 raise to minus 2 rho naught divided by rho m. This is u divided by u at inlet it will be function of x and it will function of r and you can see as x increases u is decreasing at the same time as y as radius increases u decreases it will be maximum when eta is equal to 0. So, u over u max would simply be 1 over 1 plus eta square by 4 whole square and since we do not know where the edge of the jet will be we it is customary to define what is called half jet width. So, where u over u max will be equal to half eta would assume a value of 1.287. So, you can see 1.287 square divided by 4 plus 1 whole square would give you 1 by 2 and therefore, eta half equal to 1.287 is dimensionless jet half width. So, this is by convention of the dimension we say eta half characterizes the jet width r half. So, r half by x will be eta half divided by c equal to 1.287 8 by 3 Reynolds rho naught by rho m raise to minus 0.5 equal to 5.945 divided by Reynolds rho naught by rho m raise to minus 0.5 and that is nothing but tan alpha which is which what we call the jet spread angle you will see you will recall that I have shown you the jet spread jet spread. So, r half divided by x corresponding x will simply give you the angle of the jet it is obvious that if the bigger the Reynolds number smaller would be the jet spread angle smaller would be the jet spread angle as we would expect. Now, we want turn to prediction of length n r f. So, assuming Lewis number equal to 1 and making simple chemical reaction as we have done all equations can be rendered in conservative form of this type. We have done this many times and phi will be simply omega f u minus omega ox divided by r s t equal to h m in plus delta h c omega f u and it would also be equal to u or u naught because our momentum equation itself is of the conserved property form and because it does not have a pressure gradient. So, phi can now represents both the mass fractions it can represent enthalpy and it can represent velocity.  Now, suffix a here implies in the air stream and suffix f implies in the fuel stream.  Now, you can see omega f u in the air stream would be 0 whereas, omega ox in the air stream would be 1 because omega ox represents air so that would be 1. So, this will be simply 1 divided by r s t omega fuel in the fuel stream is 1 whereas, omega ox in the fuel stream is 0. So, this will be simply 1 as you can see here and this would again be 0 and this would be 1. So, you get 1 by r s t.  This is by taking phi equal to omega f u minus omega ox r s t f is given by that. Now, the flame is located where omega f u minus omega ox divided by r s t is 0 that is where the fuel and oxygen are in stoichiometric proportion and the stoichiometric proportion as we have seen means omega f u will be equal to omega ox by r s t.  The flame edge would correspond to simply omega f u minus omega ox equal to 0 that would be equal to 1 over 1 plus r s t this shows the outside of the flame where f lies between 0 and f stoic whereas, inside the flame f lies between 0 and 1. To see this on graphically we draw a graph of f equal to 0 to f equal to 1 and here is what I have shown f stoic because r s t for a given fuel is known ox r to fuel ratio is known and therefore, f stoic can always be plotted on this f of course, being dimensionless fraction can only go from 0 to 1 and you will see that on the outside of the flame this is the variation of oxygen up to f stoic at the flame front the oxygen disappears. So, outside the flame there is oxygen, but it will disappear at f stoic the fuel is in the inside would go on decreasing from center line to the edge of the flame the product would go on increasing at up to the flame edge and then would decrease the temperature would be t infinity in the outside will increase to t at the f stoic and then would again decrease.  In fact, that is what is often found and that is what I have shown here that the fuel fraction would also appear little bit on the outside very close there to f stoic and oxygen would appear little bit on the inside and this zone is the flame thickness zone if you like or the flame edge thickness which you often see, but for all practical purposes we are going to say that the flame edge is a very sharp surface f equal to f stoic is a very sharp surface. Now, if we take phi equal to h star equal to h m delta h c omega f u where f is equal to h star then you can you will see I will get h m minus f delta h c omega f u the same quantity in the air stream and the same quantity in the f stream and same quantity in the air stream. So, this would simply be c p m t minus t infinity delta h c omega f u because remember there is no f u in the air stream c p m t naught minus t infinity again because in the air stream the temperature is t naught and in the fuel stream f u is equal to 1. So, you get delta h c here where there is no f u in the air stream. So, delta h c will be 0. So, h m in the fuel stream minus h m in the air stream is c p m t naught minus t infinity.  