Welcome to yet another session of our NPTEL on non-linear and adaptive control. I am Srikant Sukumar from Systems and Control, IIT Bombay. We are now in the fifth week of this course, which I hope all of you are finding rather interesting and rather useful. And starting this week, we have a new motivating image, which is that of a spacecraft from SpaceX specifically, that is hovering around the earth. And the algorithms that we seek to design are also driving systems such as these, so that they can reorient and move autonomously in space. So, now starting today, we will look at a new set of course notes. And this is just sort of preliminary, not a preliminary, but something that precedes adaptive control, adaptive control literature was preceded by identification literature. And it was rather well known that for any parameter identification to happen successfully, there was a rather a certain requirement for richness of signals. And this richness of signals was regularly codified in terms of persistency of excitation. So, until last week, we sort of completed our discussion on, well, I mean, until the last lecture, we completed our discussion on, I mean, the Lyapunov theorems and the different variants. And now today, we are ready to delve into topics on persistency of excitation. So, like I said, this precedes what we did in, what we will do in adaptive control. And so chronologically, it in fact came before the adaptive control literature. Of course, you will also see that there is a healthy connection to stability, because we are talking about parameter convergence, which is a sort of stability problem. So, there is a healthy connection to stability. And so we will look at some alternate exponential stability theorems and so on. And so this is what we will discuss for the rest of the week. So, let me warn you, we are already starting to get more and more mathematical. So, the topics are getting more and more mathematically involved. So, I would expect you to spend more time trying to understand the material, going through the material and be comfortable working with the material and use it in different problems and application contexts. All right? Great. So, let us begin. So, the first thing we sort of talk about is what is the definition of persistency of excitation. So, vector signal phi of t is said to be persistently exciting. So, this is a more how would I put it, a definition in words. And then of course, we will define it more mathematically. So, the notion of persistency of excitation is that if the signal wobbles around enough in every window of length t, right? So, if I have a sliding window of time, so I keep sliding the window of time, right? I keep moving forward, forward, forward, forward, forward, forward, forward, right? In time, over each of the each such window of, you know, length t, I want the signal to wobble sufficiently or move around sufficiently enough, right? And it is made a little bit more formal saying that the integral of the diode associated with it is positive definite. Again, you will look at a more mathematically precise version just down below. So, we do not have to worry too much about understanding this, but diode is an operator which is a combination of two vectors, okay? So, here in this case, it is basically referring to an inner product, all right? In this case, it is referring to an inner product, right? So, what are we looking at? What are the elements here in the definition? There is a sliding window of time of this constant width t, capital T. So, we have kept a capital T window of time. And on each such window, we are expecting the signal to, you know, sort of wobble sufficiently, right? So, that is some kind of positive definiteness of a diode is achieved, all right? So, without, again, all elements of this are not very clear just by this definition in words. So, we actually look at the more formal mathematical definition for our purposes, that is, when the signals are in, when we are looking at vector signals in Rn, right? So, that is, if there is an integrable signal phi from R plus to Rn, then it is called persistently exciting. If there exists three constants, mu 1, mu 2 and capital T, all of them positive, such that this kind of integral inequality holds. What is this integral inequality? And this has to hold for all times small t. So, this is what it means to have a sliding window, right? Because as I change T, my windows start to slide, okay? So, changing T means I am sliding the window because this capital T, that is the range of this integration remains the same. It remains capital T, okay? But it is just that I am changing the initial time from which I began, all right? Okay. So, what does this inequality sort of mean? Let us just try to interpret it, right? So, the first thing to remember is that this matrix phi phi transpose is belongs to Rn cross n, all right? So, it is an n cross n matrix. That is the first thing to remember. The second thing is this is in fact positive semi-definite, right? Because it is a symmetric, first of all, it is symmetric because it is just product of phi phi transpose. So, if I take the transpose, it is still phi phi transpose. So, therefore, it is a symmetric matrix and it is like a quadratic, right? So, because it is phi and phi transpose, therefore, it can never be negative, it can never have negative eigenvalues. We already know if the matrix is symmetric, then the eigenvalues are real, right? So, we can talk about positive and negative eigenvalues. But we also know that this matrix cannot have negative eigenvalues because it is a, it is like a square, right? If you have any confusion in understanding this, you can just think of it like if I multiply both sides by some constant vector, say V transpose phi tau phi transpose tau V. Suppose I do this because I can move this in and out of the integral if I do this, then you know that this is actually a square, right? This is actually T, T plus capital T, phi transpose tau times V square d tau. And this is the norm square. This is the norm square and this is like something like an X transpose X, X transpose X, which is a norm square and then the two norm square, right? And the two norm can never be, the norm can never be negative, right? Therefore, this entire quantity has to be greater than equal to 0, right? Now, you know that if the quadratic form is non-negative, then the matrix has to be a positive semi-definite at least, okay? So, that's really the argument. It's like a square. Therefore, it is positive semi-definite at least. But we are claiming something more, something more. We are saying that it is in fact lower bounded by mu 1 i, which is strictly greater than 0. So, therefore, somehow we are