All right, we are live here today. This is the OpenShift Commons Briefings Operator Hours. And today we have some very special guests here from GitLab. So we've got Darren Eastman. He's a Senior Product Manager. Hey, Darren, how are you? Hi. And then we've got Pete Rahman, who's the Federal Solutions Architect. And we've been talking this morning while we've been getting ready to get going about is winter in fact over? And can we put the snowblowers away and so forth? So probably won't be part of the topics for the conversation today, but it's certainly something that I'm trying to figure out. Anywho, gentlemen, welcome to our show here today. How are you? Great, thanks a bunch. Appreciate it, Michael. Thanks for having us. Thank you for having us. Where do you come from? You both are at GitLab. Pete, you're an SA, specifically in the federal space. What do you do there at GitLab besides being an SA? Yeah, so I am a part of the channel team. So my focus is on alliances such as Red Hat and also work with FSIs and other partners as well. So I'm in the federal side, but I'm on the channel team on the federal team. Okay, and what makes you an expert on being able to talk about GitLab and GitRunner and everything else? So this is my third year here. So I feel like I've got a little bit of time under my belt. And as well, my focus being on the channel team, working with Red Hat has been on OpenShift for the past few months or actually longer than that. My participation has been writing a lot of documentation, doing a lot of Red Hat slash OpenShift specific demos that relate GitLab to OpenShift. So that's been, I would say probably the primary focus of my role within the last year. Okay, great. Darren, how about yourself? What do you focus on there at GitLab? Tell us a little bit something about you. Yeah, thanks Michael. Hi, I'm Darren Eastman. So I joined GitLab in September of 2019, specifically as a product manager for GitLab Runner, which we'll be chatting about today. GitLab Runner is the engine that makes GitLab CI work. What makes me an expert? I guess I've been in an interest here at GitLab for just a year and a half now and working in all things Runner, which is a very interesting space because we get to touch a number of different technologies such as OpenShift. Then working with the Red Hat and OpenShift team now, I think very closely on getting the Runner operator going. Maybe for the past six or eight months. And so I wouldn't say I'm an expert, but I certainly have put it from a lot of our customers and users in terms of the features and capabilities that they're looking for. And so if that makes me an expert, we'll see. Okay, well, I would imagine that your managers and your managers, managers wouldn't have signed you up to be our victim for the show here today if you folks weren't pretty comfortable with that. So GitLab, we've been working with your team to get your operator built, tested and certified for OpenShift. Is that the, that's the GitLab Runner? That's right, that's the first one we've done. So what's the difference between the GitLab Runner and the GitLab Server, for example? That's a great question. Well, GitLab Server is, of course, the entire platform is the whole thing that makes GitLab. It is GitLab, right? GitLab Runner, it's a simple way to kind of think about it, that I kind of do, I think about it, is like it's the engine, it's the engine that makes GitLab continuous integration work. So, and continuous integration or CI, and you know, shortened in the industry, it's kind of what's making this transformation in terms of software development, in terms of velocity work, right? And so the runner is the thing that basically executes your CI jobs on a platform of choice, like in this case, Red Hat OpenShift. So it's the engine that makes the app work. It's a little thing that, you know, that basically the little engine I could, if you will. Okay, and customers can use this on-prem, public cloud, hybrid. What are the deployment modes for it? That's a great question. And that's kind of the beauty of GitLab and GitLab Runner. So in terms of GitLab Runner itself, you've made different choices. As a GitLab user or a customer, I guess kind of just stepping back, you can subscribe to our GitLab SaaS offering. So if you're in your security requirements or compliance requirements allow for it, you can just basically subscribe to GitLab SaaS. You don't actually have to install an on-premise version of GitLab or GitLab Runner. But as you well know, as everyone in the call well knows, there are different security and compliance and set up requirements. So with that, you have the flexibility of being able to install both GitLab and the GitLab Runner on-prem in the cloud, different types of choice and so on and so forth. Okay, so present company excluded with you and Pete, tell me what business problems GitLab solves for customers? Meaning like at a very high level, how do people survive without GitLab? What does it do? I mean, if someone said to me, hey, great, awesome, so you work at Red Hat, what does Red Hat do? I would say, well, we made the first enterprise commercially-supportable Linux distribution which helped our customers migrate off of proprietary Spark, Solaris platforms years ago. And then through acquisitions and technology development, we've built open stack distributions which help customers in the telco space and these days, Ansible and management and certainly OpenShift as a Kubernetes orchestration platform. What about GitLab? Like, what do you do? What problems do you solve and why are you so terrific for customers? That's a great question. In the simplest term, I'm gonna use something that I said for one of our CFOs and a cheddar he had. In the simplest terms, GitLab helps teams collaborate on software development and project management. And it's very simplest terms, right? Basically, GitLab is the one platform, the one tooling of choice for doing software development. So it's an enabler of innovation. And if you kind of think back, Michael, to maybe 10, 15, 20 years ago, how we develop software back then is completely different from how we develop software now and our expectations in terms of users as well as our executives in terms of how fast we should innovate, how fast we should deliver new features to market has completely changed. And so GitLab is that one software platform that is revolutionizing how you think about developing software. So instead of having multiple point solutions for project management, for software configuration management, for security testing, for CI CD, you have everything in one platform, in one collaboration tool. So that's basically what we solve the problem of innovating, I think, in the 21st century. That's what we're here to do. Okay. I wanted to remind you that we are live here, obviously, on our bridge and this is being picked up by Twitch and it is also being simulcast on Facebook Live and YouTube Live as well. So if people either on Facebook or YouTube have questions for Pete or Darren, please put it into the chat box and our producers will make sure that those questions get picked up and brought over here and we can get those addressed. And the same thing for those of you who are on the bridge here, please drop your questions into chat. Having said that, Pete, I'll turn it over to you. Very good. All right, so I'm gonna go ahead and share my screen if that's all right. Oh, if it's coming through, okay. All right. Are we, do you see my screen okay? I can see your screen. How many times a day do you folks hear? Can you see my screen and or, hey, you're on mute. Well, back in the day of the telephone, we'd always start with hello. I guess currently with Zoom, we always start with can you see my screen? So I think that's just the way it is now, right? I'm making T-shirts that basically has a Red Hat logo on it here and then there's gonna be two variants. One's gonna say, can you see my screen? And then the other one's gonna say, you're on mute. And so I'm making these and I'm gonna ship these out to our software partners. And I should say before you get going, the reason why GitLab is here today is because my team works with software companies to test and certify their software for the Red Hat portfolio, whether it's Linux or OpenStack or OpenShift and Ansible and so forth.  When we get done, if you guys want, I'd like to send you some of these shirts and you can use them on your Zoom conferences and so forth. We even won for your manager, Pete.  