So, at x equal to l f we can say that phi is equal to u over u naught f h star is equal to 3 by 32 which is the solution that we had written earlier here. The solution to phi would be simply equal to u over u naught for all variables phi and that is what I have written here phi equal to u over u naught and all that sort of thing here. So, at r f if I replace eta by as eta f then I can recover r f by x equal to 16 by 3 raise to 0.5 r e into this density into that expression where f stoic is of course, 1 over 1 plus r s t and setting r f equal to 0. If I set that to 0 which essentially means this quantity is equal to 1 then x equal to l f I will get length of the flame divided by diameter equal to 3 by 32 rho m naught by rho m r e f stoic and f stoic being 1 over 1 plus r s t I get that. So, what this shows is that l f would increase with Reynolds number of the jet. The higher the velocity of the jet the longer will be the flame. Now, turning to turbulent jet flame let us look at what happens to flame length with increasing flame velocity and experimentally it was documented for the first time by a scientist called Hothon and he showed that in the laminar flames the flame length increases almost linearly with nozzle velocity as we have shown on the on the previous slide. We have shown here l f would almost linearly increase with velocity u naught, but after a certain velocity the flame length actually decreases and when the flow is completely turbulent the flame actually is independent of the nozzle velocity. So, in turbulent flows turbulent jet flames l f is almost constant the length of the flame is almost constant. So, we have something to think about here how we can predict the turbulent jet flames. The radial distribution of u is nearly uniform over greater part of the length and also experimentally it is very difficult to identify edge of the flame length because the turbulent flame is never steady it is unsteady and the edges are very jagged. So, you you get the flame which is sort of oscillating in the actual direction and it is very you can only take photographs of that to to measure what sort of time average flame length if you like as observed from photographs. So, the previous equations that we had used for laminar jet flame apply even for turbulent only thing is we have to use effective values of viscosity or kinematic viscosity and thermal diffusivity and mass diffusivity. So, we we say the equations of the three as I show here the equations of the slide 3 apply only thing is the effective values will be used as mu effective divided by Schmidt number and effective thermal diffusivity will be mu effective divided by Prandtl number and in gases Schmidt number and Prandtl number under turbulent range is point about 0.9 quite we have seen that in turbulence modeling part of the course. So, the simplest velocity formula is so we need now to define mu effective essentially.  So, for example, I may have a jet which is like that and there is a parallel stream at u infinity sometimes you do get the co-flowing streams also. So, we define u axis here u x and u infinity then the turbulent viscosity would be given as 0.01 rho m u infinity minus u x delta this is the simplest form of the turbulent viscosity specification. It was proposed by Spaulding in the book combustion and mass transfer Pergamon press at Oxford 1979 and for stagnant surroundings of course, u x u infinity is 0 u x will be u max and also for from experiments it is found that the jet with delta thereby r half the jet half width is about 2.5 in turbulent boundary layers in turbulent jets and therefore, if I substitute delta for delta and set u infinity equals 0 then you will see I get mu effective equal to 0.0256 rho m u max r half and this as you can see r half can only be a function of x u max likewise can be a function of x and therefore, this is not a function of r. So, essentially what we have said is that mu effective is constant across the width of the jet it may vary with x we will see whether it does or not. From all our solutions we will apply if we assume constant properties and since mu effective is also nearly constant we will say simply change mu to mu effective and you will get u star max equal to u max by mu m equal to now r e turbulent square r half by x will be again given by that where r e is replaced by r e turbulent and what is r e turbulent it will be rho m u naught into d divided by mu effective which is 0.0256 rho m into u max r half. And therefore, from this I can get u max over u naught will be equal to 6.57 remember r half will get cancelled and 6.57 d by x rho naught by rho m raise to 0.5. Now, combining this with u star max I will get u max over u naught square equal to that or r half by x equal to 3.662 6.57 square is equal to 0.0848. So, r half is definitely a function of x in fact it increases linearly with x as r half divided by x 0.0848. So, in our effective viscosity formula r half will vary with x now let us see whether how u max will vary. Now, the results agree very well this particular result agrees very well with experimental data when x by d is greater than 6.5 because the initial range from just outside the mouth of the jet the r half is largely governed by ellipticity whereas, we have used parabolic assumption now replacing r half and u max we would have mu effective equal to 0.0256 remember I am replacing u max in terms of u naught d by x. In fact, you can see u max is inversely proportional to x and we just showed that r half is directly proportional to x. And therefore, mu effective is not at all function of x in fact it is absolute constant absolute constant. And that is why we our replacement of mu effective is perfectly varied all we are saying is a turbulent jet is simply a laminar jet with a much more augmented viscosity which is constant mu effective would then become 0.0142 I simply replace here u max equal to 6.47 u naught and so on. So, for an r half equal to 0.0848 x. So, x and x get cancelled and we get u mu infinity equal to an absolute constant as 0.01426 u naught d multiplied by rho naught rho m raised to half. Now also since eta half is 1.287 we can say that eta will be 1.287 r over r half and u over u max will be 1.414 r over r half whole square raised to minus 2. So, this is the velocity profile of a turbulent jet u over u max equal to all that and eta would be 1.287 r over r half and r half is simply 