saying something about the eigenvalue of this integral, all right? Because if you remember for any symmetric matrix, we had this nice inequality, right? What was it? It was something like X transpose AX less than equal to lambda max A norm X squared and lambda min A norm X squared, right? Which means that the quadratic form is lower and upper bounded by the largest and smallest eigenvalues. Right? Therefore, if I write it in this nice form, I'm just, if I write it in this form, all I'm saying is that the smallest eigenvalue of this matrix with the integral of course is, has to be greater than equal to this mu 1. So, the smallest eigenvalue of a symmetric matrix being greater than a, being greater than equal to a positive constant means what? It means that this is a positive definite matrix, okay? This is a positive definite matrix. The other side is rather simple. It just says it is some kind of a bounded matrix, right? So, there is an upper bound on the eigenvalue of this integral, okay? It's like a, it's a simpler condition. In fact, many textbooks define this without, define persistency of excitation without this right-hand side. So, I would not put too much of a stress on this side. So, it's more of a question of how you want to do the math that's about it, right? So, so what's the idea? What's the idea? So, we are saying, so the first thing we know that the integrant is greater than equal to 0. What else? We know that phi, phi transpose singular for each t, yeah? Why is that? Why is phi, phi transpose singular for each t? See, phi itself is just a vector. What is the maximum rank of a vector? 1. Now, if I take product of two matrices, then the rank of the product is less than or equal to the rank of the, each of the matrices, right? So, now what am I doing? I am taking two matrices, that there is also a matrix, right? And I take that product. Therefore, the rank has to be less than equal to the rank of each one of them, which means the rank of this whole thing is less than equal to 1, can be at most 1 is what I am saying. So, the rank of this product is at most 1. So, this is rather interesting, right? I am saying the rank of this product inside the integral is at most 1. But I am saying that when I integrate this quantity over this window of time, then the rank, in fact, becomes n. Because if the rank doesn't become n, this cannot become positive definite, which is what is indicated by this inequality, right? Because, or even simpler idea, this is less than equal to the smallest eigenvalue, which is positive. So, we are saying that the smallest eigenvalue is greater than or equal to mu 1, which means what? Which means that all eigenvalues have to be strictly positive, which means I am somehow saying that although the integrand has ranked at most 1, the integral over this time window of capital T has ranked in, has maximum rank. So, this is the rather cool property that we are looking for. And this is the property of persistence of excitation, right? So, we therefore, which is what is mentioned in this note, the matrix itself phi phi transpose is singular for all time. So, the P conditions somehow requires that the phi rotates sufficiently, right? Such that phi phi transpose is uniformly positive definite. Why do we say uniform? Because these bounds don't depend on the small t. Yeah, mu 1 and mu 2 are independent of the small t. You remember that in all our definitions, uniformity has always got to do with the time argument, alright? So, in this case, that time argument is the small t. If mu 1, mu 2 are independent of it, so you keep sliding, it doesn't matter where you are, your bounds remain the same, yeah? Because if they don't, then you are sort of, it's rather troublesome, yeah? If you don't have, you know, a uniform bound, yeah? Then you will not be able to complete the sort of analysis that we try to do, alright? Excellent, right? So, we start with a singular vector, we make an outer product, phi phi transpose is an outer product. We know that it is symmetric, we know it's positive semi-definite, we also know it's singular with at most rank at most 1, yeah? But the cool feature that we are looking for is that when I integrate it over a window of time capital T, I want it to become positive definite. Of course, I also expect it to remain bounded. It's fine, not a big deal, okay? Not asking for months there, alright? Great, great. So, that's what it's sort of, we are saying, we create an outer product, this condition has to be valid for all small t and we slide a window of size capital T and phi phi transpose is symmetric positive semi-definite, yeah? But when we do a moving window average, it is positive definite. So, if we do moving window average, it's always positive definite. So, this is rather strong, alright?  So, the first example obviously is a scalar signal. Well, we, most a lot of our examples are scalar signals, but whatever you can construct the vector counterparts without too much of a trouble, right? The first very, very easy example is a constant signal, right? The constant signal is of course, persistently exciting, yeah? Obviously. And it's lower and upper bound are exactly this value itself and the lower and upper bound will be exactly C and therefore, it is a trivially persistently exciting, yeah? If you integrate this over C d tau, t to t plus cap tau, you will always get C t irrespective of what is your small t, alright? And therefore, the lower and upper bounds are can be exactly capital T, C times capital T. So, one of the things you can remember, so I mean, so I can actually mark this to be my mu 1 and mu 2, yeah? So, one of the things to remember is that these mu 1s and mu 2s can depend on capital T, okay? So, a lot of times again, one of the things that is done is, this definition is again taken with the 1 over capital T to do sort of an averaging out, right? To do sort of an averaging out, so that T doesn't appear in these constants. So, this is another thing that is standard, okay? Definitely not non-standard.  And without this, this is not an average, it's just a summation. I mean, if you think of, you know, breaking the integral, of course, yeah? But with this 1 over capital T, it is a sort of average, right? So, that's why we call it, you know, this is a word moving when the average is being used, alright? So, here also, if I do 1 over capital T instead of just, yeah? So, in fact, sorry, this is C squared, right? So, this is just this guy, okay?  