Anyways, I digress. Michael, I would wear that with pride. So that's a fantastic idea. I like that. So sign me up. So yes, we can see your screen. All right, great. So let me just, you know, before I dive into this, let me explain what the object here is. Darren did a great job of explaining the runner versus the server. And I was going to kind of go along those same lines where we have two primary pieces of software, the runner and the server. And, you know, the server is kind of the brains of the operation, whereas the runner is the workhorse of the operation. And what I'm going to show you today is basically starting off in the OCP console, we're going to create a namespace. We're going to create a new GitLab project. We're going to install a runner and then we're going to actually create a pipeline using that runner and then deploy back out to OpenShift. And, you know, to kind of show you how GitLab works and how it works with OpenShift in specific. And then, you know, we'll hopefully get our application provisioned towards the end. And let me... So, Pete, while you're running your demo here, you want us to hold questions to the end and we'll just, we'll catalog them and address them when you're done with this. Yeah, that'll work for you. That way, Darren and I can attack the questions as they come in afterwards. Like I said, so we're going to start off within OCP.  So, first, we're going to go ahead and create a namespace for us to work in. And again, this is going to be for our fictitious company called Tanuki Tech. And what we're doing is we're creating an application which is going to be our portal that we're going to use for our fictitious company. So, once we got the namespace created, we're going to go straight to Operator Hub and we're going to search for GitLab. And you can see that we're, you know, making use of the correct namespace there so that we install it in the right namespace. We're going to go with the GitLab operator and, again, make sure that we're in the right namespace. Go ahead and install it. And so, basically, what this is doing is it's installing the operator as a prerequisite for us to actually install the runner in a little bit. So, once we have this operator installed, let's just go ahead and take a peek at it real fast and make sure everything's out there. We'll go into installed operators. We see it there. Switch over to the developer view and we can see that the operator is there. So, everything's fine and dandy. So, what we're going to do now is we're going to jump into the GitLab side of the house and we're going to actually start creating a project. And you're going to see, once we jump over there, that there's many ways to start a project. We're going to go ahead with importing a project which, again, many ways to import projects into GitLab. We're going to do a repo by URL. So, this is an existing project that's out there for our portal. We'll give it a project name, project slug and we'll change the visibility level so that anybody that's on this instance of GitLab can see this project. And now we're basically pulling in that repo into the GitLab repo. So, now that we've got the project set up, it's time for us to go ahead and start building, and this is where the fun stuff starts. This is where we start building the runners, actually installing them. So, by default, GitLab allows you to utilize shared runners throughout an instance of GitLab. We're not going to use that for right now, so I'm going to go ahead and disable that. And what we are going to do is make use of the area, the section that allows us to create a runner manually, because, like I said, runners in the server instance are two different pieces of software. Generally speaking, you're going to run the runner on a different virtual machine or different piece of hardware just to keep that utilization off the server. So, we're going to grab this token, and what I did is I actually cut and pasted it into a command that we're going to use in a little bit. And first, we're going to switch over to the correct project and excuse my slow typing. That's one thing that I was never fantastic at. And to save you the pain of watching me type a long command, I went ahead and copied this next command, and you'll see at the very end of this command, that is the token that I just grabbed from the GitLab side. So, again, this is what associates the runner that's going to be on OpenShift to my specific project. Now, runners can be done at different levels, you know, group level, at the instance level, but what I'm creating right now is a runner specific to my project. And so, that was the secret that we've done, and we're going to create a CRD file here, which I already did beforehand, so you wouldn't have to watch me actually type this.  We thank you for that, Pete. Yeah, well, yes, yeah, trust me on that one. So, let's go ahead and apply that and basically start building out the runner. Now, with that said, if I pop over to the OpenShift side, you're gonna see that we're spinning up a runner as we speak, so not only is this, you know, it's taking the CRD file that we used, it's building the runner based on that, and it's also registering it with GitLab. So, it's basically reaching out to the GitLab instance, basically straight to the product, or on project, and registering it with that project. So, now if I jump over to the developer viewer fast, you can see we've got our operator, we've got our runner spun up. Though it looks like we're pretty good from the OpenShift side, let's check the GitLab side as well. And like I said, so we basically registered that runner with GitLab. So now, when you go to available specific runners, you can see that there's a brand new runner there. That's the one that I just created. I'm not gonna use tags in this demo, so I'm gonna uncheck that box. And I also kinda like to track, you know, runners and make sure that I have my runners assigned to me with my name, so I'm gonna change the description out. And let's just go ahead and make sure that the changes have taken for the runner. That looks good. So, at this point, we now have a fully functioning runner, right? That's sitting out on OpenShift, ready to start taking a pipeline. Before I do that though, I did wanna dive into a very important piece of the software which is our GitLab CI YAML file. So, when you start talking about pipelines, you're gonna see that there are stages and jobs. And this is what defines those stages. It defines what's in a stage. It defines a job. It defines what's in the job. When the job's gonna be run, how it's gonna be run, what images it's using. You can see here there's scripting commands. There you see a series of OC commands in here. So, this is, and I'll come back to this in a little bit, but that's what really drives this next part which is running the pipeline. So, we're gonna dive into this. We're gonna go ahead and run a pipeline. So, we're gonna run it on master. And this is the pipeline that that CI YAML file built, right? So, you got the four stages that go across from left to right and then you've got the jobs within each stage. Now, if you were to, this is a very simplistic pipeline. If you were to add things like security scanning, license scanning, you would basically use that CI YAML file that I showed you and build those parts into these stages, right? You might create a new stage called scanning or something like that where you add these other stages into your pipeline.  