0.0848 into x. A turbulent flame now we have turned to L F and R F prediction a turbulent flame is essentially an unsteady and its edges are jagged as I said. Fragments of gas intermittently detached from the main body of the flame and flare outside diminishing in size turbulence affects not only L F, but also the entire reaction zone near the age of the flame compared with the laminar flame this zone is much thicker. We had identified that in laminar flame also there is a slight overlap where near F equal to F strike, but in turbulent boundary layers turbulent jet this zone is little bit thicker the flame so called flame zone or the age zone is somewhat thicker. This implies that if the time average values of omega f u and omega ox are plotted with radius r then the two profiles show considerable overlap around the crossover point F equal to F strike. Unlike the overlap in laminar flame which is caused by finite chemical kinetic rates however in turbulent diffusion flame the overlap is caused by turbulence and in the presence of turbulence R F u actually experience is not as high as estimated from R F u proportional to omega f u raise to x, omega x raise to y and this is because the fuel and oxidant at a point are present at different times. So, although the average values of omega f u and omega ox may be high the actual reaction rates R F u found is somewhat less and therefore how less is dependent on what is the probability of omega f u and omega ox meeting each other in the right proportions to cause a chemical reaction. So, the effective rates of burning are actually smaller than would be calculated from omega f u raise to x and omega f u raise to y which is the typical formula we use for burning rate of a fuel and therefore we must allow for probability of turbulence. Now, since all laminar solutions are applicable to time average quantities we may write phi bar equal to u bar over u naught equal to F bar over equal to h star equal to all that this is the solution repeated, but now let us see what actually happens. Let us consider the mixture fraction F and let this be the time average value. In reality the mixture fraction F would fluctuate between F high with a cap on top and F low with a cap on top these are the instantaneous values. So, what we are saying is that at the age of the flame in the presence of turbulence or because of the turbulent the mixture fraction would jump from a low value to a high value and high value to a low value almost instantly, but when it reaches a high value it will spend some time at in the high value and when it is suddenly fluctuates to a low value and again spends a little time there this is called the square wave or the rectangular wave if you like of variation. So, this is an assume variation of F. So, F is equal to F mean plus F dash on the positive side and F dash on the negative side. So, F dash can be both positive and negative around F bar and this is what I have shown here. So, although the F stoic of the fuel which is 1 over 1 plus r s t is reside somewhere here on the F and F equal to 0 and F equal to 5. So, the instantaneous high value may be here the average value will be in between the two, but that may not equal F stoic the average value of F may not equal the F stoic value. Now, what are the deductions we can draw therefore, for omega ox average omega fuel average and t average with reference to the figure with reference to the figure suppose that the value of F instantaneous F truly fluctuates between a low value F and I have value F. Let us assume that the fluid spends equal time at the two extremes and sharply moves from one extreme to the other. So, then F bar the average time average value F will be half of high and low values instantaneous values and F dash the fluctuation will be half of difference between high and low values. So, thus omega F u bar would be 0.5 omega instantaneous value of low and high mass fractions of fuel shown by the field circle. You can see this is this is the value shown by the field circle here would be greater than omega F u which is the value corresponding to the local value, whereas the time average value is over there shown by the field value and it is greater corresponding to F bar greater than F stoic. Now, we are taking the case of F bar greater than F stoic, but the story can be repeated even when F bar is less than F stoic. Likewise, omega ox is also greater than omega ox which is 0 for bar greater than F stoic. You will see that oxygen has already been consumed. So, the local value is 0, but the time average value is somewhere there omega ox time average value there. Therefore, for F bar greater than F stoic time average is greater than omega ox T bar 0.5 T instantaneous low plus T instantaneous high is less than T. You can see T bar is less than T the local value of T corresponding to F bar at the time average F. The above observations reveal will also apply when F bar is less than F stoic. Thus, in general finite amounts of fuel and oxygen are found when F bar is equal to F stoic. When F bar is equal to F stoic, you will get finite amounts of omega F u and omega ox at F equal to X stoic. Therefore, we get a little overlap. So, if F stoic does not lie between F l instantaneous and F h instantaneous, then T bar omega bar ox and omega will of course, correspond to F bar values. Therefore, the flame zone will be a finite volume enclosed by F l equal to F bar minus F dash when that quantity is equal to F stoic, which is the inner edge of the flame, flame edge rather and F high equal to F bar plus F dash equal to F stoic would represent the outside of the flame. Thus, F bar equal to F stoic surface will lie somewhere between the two surfaces. So, in this case, the thickness of the flame edge is now being analyzed. So, how do we estimate F dash? That is the issue. From our results of laminar flow results themselves, we can say that R f out minus R x will be F stoic minus F dash because that is the value of you can see for the outside F stoic will be equal to F dash plus F bar plus F dash and therefore, F bar would be equal to F stoic minus F dash. For inner surface, R f in would be F stoic plus F dash into all this and for the stoichiometric case, when F bar will be equal to F stoic, you will get R f stoic given by that. Now, we have to determine F dash.  