C squared because it is phi phi transpose. So, in this case, it's C squared, right? Great, great, great. So, this is like we said, this is trivially persistently excited, no problem, okay? So, let's look at another example, yeah? Of course, this is sort of example where the signal can possibly hit zero, right? This was trivially persistent because this never hits zero anyway, yeah? So, we are not worried about this signal so much. So, next one is something like this is a periodic signal with a period capital T itself, which is this window size, right? And what is this function? It is a max of sine T and zero, okay? And of course, we take capital T to be 2 pi, okay? Because that's the period of this signal, right? So, we take the max of sine T and zero, right? And this is also, so basically, the purpose of this is to somehow make sure that you don't go below zero, that's all. I mean, not that it matters, yeah? Not that it matters so much. In fact, in fact, I could just take instead of this something like a f of T is sine T, right? And T is zero to 2 pi, right? And now if I take capital T equal to 2 pi, then I'll be doing integral from sum T to T plus 2 pi and sine T, sorry, sine tau d tau, sorry, sine squared tau d tau, okay? Right? Something, it's basically sine squared tau d tau, right? So, what is, let's see. So, now I want to basically use, see if I can integrate this, right? Let's see, yeah, let's try to do this, okay? So, this is something like this is equal to T T plus 2 pi sine squared tau d tau. And I do want to see if I can use some kind of trigonometric formula. Can I do that? Yeah, I think 1 plus cosine 2 tau will be equal to 2 sine squared tau. I believe this is an, let's see, I believe this is an inequality because cos 2 tau is cos squared tau minus sine squared tau. Now let's see. Yeah, I think this, I think we can use something like this because cos 2 tau is cos squared T minus sine squared T. So, this becomes sine squared T plus sine squared tau. Yeah, yeah. So, this is 1 minus cos 2 tau. So, this is this guy. And if I integrate this, I will get something like tau minus half sine twice tau. And this is T 2 T plus 2 pi. So, the first term will just give me 2 pi. And the second term will be minus sine 2 T plus 4 pi minus sine 2 T. So, what is sine 2 T plus 4 pi? Because this is just periodic with 2 pi. So, this is actually going to just cancel. So, I am going to be left with 2 pi. Yeah. And if I actually took a 1 over 2 pi here, or a, so 1 over, or 1 over T here, which is 2 pi itself, 1 over T here. So, this is 2 pi by 2 pi and that is equal to 1. So, this signal is also persistently excited. So, pretty straightforward. I just integrated the square of the signal because the outer product, if the signal itself is a scalar, then the outer product is simply the square of the signal. And that is what I did. And it is not difficult to compute that this is also persistently excited. Now, if you look at this kind of a signal, again, I mean I do not need the square here. If you look at this kind of a signal, f of T is e to the power minus T sine T. So, this is actually, we are not going to compute it, but I mean, let us see. So, if you look at how the signal evolves, this will really start to decay very fast. All right. So, if you look at this, we make this envelope, it can e to the power minus T. If you make this envelope, then what will happen is that the sinusoid will lie between this. And it will start to decay very fast. Yeah, very fast. It will start to decay very fast. Now, this kind of a signal is not persistently exciting. Yeah, I am not actually computing the integral itself. I would leave it to you folks to try to compute this, right. But this is going to be, this is not going to be persistently exciting, right. Why? Because this is sort of decaying. And now what happens if it is decays, especially exponentially? Yeah, what happens is that this integral over this window of capital T, right, I mean, I make a window, then I move the window, move the window, move the window and so on and so forth. You can see I get smaller and smaller pieces, smaller, smaller amplitudes. And in fact, this amplitude will somehow be scaled by like an e to the power minus T. And because I get smaller and smaller amplitudes, you will see that my mu 1 and mu 2 for a particular window start to get smaller and smaller. And the thing is if the mu 1 and mu 2 get start to get smaller and smaller, I get to choose only one mu 1 and mu 2, right. It has to be uniform in time. Mu 1 and mu 2 cannot depend on T. So, if I keep moving the window and this amplitude becomes smaller, the corresponding mu 1 and mu 2 come out to be smaller for each of these windows, then the only thing I can choose is the smallest mu 1, right. I can only choose the smallest mu 1 and the largest mu 2. So, the largest mu 2 is not a problem because I will just choose it from the first one. But the smallest mu 1, if you keep going on and on, on and on and on, you can see that this is going to become really, really tiny. So, the smallest mu 1 I can pick, it is just like that uniform stability argument. The smallest mu 1 that I will be able to pick is in fact, 0, yeah. And if the mu 1 that we pick is 0, then this is not persistent because we require this. We require mu 1 to be strictly positive, okay. Because you already know it is semi-definite, right. We already noted the outer product is semi-definite, no magic there. What we need is that the outer product be, the integral of the outer product be significant, it is strictly positive definite. That is the, you know, if you take an average over this window of time t, it has to be strictly positive definite. And that is why we need a uniform window, right, uniform mu 1, yeah, independent of the small t, all right. So, this kind of a signal is not persistently exciting, yeah. These are for the purposes of identification, these are not good signals, yeah. So, if I may, these are not good for identification, all right. These are not good for identification. So, anyway, so what, so I will sort of summarize what we did today and what we are going to do subsequently, right. So, what we started today was a discussion on persistence of excitation, right. And this is a rather, rather important notion in parameter identification, all right. And we will sort of try to connect it in basic ways to parameter identification in the subsequent lectures. But today we saw the definitions of, definition of persistence of excitation. And we also saw what kind of signals are in fact persistently exciting, right. So, it really just involved computing a simple integral of an outer product, right. And in fact, for the more complicated cases, it is not difficult to verify this numerically also, all right. So, it is not that difficult to do a numerical verification. And so, like I said, subsequently we will start looking at how this is connected to your adaptive identification, all right. Great. This is where we stop. Thank you.