Therefore, giving you that ability to run all the scans that you need to run each time. You'll see that I did set this up to be a manual deploy just because I like to have that manual step before I actually deploy anything out into production. And what it's doing right now is it's basically doing just that, right? So, we are taking my application, my portal and deploying it out to our OpenShift instance. So, there it goes. It looks like it's been deployed. If we go over here, we can see that we now have the application out there. And we'll give it a second to spin up. And what's gonna happen is basically, it's gonna bring up our Tanuki Tech portal that we utilize for our fictitious work that we do at our fictitious company. All right, let's go ahead and fire it up, see if it works. So, there it is. So, we've got our portal. Everything looks fantastic. But there is a problem. Again, I've told you my typing skills aren't great. It looks like I fat-fingered something. So, let's go through this. And I'm gonna show you what GitLab does in terms of being able to handle the entire SDLC process within a single product. So, what we do is we use these things called issues, right? So, we go into our issue tracker. We have our issue boards. And this allows us to open up issues. An issue is something like opening up a feature enhancement request or a bug fix or something along those lines. And that's, this is where we manage those. So, maybe a tester is inputting this or somebody from a project team. So, we're gonna go ahead and open up an issue and related to this problem that we found on the website. We'll submit an issue, the issue. And, excuse me, immediately to the right-hand side, you'll see that there's various things that I can do. I'm basically assigning to this to myself just because that's who's gonna fix it. But, basically, this can be an assignee to a person or persons, multiple people, that might be actually working on this problem. You can do other things like assigning it to Epic, Milestone, work on time tracking, give it a due date. We're also gonna work with labels here. So, these are customizable labels. I'll give it a critical status so that that way, you can keep your issues labeled and organized in that way. So, diving actually into the issue, we can see a little bit more about the meat of the problem. And this is where you get a little bit descriptive. In case I'm not the person that's assigned to it, we need to make sure that the other person understands what's going on in a better scenario, in a better way. What you didn't see me do was I got a screenshot of that problem on the previous screen with the portal. And what we can do is basically take that screenshot and literally just drag and drop it into the issue, which allows us to have that picture, pictures worth a thousand words sort of a thing. So, let's go ahead and look at the preview. There it is. So, that way whoever gets this issue will understand a little bit better what to look for and what to fix. And that said, so this is a starting point for whoever put in the issue and that collaboration now begins from that issue. But then now that I'm gonna start to work on it, I'm gonna go ahead and create a merge request. The merge request is where everything, all the magic really starts to happen here, all the work really begins. You're gonna see things like commits and changes and some other info in there. What we're doing right now is we're building out a separate branch for us to actually work on. So, we don't wanna be working on master, impacting production in any way. So GitLab on the background is actually spinning up a separate bubble if you will for us to do all of our testing and viewing of the application. You'll also see there that it closes number one, which is the first issue here. So, we stay directly attached to that first issue through the merge request. So, that way there's no orphan issues, right? So, once we do this merge, it's gonna close out the issue and everything will be done so that person that's working on it can move on to the next job. And like I said, this merge request is gonna be a record of all the collaboration that occurs throughout this change. So, you can see here that we're actually, GitLab's automatically kicked off a process in the background to create a new branch, again, a sandbox so that we can do our work without impacting any production. And it'll also make use of an approval process for us to put the changes into production. But for now, now that we've got that ready for us to start working, let's start working. Now, obviously, most people might use their own local applications to do the web work or do the programming work. So, here we're using GitLab's very capable web IDE which comes as a part of the product. So, basically allows me to do the work, let's say from even an iPad while I'm on the road. So, in case you can't get to your local IDE, which is really nice. Once we make the change, we go to a split screen and the split screen allows us to see the before and after making sure that what we did is the right changes and we didn't do any inadvertent kind of changes on the side. We'll go ahead and give it a commit message and we're gonna go ahead and commit it. So, again, GitLab is very good at automating the process and making things quicker. And what you're gonna see here, if you look on the very bottom left corner there, you're gonna see us kick off a new pipeline. There it goes. We'll jump into that pipeline real fast. And so what's happening here is we're running another pipeline. Again, these pipelines are customizable to do whatever you need to do, whatever scripts you need to do, whatever scans you need to do. This is a very simplistic one. And what we're doing is deploying the application back into its own bubble. So, we're not going to production at this point, but we are taking the changes that we've made and deploying that into our bubble right now for testing. And this is a big advantage, particularly if you're gonna have approvers, approving before this application goes live. So, going back into the merger quest, I told you, this is where the rubber hits the road, sort of a thing. This is, if I was an approver, I would come in here and I'd have these various information for me to look at, such as the commits that had occurred, right? So, you only saw me do one commit. So, it's literally just that one commit at the time. You see the pipelines. And the great part about this is, if there's any part of the pipeline that didn't complete, we can hover over things and drill down on things and see what failed, how it failed, why it failed, we can get into the raw output to really start figuring out what happened. In this case, you could see that my great programming skills went straight through with no problems. You can also see the changes that were made. So, again, this is great from an approver standpoint, if they want to see all those bits of information. As, in terms of the actual approvers themselves, it can be a single approver, multiple approvers. It could be a group of people and maybe, let's say, you know, seven out of 10 people need to approve this before it goes through sort of a thing. So, just a way to keep an eye on the project and, you know, keep that authority in check. In this case, though, I'm not using any approvers. I'm just going straight through, just to save a little bit of time. So, I'm gonna go ahead and it looks like I'm ready. So, I'm gonna go ahead and do the merge. And what we're gonna do is we'll delete out the source branch, keep things clean, and we'll go ahead and merge the software. And, again, you can see the history is building out in the merge request, which, you know, you'll probably see a lot more collaboration going on in here. In realized scenarios, you would see more pipelines, more commits and a lot more activity in terms of collaboration here. We've kicked off another pipeline.  And it's, you know, it's a critical piece in the sense that, again, if you wanted to add your security scans, your license scans, or, you know, modify the jobs, do certain things, you know, this is how you do it and where you would do it. You could see on the very bottom there, you see when is manual, for instance, that, you know, that could be switched to automatic or just removed out to allow the process to go all the way through without that manual step that I added in. It's a sanity thing for me. I just like to be able to push the manual button right there as needed. So, okay, so what's happening here is we're actually deploying that out to our production instance. So now it's going back out to our open shift instance as a repaired application. So now that it's completed, it looks like everything is completed okay. You can see that the merge requests are gone. The one is closed out. And that, in turn, if we go into our issue boards, you can see it's, the issue is no longer open. So we keep everything integrated with each other so that that way, you know, from a project management standpoint, everything's nice and clean. And we'll head back to open shift. And we'll check to see how our application is doing. How often does your demo fail, Pete? With the demo gods, you know, it's, we do pretty good. I will say that the unfortunate part is I'm actually running OpenShift on my laptop in a CRC image. And so sometimes my laptop screams for help, but generally speaking, we're pretty good. Yeah, I saw that in the comments when you were in the config files there, it was like Pete's MacBook 16 or something, right? Yeah, I don't have an OpenShift instance available to me at the time, we are building that. But just to recap kind of, you know, what we did there is, you know, we started off an OpenShift, we created a namespace, then we added the operator in, we popped over to GitLab, we created a new project, and from there we created the new runner, put that into OpenShift. We then were able to provision our first version of the application out to OpenShift. Once we did that, you know, then that's where we kind of went through the entire software development lifecycle within a single application, where, you know, we saw that there was a problem, we opened up an issue, we went immediately into the merge request to work on that problem, where we did all sorts of, you know, security scanning, license scanning, and all the tests that we need to run on those things, we went through an approval process. Once that was allowed, then we basically provisioned that application back out to OpenShift.  