So, F bar solution is already known to you. This is the solution to F bar. So, you take a derivative of this with respect to r and l m.  For a turbulent round jet, this is found to fit the experimental data quite well. There is no distance from the axis term here simply because there is no presence of the wall and therefore, the mixing length becomes 0.1875 r half is essentially a constant. So, if we substitute for r half, then we will get F dash would essentially become like that. At each x, we can predict F dash R f stoic by x whole square. Now, if I set R f in each case, if I set that equal to 0, that equal to 0 and that equal to 0, then I will get Lf in sorry Lf out Lf in and Lf stoic. That is what I have done here. So, Lf out thereby d would be 6.57 F stoic minus F dash rho not by rho m. Lf in would be 6.57 F stoic plus F dash and since this is subtracted, you will see Lf out will be longer. Lf in will be smaller and the stoichiometric case where the in between length would be 6.57 F stoic rho not by rho m equal to 6.57 1 plus R st rho not by rho m. Thus, if Lf stoic is regarded as the mean flame length, then knowing F stoic equal to 1 plus R st raise to minus 1, the flame length can be estimated for any fuel. Remember air fuel ratio would vary stoichiometric air fuel ratio would vary for the fuel under consideration and therefore, we can say that we can readily predict the Lf stoic. Although the above relationships, the most important thing is you can see this relationship does not show effect of Reynolds number at all as was observed by Hawthorne experimentally that in turbulent flames, the length of the flame remains constant and that is what has been shown. So, we have we have recovered in spite of a very simple analysis, we have recovered the most important result. Now, though the above relations are only approximate, they do embody the form of the experimentally determined empirical correlations and what do they look like? The experimentally determined correlations for Lf show that F will be function of D as you have seen here, it will be function of R st, it will be function of rho not by rho m and rho not by rho infinity in some cases, the experimental correlation and rho not is essentially the density of the fuel thereby density of the surrounding gas rho infinity. But rho not by rho infinity is of course, the density ratio which can be different for different types of fuel in diffusion flame. So, except for that ratio, basically we have not been able to identify rho m and rho infinity because we assume constant property the ratio. So, with this I conclude the lecture on flames and with this I also conclude the entire course on convective heat in mass transfer. In the first 20 lectures, I covered laminar flows both external flows and internal flows with and without suction and blowing in the presence of pressure gradients and wall temperature variations. We also considered laminar internal flows both in simple ducts as well as complex ducts of non-circular cross section and we were able to calculate numbers both in the presence of circumferentially varying boundary conditions or actually varying boundary conditions. Then we moved to the next 10 lectures where on turbulent flows the formal aspects as well as turbulence modeling and also phenomenology called arguments of flow near the wall which gave us the universal laws of velocity distribution and in that of temperature distribution close to a wall which enables us to calculate the Nusselt number and friction factor for a turbulent boundary layer as well as turbulent ducted flow. Then we moved to the convective mass transfer problems in which we first of all postulated the we first of all considered the full boundary layer flow equation and we said there are simplified forms which are good proxies for mass transfer problems can be derived and the Reynolds flow model was found to be a very good proxy for the full boundary layer flow model and using that model we solved several problems. But of course, diffusion mass transfer is as important as convective mass transfer and for that diffusion mass transfer is simply a special case of a boundary layer flow model which we modeled as the stiffened tube flow model and found that the results from there were giving us the logarithmic form of the connection between mass transfer rate and the spaulding number b. In between these two Reynolds flow model and stiffened flow model we also invoked the queer flow model which showed us why property variations at large mass transfer rates are required and the model was successful in showing us the trends of property correction that should be applied and in the last two lectures I considered natural convection heat and mass transfer and in the present lecture I considered the case of heat and mass transfer in a free jet that is the case of a jet diffusion flame. So I hope you enjoyed these lectures and I also hope that this will prompt you to take up a career in the field of convective heat and mass transfer. Thank you very much and all the very best wishes to you.