Come on directly coach griffel is a four-man sport. We only have three players now that XT is What's the word I'm looking for? I'm gonna blow up Exploded thank you tank now that XT's exploded and where's rookie we're already a man down He should be here rookie took the day off needed a personal day Personal day. What does that mean? I didn't ask. I just assumed it was one of those You know female issues man as a man. I just didn't feel comfortable discussing that What rookie is a guy coach exactly my point so you can see why I wouldn't feel comfortable talking about that What hey everybody? What's up? Okay? Where have you been? I'm not comfortable talking about this. Hey rookie. Why are you with the commissioner? This isn't the commissioner tank This is my new agent brash tan and at your service fellas agent extruder. Yeah, I was talking to XT before he um Well, you know blow it up before he met his untimely demise Which was absolutely no one else's fault by the way He told me I should get an agent so I got an agent his agent brash That's right. I think rookie has enormous potential. He just needs someone to help develop potential He has the worst stats on our team. I didn't mean potential as a player I meant potential in his paycheck on those related. Oh heavens. Oh, I'd be on the job if they were I'll be renegotiating rookie's contract with the team. He makes a fair wage now not the way I see it Why do you realize he's only paid 25% of the teams that's fair There's four players so he makes 25% I don't see four players here Well, I mean, there's only three of us here now sure, but three percent if that's what you're getting Of course not that wouldn't be fair to him. See, there's only two of you and there's one of him We all know that one client should be making at least 50% of the team payroll makes sense in a way that no it doesn't tank exactly And how will we be able to tell that apart from any other day? Welcome to UNS in sports I'm Stu Stuman and tonight's matchup is slip space versus the new Mombasa bossa nova bosses strictly speaking I guess this matchup doesn't actually match up since team slip space is entering the game down one man's injury and another player is on Strike and now it appears something is wrong with lead blocker tank Dixon. What else could go wrong for slip space All the time, why do you think now to probably advantageous for us not for you? I think we can win with only two players and now you can see the value of my client Are you ready to settle this can't you make him play? Okay, do we a second?  Right. That makes sense. I think he says makes sense And now I have to go play a game four and two thanks to him Oh, that means each player only has to take on to a poll his salary, but provide only half the benefit Then you can't be quiet. Don't even try that stuff on me. And that's the start of the match. I have to go I'm still a team player Well, that was the shortest game in the league's history with slip space going down nine to zero in straight rounds I guess the organization might want to think about but you guys were terrible One of the people on the other team because there were two people Then why did they look the same great now just practice with other things therapeutic for you wait If nothing's wrong with me, why do I need therapy? I said there was nothing wrong with you physically Hey coach come here don't reach him No, and I've been trying all morning our big negotiation with the commission is in an hour You can always represent yourself myself if I can represent myself You really think I'd be stuck on this lousy team. You're scared as a commissioner, but I am I'm scared of him And he's scared of my agent. That was my only hope. What if he doesn't take my deal? What if I'm on strike forever up striking? What if he won't let me he can't stop me from Flint if we need more players I can just make more of you with my magic cloning thing I think I may actually have a way out of this mess Tank come on. I need you to help me carry something. It's awesome. I love carrying stuff Thank you for watching this episode of red versus blue if you want to check out more go to rooster teeth It's an app. It's a website It's a lot of stuff


Hello my name is Adrian welcome to another video in the understanding thermodynamics video series. Today we are going to look at how we can solve for temperature pressure specific volume and quality for different scenarios. This video will look at typical examples of calculating the value of either pressure, temperature, volume, mass and quality and this will include for scenarios of ideal gases, real gases, saturated two phase liquid vapour systems and compressed liquids. So for the first question we need to calculate the mass of air in a room measuring three by four by two meters and the temperature is 25 degrees and the pressure is 87 kPa. Now there are more than one way to solve this problem but I chose this route as I wanted to demonstrate the use of the two equations that I'm going to use. The first step in solving a problem is to write down the key equation. The key equation usually contains the variable we are asked to determine. So we use the equation which states that the mass of air in the room is the total volume of the room divided by the specific volume of the air. We can calculate the volume of the room as the dimensions are given in the problem statement and the ideal gas law is valid for these conditions and can be used to calculate the specific volume. As the values of the two independent intenser variables are known the state is fixed and we can calculate the values of the required variables. Remember that the value of r the gas constant is different for every substance in this case. You can find this value in tables