And I guess that's kind of it, Michael. So I have a couple of burning questions here for you.  I am not. Was that an option? No, I just, I mean, it's almost like this was an advertisement for Red Hat OpenShift.  So it was all over the place in a good way or a bad way? Well, in a good way, but I mean, it's like, you know, does GitLab run on other platforms? And if so, what are they? Yeah, absolutely. Yeah, so, go ahead, Darren.  Yeah, so we definitely do. We have many deployment options available. So obviously the various Linux instances, but, you know, as well as, you know, we have SaaS available as well. So you can use gitlab.com. You can use deploy GitLab out in AWS, GCP, OpenShift, obviously. So we've got every option as well as standalone option too. So I'm in the federal space. So the majority of what I see is really standalone instances. So yeah, so we definitely have that ability.  I kind of want to point that as a very big benefit of GitLab. So as a standalone product, we are, you know, fantastic. We cover the entire life cycle, but in reality though, we need to be able to integrate with other products and integrate well with other products. So you were saying, you know, hey, if you were talking about OpenShift this, OpenShift that, well, that was actually by design because, you know, we do integrate very well with a lot of products. And OpenShift is definitely one. You were very big, your Red Hat's very big to us. We're a very big partner of you and, you know, we want to make it clear that, you know, we integrate well with other products. Okay. Well, thank you for that. So, Darren, there's the GitLab Runner, right? Which was, you folks certified your operator for use with OpenShift, I think like what? Two or three weeks ago or something? Yeah, that's all right, yep. How does that make GitLab better, having that operator? Honestly, it makes me think GitLab better. I think that's kind of picked up on what Peach has said, right? GitLab's vision is to develop this platform where, again, you have one platform for your entire software development lifecycle. The reality of the computing industry is we've got multiple types of computing platforms, Red Hat OpenShift on-prem, Red Hat OpenShift in the cloud, right? Different public cloud providers, IBM, mainframes and so on. And so we have to meet those customers or users where they're at. So the GitLab Runner on OpenShift basically just enables that on OpenShift. You're asking the question of Peach earlier in terms of other platforms that we support. The Runner, for example, you can currently, today, you can host the Runner that CI Engine for GitLab on an IBM Z mainframe. You can host it on public cloud platforms. So that's really necessary to make it better. We're just making sure that we meet our customers where they're at, because we know our customers and users have different environments that they support as they continue their evolution, as they continue their digital transformation. Okay, I'm gonna, we just got our first question from Greg Weyer. But before we go to that, I'm gonna just steal the screen here. And I'm gonna now ask the question, can you see my screen? That's brilliant. When can I get my T-shirt? That's my question. So I will, we'll get like 10 or 15 of those made for your team and we'll ship them over to you. We just need your logo. What I'm gonna say though, is Greg Weyer, you just asked the first question. So we're gonna ship you one of these Red Hat GitLab shirts as well. You can either have, can you see my screen? Or we have the second version, which is gonna be, you're on mute. So if we have any more interesting questions that people wanna ask, don't be shy. Pop them into chat and we'll make sure we get you your very own GitLab Red Hat. Can you see my screen shirt? I'm gonna stop sharing now and we're gonna go back to the question. And by the way, Greg Weyer, shoot me an email. It's just wait at redhat.com, W-A-I-T-E at redhat.com. And hopefully you're in North America. I don't think we're gonna be shipping these, these are limited edition 2021 shirts, by the way. We'll do another one for 2022, but send me your mailing address and we'll get a shirt off to you and anyone else. Okay, Greg Weyer, will residual files on the runner be cleared between jobs? Or do you have to ensure everything is removed in the CI script? I was gonna ask the very same question, but I'm glad that he did. Yeah, the answer is yes. So the answer to the question is yes. We also have a feature that we're currently working on in a next release to also do some additional cleanup of the pods on OpenShift, or specifically the runner pods on OpenShift, but at a high level, to Greg's question, the answer is yes. So residual files will be cleaned up. Will be cleaned up. Okay. Anyway, so we were talking about the runner was certified not that long ago. What about the server and how does that... So if a customer is running OpenShift in their environment, right? Whether it's in public cloud, multi-cloud, on-premise, whatever, they can use the runner operator. What's the relationship between the server and OpenShift? Where's that? Is that all in your data centers? And is that the SAS component of it, which the runner, like say, phones home to that, or how does that work? Yeah, I guess I can start and Pete, you can jump in. At a high level, I believe in Pete's demo, Pete, keep me honest here, the GitLab server that Pete was working on was probably the GitLab SAS version, right? So Pete was on GitLab SAS, GitLab.com. And what's interesting in Pete's demo, he was then connecting to a runner operator plus runner that he installed in an OpenShift environment. So you can imagine as a user or a customer that could be your own OpenShift environment. So the relationship is always, you have a GitLab server somewhere if either GitLab SAS or a GitLab server that you install yourself and you associate a GitLab server with a runner. So that's the relationship. So today, as you rightly pointed out, Michael, the runner operator and the runner is available to be installed in OpenShift. GitLab server is going to be coming soon. I believe, Pete, we are targeting that 1.1, which is our April release, so that folks that may not be able to use GitLab SAS can leverage the GitLab server in OpenShift. Yeah, that's correct. And that's something that I've been pushing for very hard. So I'm very excited to see that. But yes, you are right, Darren. So Michael, in this specific demo, it was a SAS instance of GitLab out in Internetland. And the interesting part is the OpenShift server in this instance is behind a firewall. I installed the GitLab runner on that instance of OpenShift. And the way that the runner works is it actually pulls the GitLab server, right? So it's an outbound communication to the SAS instance of GitLab to see if there's any jobs awaiting. If there is, it gets the information and runs that job. And then it was able to push that workload over to my OpenShift instance in this instance. So I guess the answer to your question is it's very configurable in the way that you want to set up your environment. As long as there's communication paths, in the federal space, sometimes there's hurdles to jump through in terms of communication paths. But it'll work SAS on-prem, however you want to set it up. Do you see that there's a different set of roles and requirements in the federal space?  