for ideal gases in textbooks or on the internet. Also remember when using the ideal gas law that you need to convert the temperature from degrees Celsius to Kelvin and we get an answer for specific volume of 0.983 cubic meters per kilogram and we can convert that to mass and we get an answer of 24.4 kilograms of air inside that room. Now before we get started on real gases liquids and the two-phase system problems there are two steps that you always need to do when tackling these problems. The first thing that you need to do is always determine the phase first which will then help you to use the appropriate table. Now in this question we need to determine the specific volume and quality of water at 10 kPa and 68 degrees Celsius. Now as I said we first need to determine the phase in order to know which table to use and because the values of temperature and pressure are given in the question we can use the pressure temperature diagram to determine the phase and you can see at 10 kPa and 68 degrees it falls in the superheated vapor region. If you do not have the graph with you you can always use the saturated water pressure table shown here because at 10 kPa saturation temperature is 45.81 degrees Celsius and the question tells us that the water is at 68 degrees meaning it's higher than the saturation temperature thus it is in the superheated vapor region. Now we can move on to use the superheated steam tables to determine the specific volume. So we will be using the superheated table superheated water and we will be looking at pressure of 10 kPa. So for our case where we want to know the specific volume at 68 degrees Celsius that is not shown on the tables that value is between 50 and 100 degrees which means we need to use interpolation to get the specific density at 68 degrees Celsius. Linear interpolation was introduced in a previous video so if you're unfamiliar with how to use interpolation go back to that video watch it and then come back to this problem. So through interpolation we can get the value of A which is 0.745 and now we can go and calculate the value for specific volume at 68 degrees Celsius and we get an answer of 15.612 cubic meters per kilogram. You are welcome to pause this video and see whether you can follow the logic and get the same value as me. Let's do another question. So now we need to go and determine the temperature and quality of water at 100 kPa with a specific volume of 0.1 cubic meters per kilogram. So first things first we need to determine the phase. Looking at the saturated water pressure table for 100 kPa we see that the specific volume given falls between these two values meaning that we have a two-phase mixture. This can also be shown graphically where at 100 kPa and 0.1 cubic meters per kilogram it falls inside the dome showing visually that it's in fact a two-phase mixture. So because it's two-phase mixture we immediately know that the temperature at 100 kPa is 99.61 degrees Celsius. Now we just need to calculate the quality. So for quality we can use this equation with the unknown being x. We know specific volume at saturated vapor and we know what's the specific volume at saturated liquid. We can get that from the tables and it is shown over here in the bottom. We can substitute the known values in and we can solve for x and we get x as 6.748 times 10 to the power of minus 3. You can pause this video and see if you can follow my steps and get the same answer. Now we need to determine the pressure and quality of water at 100 degrees Celsius with a specific volume of 1.672 cubic meters per kilogram. We can use the steam tables to determine if it is a two-phase mixture or not and if we go to 100 degrees Celsius and we can see that we have at saturated vapor a specific volume of 1.672 which is exactly the same as the one given to us. This means that the mixture is a saturated vapor with quality one. This can also be shown visually and you can see it touches the right side of the dome meaning that it is a saturated vapor with a quality one. So knowing that it is a saturated vapor we know the pressure at 100 degrees Celsius will be 101.42 kPa. Next question. Determine the specific volume and quality of water at 200 kPa and 100 degrees Celsius. Again the first thing you need to do is determine the phase. Now if we use our saturated water temperature table and we go down to 100 degrees Celsius we can see that the saturated pressure at 100 degrees Celsius is 101.42 kPa but the pressure given to us is 200 kPa meaning that this water is in fact subcooled water. This can be shown visually as well where at 100 degrees Celsius and 200 kPa we are in the compressed liquid or subcooled liquid region. Now while the specific volume of liquid water varies with temperature we assume that liquid water is incompressible. This means that the specific volume of liquid water at 200 kPa and 101.42 kPa will be the same as long as the temperature remains the same. Therefore for all compressed liquids we assume that the specific volume of the compressed liquid at temperature T is equal to the specific volume of the saturated liquid at the same temperature. Lastly quality is undefined because it is a subcooled liquid it is not in the two-phase region. In summary when solving for pressure temperature volume and quality you first need to determine the phase. Once you know the phase you can use the appropriate table and quality is only defined for a two-phase mixture. Hope you've enjoyed the video the course notes which these videos are based on is available on my website adreonsblog.com. I am also on Twitter my Twitter handle is at asv90 where you can ask me any questions and I'm more than happy to answer them. Thank you very much for watching and I will see you in the next video. Bye!