Or does everyone just trust the interweb these days? So this is more of a, yeah, it's a preference things, I guess, kind of so to speak, where they're keeping it on-premise in order for them to go anywhere SAS that needs to be bed ramped in order for them to be allowed to use that service. So I'm not sitting here saying that they do not use online services or SAS services. I'm just saying from a GitLab standpoint, the majority of the deployments that we see are on-premise in the federal space. Okay, fair enough. Looks like we have another question come in here from, is it Meek310 or Meeko31? He says, I've had no luck running GitLab server on OCP without root. Goes against the NOID compliance. Will there be a light version that complies maybe? And by the way, Meeko, make sure you shoot me your contact information and when we get these shirts made, we'll shoot one out off to you. And let me know in your email if you're a large, medium, or small or whatever, so. I'm just gonna back to you. Yeah, that's a great question, Meeko. I need to double check exactly how we're developing the current version of the GitLab server for OpenShift. I believe that the NOID requirements should be in there, but I'll need to double check that. So Meeko, I'll grab your information from Michael as well and maybe I'll connect with you offline just to make sure that I answered the question accurately in terms of are we taking care of the NOID pieces? If you were interested, Meeko, we did take care of it for the runner. So the runner is compliant with all of the NOID stuff, but I'll double check for you on the server side. And if I could, one other thing I'd like to add is at GitLab, we try to be as transparent as possible. And when I say that, I'm referring to our product, for instance. You have the ability to go out to gitlab.com and actually search for the issues in which we're working on these. So you might see feature requests or enhancement requests out there. So my urge to you is go out there and do a search for any UID and see what the product or the status is. I know that we have an EPIC out there, for instance, that we are working on, which is publicly available, which you can see all the statuses of everything that's going on. So you definitely have all that information available to your fingertips. Thank you, that's a great point. I'm dropping that EPIC into the chat window if folks are interested in taking a look. Yeah, good idea. Now, what is that that you just linked in there? So basically that is actually the EPIC and actually this is a good example of how we use GitLab to collaborate on software. So this EPIC is the EPIC that's around GitLab being ready, the GitLab server being available in OpenShift, in beta, in our FlixNet 1.1 release. So Michael, you can take a look. It's completely open and transparent, but in this EPIC we describe the scope of the project and then there are a whole number of related issues and merge requests and so forth. And so this is kind of telling the world what we're actually working on, what features will actually be there in the server version of GitLab, OpenShift, et cetera, et cetera. Gotcha. Yeah, I'm actually just scanning over it right now very, very briefly. What's the issue of not requiring a root access? Meaning, does this have to be set up by someone with root? It's a deep OpenShift question. There are very specific rules in OpenShift in regards to using NuIND and that's kind of the key, that's really, it's really a Red Hat OpenShift thing in terms of the sort of the NuIND requirement. Not mean to go like too deep into it, but that's leaving it at a very high level. Okay, we've got a couple more questions here. One from Mikey, are Red Hat actions supported? I'm not sure. What are Red Hat actions actually? I'm not sure I'm familiar with Red Hat actions. Red Hat dash actions. By the way, ladies and gentlemen, welcome to our show today. This is Stump the Product Manager. My name is Mike, wait for Red Hat. So Mike, I can actually answer that. The Red Hat actions are actually GitHub actions. So I'm not sure where y'all stand with GitHub actions if there's any compatibility there. Oh, so you're talking about GitHub actions. Okay, well, no, it's definitely two different products, products in this case. I mean, GitHub actions is how GitHub has implemented CICD on the GitHub platform. So two different product streets at this point, to be quite honest. I think it's a sympathy with the answer to that. Two different products from two different companies. Exactly. But presumably customers have a mix of just about everything out there. So I might ask the question, then I don't know you tell me, but we're talking about large customers, whether it's in the federal space or financial services, presumably there's different groups within side different companies that are using different DevOps platforms. So you probably see some customers, yes or no, that have GitLab, GitHub and or others, yes? Yeah, absolutely. You're gonna find, and stepping back, that's the goal of GitHub, right? Is that if the idea is, and what we're seeing with other companies that have adopted GitLab in total, is that because you now have a single tool chain, you no longer have the need to say maintain a Jenkins or maintain something else to do your DevOps or maintain a different tool for project management. But you're right, you'll go into an existing organization today and team A might be on Jenkins, team B might be on GitHub, team C might be on something else. Absolutely right. But if you start thinking about adopting GitLab, then you can actually start thinking about getting all of those tool chains out of your organization, out of your shop and doing all of your self-development in just GitLab. Okay. We had another question come in from YouTube, wave to YouTubers. Hello. The question is from Preston Davis. Does GitLab run on GovCloud? So Darren, I guess I'll take that one. The answer is yes, we do. And not only that, we somewhat recently announced that GitLab is available in the AWS Marketplace as well. So you'll be able to provision it into GovCloud via the Marketplace. Okay. That's pretty straight cut and dried. What about this one? Are GitHub actions similar to runners? GitHub actions is GitHub's implementation of CI CD. It's similar to runners. I think they actually call their runner GitHub agent. And I think they're using the same software that Microsoft Azure is using. So they call it an agent. Whereas GitHub actions I think is what they're referring to or the technology they use to refer to their CI CD offering. So I think, yeah, but I think the more accurate sort of Apple comparison is the GitHub agent and the GitLab runner. Okay. Here's a long one. This one's also coming in from YouTube from Sebastian. Can we opt, and I'm gonna optimize in quotes, right? Can we optimize our projects, build time or runner availability for multiple projects building at the same time by deploying a GitLab runner on OpenShift? I'm gonna try to pass this question. So can we optimize our projects, build time or availability for multiple projects? I guess Sebastian, you can keep us honest here and Sebastian on YouTube. Are you basically trying to get to a state where you're only deploying a runner when you need to? If that is the core question, the answer is currently not. As Pete was showing in this demo, you would want to install your runner on OpenShift first because what's happening is the runner is pulling GitLab for an available job. You can certainly optimize your projects build times and there's certainly different strategies to do that. So I think generally speaking, yes, I think we can certainly delve into your use case a bit more and kind of tease out exactly kind of what you're trying to solve for in terms of the availability by multiple projects piece of this. Okay, Sebastian, hopefully that answers your question. And by the way, if it doesn't, we're really accessible people, like you can send me an email. Again, it's just wait at redhat.com. You want to get in touch with Darren. You want to get in touch with Pete or anybody else. Like we're really easy to work with and so don't think that this is the last chance to get any questions answered from us. Mikey wanted to know what runners are supported. Just basically, in this case, just one GitLab runner. At a really high level, you have just the one GitLab runner software itself and within the GitLab runner software binary, we support either A, multiple target deployment environments or B, multiple executor times. So in the case of OpenShift, we are leveraging our Kubernetes executor and of course we're packaging it up with the operator in terms of the install process and the management process. So it's just one runner, multiple the environments. Okay, and I'm going to continue to read the questions because the other people watching on YouTube and Facebook won't know what the question is. So we've got a couple more here. I'm going to allow Pete to pronounce this person's name. You can take a stab at that one and why don't you read that question off? It's probably up your alley. Rapscallion Reeves, I think. Is there a marketplace where I can find pre-made GitLab CI EML files for common projects, i.e. rebuilding and deploying Node.js apps? So the answer is yes, but it's not specifically in marketplace. It's actually within GitLab. So one of the things you can do. So if you're already a user of GitLab and if you're not, you can go to gitlab.com and sign up for a free account and start using it. But my suggestion there is once you go into the repo, you can opt to create a new file. And when you do that, you can opt to use a template. And from the templates we basically have I don't even know what the number is. A series of pre-made GitLab CI EML files in various languages already for you to go. So the answer is yes, from within GitLab. I'm not positive if marketplace has anything, but we do have some standard pre-canned EML files at your disposal. Okay. This one's from Oleg. I think this one's also from YouTube maybe it could be from Facebook, I'm not sure. Oleg wants to know, are you using operator SDK for building GitLab operators? What was the most difficult part of creating an operator? And actually, let me ask another question in advance of that. Is your operator built in Go or is it more of a Helm chart? So the answer is Go. And the answer is yes, we use the operator SDK for building it. In terms of what's the most difficult part, I can answer that. I personally, this is a downing, can't answer that question Oleg, but you can certainly ask that question of the developers that actually did the coding work. And so I will just drop in the chat window the link to that project. Oleg, just feel free to create an issue in there and ask that question. Hey, I'm interested in understanding what was difficult about using the operator SDK. Can you give me some pointers or what have you? And the developers will actually respond to your question. Okay. We have four minutes left and you're, Darren, your team provided me a whole bunch of questions just in case we didn't have anything to talk about so we wouldn't be sitting here saying great, well, that's really excellent. I'm not even gonna get to them. So I'm not gonna read these canned questions at all. But I did wanna ask you about what's next in the next major release of coming up for GitLab. And that ties in really well with Preston's question that just came in. For the upcoming GitLab server, will it install operators a different user than Root? And maybe you can kind of, Darren, tie that in with like what's coming in your releases, the major releases for your products. Okay, so in terms of the GitLab server itself, I'm in the product manager for GitLab server. So Preston, I wanna point you to the link that we posted earlier on that takes you to the Epic for the GitLab server on OpenShift. Go ahead and raise that question in Epic in terms of the Root requirements or any other folks that are listening in the call, the requirements around NUID and the product management team and development team working on GitLab server respond to that. Michael, in terms of the runner, what's coming in our major release, we've got a bunch of things coming in our major release just forwarding it all for the runner. Specific to OpenShift, we're doing things related to PUT cleanup and then some additional work related to managing of Root certificates. But yeah, if folks are interested in things that are happening specific on the server side, yeah, thank you, Preston. That Epic there is a place to raise those questions. The product management team will respond to them. Okay, we get time for this one last one. Sebastian has a clarifying question. I don't know, Pete, you wanna read that off? So YouTube and Facebook knows what the question is. Pete, you're on mute. You need one of our T-shirts. I was gonna say that should, yep, I was just demonstrating the usefulness of your T-shirts. So anyway, my question was referring to something like auto scaling up or down of the GitLab runners to prevent small project builds from waiting for a big project to finish building. And I'm gonna pass this to Darren because I think you know the answer to that one. Yeah, and Sebastian, the thing that we have in the flexibility as people is kinda showing as well is that you can configure the runners to solve different, you're sort of like use cases in terms of project sizes and large project versus small project. At a high level, yes, auto scaling is definitely there. You also have the additional flexibility of just being able to simply to register different runners for different types of products. So maybe you have a runner that's gonna just handle the last project builds, right? And it will handle auto scaling on your OpenShift cluster. And maybe you have a different one and that's gonna handle maybe your Node.js project and maybe it's in a separate name space or something like that. So the answer is at a high level, yes, you have auto scaling capabilities, but you also have the ability to configure the runners in a way that really addresses your use cases in terms of the type of sub-build jobs and how large and how frequent and so on. And again, if you have any questions, Sebastian, ping us at any one of those issues and we will help you kind of get going in terms of your configurations. Okay, we are out of time. I'm gonna grab the screen share here. And again, if anyone has more questions, send them to wait at redhat.com. I'll get them answered or if you guys wanna call, call Darren and Pete at their home phone. We're gonna put that up on the screen here right now. Yeah, I have mine forwarded over to Darren. Yeah, so this was your, this was the call to action slide that you got that your marketing folks sent over to me. I don't know if I go paid view, whatever. Anyways, people can be a part of their pipeline on OpenShift event that's coming up on April 29th. Thanks everyone for joining today. And Pete and Darren, thanks so much for coming here and being our victims. It was really nice to have you on. Thanks for having us. Yeah, thanks for having us. And I'll catch up with you guys. If you guys want some shirts for the GitLab folks, you know, just let me know and we can shoot some over to, we haven't made them yet. We just, we were just, we've been kind of like stalling on actually making and we just haven't got around to it. But we'll, I really think that they can be very useful. Well, as you just saw, I just, yep, definitely. Okay, well, we're done with this version of the OpenShift Commons Briefing Operator Hours. Thanks everyone for coming and we'll see you next Wednesday. Thanks. Thank you all.


Come on Hi, I'm Lavi and I'm Oli and this is our hero bumblebee together We are attempting a Guinness World Record to become the youngest pair to circumnavigate the globe by motorcycle Join us for season 3 here in South America Super Tender Ray No, no, maybe we have to push ready go go go Hey, good job. There's always a hill when you need one. Hey, okay, let's just hope the bumblebee starts I like that sound all bees are legend Legendary bike I Love this little road. I Want a road like this heading up to our house in the future A little jungle track. Yeah, so this place was actually where we camped last night And it's actually just off the main road, which is absolutely epic You just follow this little track and then you have a nice space there. Yeah, look just here We're back at the route of seven if you go check on traffic We get on our side of the road Yeah, this outside Okay, okay ready? Good morning world, welcome back to the channel. It's day number 272 on our circumnavigation around the globe by motorcycle. We're here on the route of seven in Chile And it's a really grey Misty tropical feeling day today. Yes, we've been following this road north for the past couple of days And it is an absolutely epic road and we're just in love with it and in love with Chile It's just amazing. So let me show you guys where we're headed today. So we are all the way Up here and today we are going to be continuing on the route of seven Up here before turning off to head back over to the border to Argentina Yeah, so we'll be really exciting today to cross back into Argentina So that would be really cool and then we try to get as far north as we can so we don't really know where we And up tonight we will see it really depends I guess on the road condition between This road the route of seven we're going to be following it for about 80 miles north Then we turn off and we're heading over to the pass Which is the border between Chile and Argentina, but we really don't know the condition of that road So it's gonna be exciting to find out. Yes, and it's already 8 20, so better hit the road. Let's go. Oh beautiful Yes, look at this and from the smell You could smell it's not a lagoon here But it's actually an inlet from the ocean one of the many thousands upon thousands of inlets that come on this coast of Chile and this channel here is called the Puyapi channel or the Puyapi channel it heads to the next town that we're going to reach in a little bit called Puyapi It's just beautiful and dramatic this morning with all the misty clouds on the forested mountains Feels like a lost world here with the perfect Armagh road No perfect perfect for touring, you know, it's like as nice Yeah, that's this road the Caratera Ostral the southern road of Chile. Yeah, just a dream roads Disappointing No, it's okay. Actually the dirt roads here. They are all right. They're at least not deep gravel It's more like a potholes. Anyway yesterday. We went around the bike and we tightened up any Loose bolts that had been shaken loose from the road over the last few days.  