From where? Yep. Oh so Hello everyone The next talk is about base lock base 64 is not the encryption by this Virgo will come Hi, everyone and everyone hear me. I'm a little sick so Awesome, I see a thumbs up in the back of the room Welcome to base 64 is not encryption or a better story for Kubernetes and secrets My name is Seth Vargo. I'm a developer relations engineer at Google Small company probably haven't heard of them And I only have 30 minutes, so I'm kind of going to run through this quickly But if you have questions or if I say a word and you're not sure what it means Please come up to me afterwards and ask me or feel free to tweet me. That's my Twitter handle My direct messages are also open so if you don't feel comfortable saying something publicly you can always send me a private message Even if I don't follow you All right, so let's set some ground rules here. What is a secret? Everyone kind of has their own definition for the purpose of this talk I'm going to define a secret as credentials configurations API keys or other stuff that an application or service needs to run Either a build time or run time so when you compile the application or when it's running And we're specifically talking about secrets in the context of Kubernetes, right? There have been a lot of other security talks We're really just narrowing in on Kubernetes here And then we kind of have to ask ourselves a really obvious question. Why should we protect them? Like why not just use a config map for everything? Why do we even have secrets? How do we separate secrets from configuration? Well First secrets are a really attractive target for attackers They often are leaked in public repositories or open buckets on s3 or Google called storage And they often include overly broad permissions and they're often given to people who shouldn't have those permissions Like the CEO of the company should not have pseudo access to all of the machines yet. That's what happens And these users tend to leak these credentials everywhere So we need a really strong strategy for protecting secrets There are really four ways in which we can protect secrets we can audit them So this is kind of retroactively let's log every use of a secret Let's make sure that we can trace who's using a secret and when Encryption encryption in transit and at rest Rotation we know that it's not enough just to have a secret that secret also has to have a lifetime It can only live for you know a couple hours or a couple years And isolation right that's kind of principle of these privilege making sure that the the place where secrets are accessed Is not the same place that they're stored This talk is really focusing on the encryption bit That's really all we're going to talk about today There are a lot of things that we can talk about but we're kind of limited by time So let's talk about encryption There are four Layers of encryption that are kind of common The first is what we call application layer encryption Application layer encryption i'll talk about in more detail in the next slide then we have service level encryption File system encryption and machine level encryption. So machine level encryption is like where you have a hardware device like a tpu Operating system encryption something like bit locker or file vault on mac or windows And then service level encryption is where you have some kind of like operating system level encryption Application layer encryption is kind of the highest level of encryption that we have today Because it's applied at the earliest possible step in the encryption process And it provides encryption at a very granular level So when you think about something like file vault on osx or bit locker on windows That's a key that protects an entire file system And if an attacker is able to get that key either through brute force or social engineering They've decrypted the entire file system and all of the data is now available to them Whereas if you imagine each file in that operating system is encrypted with a unique key Even if they're able to brute force the the high level operating system level key They still need the lower level encryption keys in order to access individual files, right? And this is really the context of application layer encryption is that It it it doesn't just protect the data at rest. It also protects the data as it moves for the system So again taking that same example if I have some file system level security like bit locker or file vault If I take that file and move it to an nfs chair It's now available for anyone. It doesn't matter how secure my local file system is I've moved it to an insecure store However, if we were applying application layer encryption I've instead moved a bunch of encrypted bytes from one file system onto another And it still has the same level of security that it had before so Application layer encryption is just one level of encryption and generally we recommend using at least two layers of encryption So you want to use application layer encryption to protect things at the most granular level But then you also want to use file system encryption encrypted backups or even hardware level encryption with something like tpu's and secure boot So all of this background was to introduce you to kubernetes defaults. So how many people here are familiar with kubernetes? Cool, you're in the right room. How many people know I have four frowny phases Cool, you're about to learn So kubernetes is insecure by default and there's a star there, which I'll explain in a second But by default when you spin up a new kubernetes cluster, whether that's mini kube or kubadmin or local kube All of the secrets are stored in plain text and ecd ecd is kind of you can think of it as like the database that backs kubernetes It's a storage engine where most of the data stored in memory But they're only base 64 encoded.  See it's encoded. It's just upside down with two equal signs at the end Um, I'm glad some of you got that joke Right, so if an attacker which is represented by this raccoon on all of the slides has access to that ecd cluster All they have to do is turn that upside down and remove some equal signs And they have your credit card data right and it it can be a credit card It can be a service account a passport a social security number any type of secret right an api key whatever it might be I like to call this encryption And I know what you're thinking right number one. I'm not here to like talk badly about the kubernetes developers Right secrets were an afterthought and that's okay, and we're working on it number two, you're probably thinking well, no one is going to like leave their ecd cluster publicly exposed and I work for a company that doesn't let me show you this But there's a url and I highly recommend that after this talk You go ahead and take a look at how many ecd clusters are publicly accessible with no authentication So instead of just talking about it. I figured I'd show you this So let me jump out of the slides real quick and enter mirror mode all right So um, what I have here is I have a mini kube cluster because I wasn't sure how the internet was going to work But this could also work in a big kubernetes cluster So I'm going to use The secrets default context here And now I'm going to create a secret. So I'm going to say a kube cuddle create secret generic What should our secret be called? Demo, okay, cool. Y'all are real exciting here And our our secret will be I don't know password equals Fogs encryption, okay I type encryption so