Yeah, but wow our bike is so Strong, I can't believe it really our tires are strong or bike is strong We had no issues in like 14,000 miles Wow, I mean, I'm so super impressed guys. Really. Yeah, Bumblebee seems to be able to face literally anything Yes, I just wait for the day when it starts flying little cows big cows many cows Wow, okay, there we go Not enough pasture anywhere else. Hey Hey, the best grass is on the road Come on guys, it's like no fields around here Our first town of the day Puerto Puyapi And we're gonna see if we can fill up Bumblebee here because on this road it's always good to Fuel up whenever you can Sometimes the petrol stations don't have any fuel. So so where is the petrol station? Yeah, it's like really in the corner of the corner of the corner. So you just follow this road here. Okay Just keep going following this wall What a cute place hey So charming Yeah, you continue this road here still there's a bridge coming over the bridge and then you turn to the left straight after okay Yeah And then to the end The sign looked so old. Yeah, I'm not sure that these guys are gonna have fuel. I don't know but there is the petrol station Oh, yeah, I see Hola Okay That should be absolutely fine, so No problem No, this was French, right? Seen problem I think it's coming up actually on this road here Okay, it's coming up on the left on this road here Yeah, there Looks promising. Yeah, that looks like a more substantial petrol station Successful fuel up in la junta and now we've got 43 miles to go on the router 7 before our turn off towards Argentina And it looks like the clouds have parted and the sun is out And it's warming up here in the mountains of Chile So we've just left the router 7 behind and we're now on our way to the Argentinian border That means we also left the beautiful tarmac behind and now we're on a beautiful dirt road Yeah, it's about 50 miles to the border and Let's hope that the road stays like nice like that. Yeah, we won't have a problem if it's like this This is great and look at the Crazy high mountains all around us. Yeah, pretty. It's such an epic beautiful little road Okay, so I'm trying to get our backup drone working but It's almost unbelievable that It's having the same issue as the other one where the gimbal is not working Okay, let me see. Come on. Come on. Come on oh no Ah, it looks like the gimbal isn't working on this camera either I can try and have a fly around and see but No, we can't even move the field of view on it. It's totally unresponsive Oh, yeah, I All right, well We'll just have to continue as we are Without any eye in the sky. It's pretty disappointing though We lost our main drone About a week ago And then we had our backup drone And now that's gone as well. Yeah, man, it's crazy. Absolutely crazy. We have them in like a sort of soft picnic bag Which is inside the rear box. So I don't know how better we can store them to be honest I have no idea. So that means the dirt roads over the past week have broken our GoPro holder on the front bars and two drones Yeah Crazy stuff, hey crazy man I guess we're gonna have to organize a bit of an equipment upgrade, but it's a very beautiful place anyway Yeah, stunning man. So you guys will have to just enjoy it at ground level So unfortunately half of this road seems to be under construction. It looks like they are preparing it for Putting tarmac, I think but what that means for us is that instead of a nice dirt road with a nice road surface They basically coat the whole thing in gravel. Yeah, I mean this bit for example is Looks like basically fresh gravel that they've just dropped down Either it's nice to have a dirt road just as a dirt road or a tarmac road Just as a tarmac road, but when it's at this in-between stage That's when it can be really tough riding roads under construction are not good for motorcyclists Are we going left or right? Wait, yeah, because I think we have a turn off here. Let me just see on maps me. I Think we are going to the left here We had a stroke of luck We turned off of that road that was being worked on And now this one is way better and we've got these beautiful mountain views that we can enjoy a little bit more now We're just stopping to take off some layers Because it is hot now wow The Sun came out hey flying along on the dirt road Beautiful stretch So it's just about 30 kilometers now to the Border crossing it didn't take us the whole day to get through the border. That's good. Yeah, this is just Great riding at the moment Or is it still the morning? It's 12 40 12 40. Yes. Okay. There we go. Yes One o'clock and we've reached the border. Can you believe it? Wow, we did really well 40 miles this morning Yes, I said cheaper fuel. Okay, let's park the bikes at the front. It's that's you know, man. They are key I'm gonna do this. Okay, turn back this way. Okay. Yeah, right. I'm gonna do this stuff with the border. I'll be right back Oh Chilly Argentina Look, there's a guard dog standing in the way. No, you cannot enter Unless you give me a pat on the head We go heading in. Oh, this is the Argentinian side already. Oh There you go. There we go Okay Well, that was really close I rode for like one minute. Okay, vamos a la Argentina Gracias, ciao. I didn't do my blip in helmet on the night. Oh, yeah, I thank you Beautiful look at this So this is actually a national park that we've just entered on the Argentinian side. It's called Park Nacional Los Alersis So now we've got about 30 miles to go To reach the town of Trevelin The first Argentinian town we'll encounter and then we can stop there have a bit of food Have a bit of a break, but I think after Trevelin. It's still another Possibly 80 hundred miles to go. So the hostel is in a town called Cholil It's got a really cheap room price So if we can get there take a room after many many days of camping and dirt roads, then That'll be great. I hear they have a shower as well Now a GoPro tape solution at the front here is starting to Starting to loosen look. Oh my god Starting to fall apart We have made it to a Panaderia And it's amazing we're back in Argentina so everything is super cheap So that's an egg, olive and queso sandwich or cheese sandwich and then here's another sandwich with a lot of salad and mini pizza Bravo Nikos just translated to us very cheap here. I will take more food Muito mais muito muito muito mais. Yeah, we really needed a rest after Something like 160 miles a lot of dirt roads up and over the pass, but we made it We're here in Trevelin. We're gonna take a rest and then do the final push to the hostel No Just what I have Churros It's coming up to six o'clock now But our final destination of the day is up ahead a small town of Cholil Cholila Cholila Cholila home for the next few days. Oh Yes, there's the Panaderia. We found it already. Okay. Yes, that's where we'll get breakfast Very important. There's the bomberos the fire brigade. Yes. Yeah, then the petrol station. Oh Is this the only one? I think so. Okay Look at this. It's like a roundabout park This is a very very cute place indeed. I think we're gonna be very comfortable here We're gonna have a bed tonight Cabanas Los Tres Picos What was the name of the hostel? It's not this one Piugimapu Patagonia hostel. It says closed on the sign Let's check it out So at the moment we've had a walk around and there's like nobody here Um So we've messaged the owner on booking.com because we've actually reserved the place on booking.com But there seems to be like no one around So we've sent them a message. We'll just wait and see if they get back to us Okay, so we've waited around for a while here and it doesn't look like anyone's home actually so We found another hostel in town just up the road So we're going to go over there and see what the room price is over there Nikas is your battery dead again?  