much. It's hard to type encryption Um, I can't type kube cuddle create secret generic Oh, I spelled literal wrong LIT wait, what? You're right. I can type There we go. Cool. So I've now created the secret. How many people feel secure? Cool, I'm going to make you feel even more insecure. So I'm going to cheat and exact rate into the ecd cluster, but There's a number of different ways you could do this So I'm now on the ecd node Um, this could be publicly exposed This could be a backup that you have restored because someone accidentally uploaded it to an s3 bucket fun fact That's what happened with tesla Just restore it point it to it and you're good to go. Um, so I'm going to run ecd cuddle get registry Secrets it's in the default namespace and we called it demo And look at that and craption is just like right there just in plain text You don't even need to use ecd cuddle like you could just search the file system for this if you knew what you were looking for Um, so y'all should be real scared now. All right, so What can we do to fix this? Well, the first thing we can do is explain envelope encryption to you because the rest of this talk won't make sense without talking about envelope encryption So what is envelope encryption? Well Normally we have two pieces of data A secret like a piece of data and a key With envelope encryption. We introduce another kind of key. So we have two keys We have a data encryption key the thing that encrypts our data And a key encryption key the thing that encrypts the key that encrypts our data. It's very meta so I prepared some animations for you and I hope you're impressed so Seriously this took forever so We use our data encryption key, which is the red key on the slide And we use it to encrypt our data and that gives us some bytes You can see that's denoted by the little red lock icon Then we take our key encryption key, which is the green one over there on the right And we encrypt our key with that key So the actual bytes that encrypted our credit card are now encrypted using this other key We then concatenate those two pieces of data together and we store them side by side using some type of separator In our storage system, whether that's a database or a file system Mobile phone, whatever it might be This is envelope encryption at a very very high level When we want the plain text data back We reverse this whole process. So we separate the pieces based on our separator We then use the key encryption key to decrypt the data encryption key Which we then use to decrypt The encrypted data to give us back the original plain text data I hope you like my animations Every time we encrypt a new piece of data, we generate a data encryption key That's usually the responsibility of the operating system or the software to generate this one time key So you generate some entropy, you generate a 32 bit key or a 32 byte key, you encrypt the data The key encryption key, the things over here on the right, they tend to live a little bit longer So a key encryption key might encrypt five or six or a hundred different data encryption keys or decks as we call them And we rotate them periodically And we store the version number inside of here so we can easily decrypt them Pull up encryption We generally generate a unique deck for each new data entry We can crypto shred if you don't know what that means Think gdpr I have a bunch of data and I need it revoked immediately instead of zeroing out a bunch of data We can just revoke the top level key encryption key and now all of that data is irrecoverable Except for brute force operations And it provides easy versioning and rotation We can rotate the key encryption keys and the data encryption keys separately So we don't have to maintain all of these kind of keys running around So kubernetes 1.7 introduced envelope encryption to try to solve this problem So there's this top level thing that you pass to the kubernetes api server when you start it called an encryption I mean an encryption configuration You give it the different providers you want and there's a number of different providers a cbc 256 gcm 256 secret box Etc You put the keys in this file And then you restart the kubernetes api server with this dash dash encryption dash provider dash config flag and all as well So it goes like this so the data comes into the kubernetes api server The data then goes to this encryption config first before it goes to ecd The encryption config encrypts it and then puts it in ecd, right? So we're we're secure. Yay. This talk is over except I have 15 minutes left So what happens if an attacker has access to ecd? Well, they have some encrypted data. That's great. Like they can't really do anything They can brute force decrypt it maybe but hopefully we've rotated our secrets by then But what happens if an attacker has access to our master node? so That encryption config lives in plain text on the master node Where the keys are? So any attacker worth their salt No pun intended Can grab grab access to that encryption config file, which if you remember from back here Has the keys in it So all we've done is given a really really big lul to a skilled attacker because they're thinking Oh, wow, you went to all of this effort and complicated your setup and added overhead Only for me to just decrypt it with an open ssl command Because the encryption keys and the encrypted data are stored in the same threat model We haven't actually improved our security for anything other than a script kitty So There are a number of drawbacks to this approach number one you have to generate those keys yourself so Anytime you want to rotate or manage keys you have to generate them yourselves So you need some type of entropy source Key management is your responsibility if you've ever actually done this It's really a pain in the butt. You have to restart the kube api server every time you add a new encryption key Which causes downtime or potential loss of service Rotation is a manual process. So you have to decide when you rotate how frequently you rotate for both the decks and the keks And there's no hsm integration So if you work in a large enterprise where you process credit cards or personal identifiable information You can't integrate with an hsm this way hardware security module But kind of as we talked about the biggest drawback is that it doesn't actually improve your security standpoint The plane the the plain text encryption keys are sitting right alongside the encrypted data so kubernetes 110 We're on 113 now for those playing along at home Introduced some happy faces. So let me tell you how kubernetes 1.10 makes this really great kubernetes 1.10 introduces this concept of a plugin For encryption particularly it uses kms plugins or key management service or key management provider plugins They operate on a unix socket so you can leverage unix file permissions to control access And they delegate access to a key management service outside the management layer of kubernetes So it looks like this the data comes in hits the kube api server It hits the encryption config and then instead of hitting a local key The encryption config uses that socket and some type of authentication to talk to an external kms provider Then encrypts the data in ecd. So if an attacker and then to reverse the process it has to go back to kms To get you the plain text data to go back. So if an attacker has access to the master node Or ecd They still don't have access to the keys because those are stored in a separate system For example, that system might be something like google cloud kms or amazon kms or even something like hashicorp vault And there are existing plugins Kms plugins for kubernetes is that do this for you. So if you want to take a picture of a slide, this is a good one So there's one that will integrate with google cloud kms. There's one that will integrate with azure I actually think rita zang is here. She's done a ton of work on that and a bunch of other stuff with flex volumes There's an dwc encryption provider and there's one that i'll demo in a second, which is the oracle kubernetes vault kms plugin If you're on google cloud, so if you're running on gke google kubernetes engine We actually have a an option that will go into beta on tuesday It's an alpha right now, but you can still use it that does this for you So when you spin up a cluster or in the ui you can specify a kms key and we'll set up all of this for you So this is automatically done. We already do a bunch of stuff to protect the cluster This gives you full control over the key and the rotation and we'll do auto rotation of those keys for you But it introduces a new problem, which is how do you authenticate your kubernetes nodes to talk to the kms provider How do you and it's called the initial secret problem or the first secret problem? And generally iam is the way that you do this if you're on a cloud provider So identity and access management on gcp that service accounts on aws That's either arns or access tokens But generally you give the master node either a service account credential and access token Or you grant the machine that it's running on permission to talk to the api and you can revoke that at any time So you delegate pam to the cloud provider through iam And then you separate concerns so the ecd nodes the the physical vms that ecd is running on Does not get permission to talk to the kms provider You only give that to the api server nodes and this separates concerns So that an attacker has to compromise multiple systems in order to decrypt these values And you can revoke access to the kms keys at any time So what if you're not on a cloud provider or what if you already have a custom managed You know kubernetes setup and you're not ready to move to a cloud provider managed one where these plugins already exist Well, this is where something like vault can come in so Instead of the kms provider being a third party kms provider like a google cloud kms Instead we can delegate this to vault and our friends over at oracle have built a really helpful plugin that runs in kubernetes That helps us delegate this Encryption and decryption to vault again. This is envelope encryption. So in vault. There's this thing called the transit backend It's basically key management as a service vault generates a key kubernetes then encrypts uses that key to encrypt another key the data encryption key which it uses to encrypt data at rest So what does that look like? So let me jump back over here My cheat sheet All right kube cuddle config Use context So switch to a new kubernetes cluster this kubernetes cluster has the Vault kms encryption already set up and ready to go and that encryption config So i'm going to go ahead and create that same secret And now when we exec into se d hopefully se d cuddle get registry secrets Default demo, you'll notice that that's not plain text anymore Um, that's a bunch of gargly goop Um, but that's encrypted and it's encrypted in transit with tls But it's encrypted at rest with this aes 256 bit cbc key that vault is managing and vault is being run outside of kubernetes right now So even if you were to compromise this se d cluster, you can't actually decrypt this data by anything other than a brute force attack Um, and all of this is open source and there's a ton of guides and documentation and blog posts out there Including these slides which will be up on the internet shortly that will help you get this stuff set up so to conclude kubernetes can take us from sad to happy with respect to secrets management Use at least two layers of encryption application layer encryption and hardware layer encryption rotate your keys regularly Leverage envelope encryption. It's the fastest and most scalable way to doing data encryption that we have today And protect kubernetes secrets using an external kms provider, whether that's a cloud provider or something like hashicorp vault Thank you, uh, i'll go back because there are people taking pictures of this slide So are there any questions? Hello, so What if I run etcd on the master nodes? That means that I basically need to provide iam permissions for the master nodes and then if I compromise the master Basically, I can decrypt anything by knowing the Uh key id if it's kms for example, right? Right, so the the question is if I run etcd on the same nodes that I run the kubernetes Yes, so this model like suggests us not to run etcd on the same nodes like on the master nodes, right? So we need to the couple that would have like maximum security. Yes, that would increase your security Much more than running them side by side okay But uh, do you have like any suggestions what to do if I have etcd running on my master nodes and basically To use like amazon kms or google kms I need to provide like a service account integrated into Machines metadata right or iam role integrated into machines metadata. What can I do to increase my security? So even if you use an external kms provider When etcd is on the master node with the kube api server you've still increased your security from When the keys live in plain text because you can revoke that service account and those credentials Without taking down all of your production infrastructure And also an attacker can't decrypt your data offline So you've increased your security posture a little bit because in the in the previous model where the keys are just stored in plain text An attacker can just do a full file system dump And now they can like run away with your data and decrypt it offline Whereas with the kms provider if you have some audit logging and those things set up by default If you detect some anomalies you can revoke access to that key And now an attacker can't decrypt that data because you've broken the link to kms So that's really the only thing if you haven't separated at cd from the master nodes That's the only thing you've improved is the ability to revoke access and prevent offline decryption. Okay, thanks Other questions There's no other questions Okay, thank you for the talk Okay, so for example, I have a huge kubernetes cluster for 1000 nodes and have A lot of data on the tcd nodes, but if I want to change my kms key or whatever So should I re-encrypt all this data? How is this process going on? Yeah, so in the question is what should I do with my existing data that may or may not be encrypted in atcd Um, when you generate that encryption provider config, let me pull up a slide that has one on it Um, so providers is an array The first item in that array is what is used to encrypt all data Everything else is try it tries to decrypt the data So, uh, there's one of them called identity, which just takes an empty object That will allow you to decrypt all of the plain text objects that you currently have an atcd Then you can do like a kube cuddle replace all On all of your secrets and it'll take a little bit if you have 1000 nodes But it'll go through and encrypt them all alternatively you can just choose to Um just choose to encrypt things going forward and how you know if you rotate your pot