Ah Hola I Evening guys we made it happy in alive Yes, I can't believe we managed to conquer all those dirt roads and make our way across the border back into Argentina Welcome back Argentina today was a pretty long day With a whole mixture of different roads. I think the roads were just playing with us today. It was like yes Yes, yes, amazing. Oh my god deep gravel. I was amazing Oh, this is not too bad. Oh beautiful landscape. Oh my god. We're nearly falling over, but we didn't fall No, it was a successful day and we've made our way to this beautiful hostel here in the beautiful little town of Cholila and After six days on the road. It's finally time for us to have a bit of a rest and have a shower And have a shower which is coming up very very soon. Yes And that's it from us today at the end we did 270 miles which is about 430 kilometers And we hope you enjoyed the episode if so, please give us a thumbs up So subscribe to the channel share the video with your friends and family comment below and we will see you next time


Hi you guys my name is Brittany and welcome back to my youtube channel. You guys in today's video I have a curriculum unboxing and a curriculum haul for you guys. I did some Christmas shopping from Rainbow Resources eBay and I also went to a bookstore called Ollie's and I got a few things you guys and I just want to share with you guys what I got for my home school some new curriculum that I have and you know just all of that jazz so I'm really really excited you guys about today's unboxing so let's go ahead and get on into this thing so you guys if any of you guys are new here I have three kiddos they are 12 5 and 3 right now and we are entering in our second semester of our home school here shortly and it's so crazy how my kiddos they went through some pieces of their curricula a little bit faster so I had to go and do an order from Rainbow Resources to replenish their curricula so we're just going to go ahead and unbox it and I'm going to share with you guys everything that I got from Rainbow Resources first and then I'm going to share with you guys some curricula pieces that I picked up from eBay because any chance that I get I love to shop use I love to be able to save any type of pennies that I can when it comes to like my home school curricula I love going to like discount stores and things like that so yeah I'm so excited so let's go ahead and open up this one and we're gonna see what's in here from Rainbow Resources Rainbow Resources is like one of my favorite places to shop for my home school curriculum too because you can always find like some type of deal or whatever from them so the first thing that I have at the top is first grade math with confidence my kindergartener right now is a little more than two-thirds away finishing up with her kindergarten math with confidence I counted the lessons and she's going to be finished with the kindergarten math with confidence in February so I went ahead and picked her up the next level which is the first great math with confidence I'm so excited to dig into this one so this right here is the teacher's manual and then here is the student workbook it's so crazy because like just filling it it's definitely a lot thicker than the kindergarten math with confidence so I mean it still has the same feel of it I love like the simple pages of the kindergarten math with confidence workbook and I love how colorful it still is so I'm so excited to dig into first grade math with confidence when we get there and I definitely wanted to make sure I already had it on hand and I didn't wait till last minute this set right here was on sale rainbow resources for $29.95 which is really really good so I'm glad I went ahead and snag that up now for my baby girl my youngest one Alana she will be four on January 2nd we are about halfway through with her preschool math at home from Kate Snow's program as far as like her math and I went ahead and I just got another workbook for the kindergarten math with confidence since I already have the teacher's manual so um it's so cute it looks exactly the same so since I was already doing an order I was like I might as well go ahead and get the workbook so whenever I am ready to start kindergarten math with confidence with my youngest order I can definitely just go ahead and pull it off of our shelf and start it so this workbook was only $11.25 so this is the kindergarten math with confidence workbook now you guys if you want to see any flip throughs now that I have both of the levels the first grade in the kindergarten I definitely can compare them and give you like a more thorough flip through of kindergarten math with confidence and first grade math of confidence if you want to see it um so what else I went ahead and I ordered also math you see alpha for my uh kindergarten or now we are about halfway through math you see primer and I like supplementing my math with confidence with math you see it's just extra practice and I love her being able to still use the blocks she loves those blocks and um it's a really great way to really solidify those math facts that she's learning right now so I went ahead and I got just the workbook from math you see um alpha from rainbow resources now for my oldest order briel she's in the sixth grade right now and she you guys she is literally on the last three lessons of math you see zeta right now so I definitely know I this main purchase for rainbow resources was for her and I went ahead and I got her the math you see pre-algebra level you guys I am not gonna lie I was so close to trying out denison pre-algebra for briel instead of going with math you see but me and briel we went back and forth we looked through denison pre-algebra and we was really deciding if we wanted to make a you know math curriculum switch for denison now or if we want to go ahead and do at least a few more levels of math you see uh pre or math you see pre-algebra and on so right now we went ahead and decided to continue with math you see I don't know in the future if we may or may not try denison algebra especially for high school but for now math you see has been a godsend and I will be crazy to make a switch if I don't need to especially you guys you already know I went through a crazy math saga with my oldest order so it's crazy that we are entering in our third level of math you see if it's not broke I'm not trying to fix it so we made the ultimate decision to stay with math you see and I'm really excited now this is the workbook and the test book that comes with the um math you see level now from ebay what I went ahead and I did was to save some money I just purchased the um the what is it the instructors manual and it actually has like the student pack with the dvd and it also has a digital pack where you can watch the dvd videos online from ebay and I snag up both of the math you see um instructors guides from ebay along with like the dvds and the digital pack for only 25 each so both of these math you see I mean they're sealed you guys they were only 25 dollars so I definitely saved a lot of money by buying the um teachers got used well technically it's not used because it's brand new but buying it I guess secondhand from ebay and then only buying the workbooks I saved about 63 dollars and you know that's a lot when it comes to uh your curricula purses uh you find it used so I'm so happy I snagged these so now I have everything that I need for my kiddos as far as math so that's like all of the curricula that I had that's tangible I went ahead and I purchased during black friday I went ahead and I purchased this curriculum is digital which is mitt and blooms power of the people and I went ahead and I purchased the book that goes along with it which is rad american histories a through c and it says movements and moments that demonstrate the power of the people so this is kind of like a civics um unit that I want to go through with briel where we would just go through each movement on fridays and it's really really going to be cool for us to go ahead and do this when it comes to her seventh grade year because she's getting turned into like world history and I think that this is a awesome time it's really world history but it's really focused more so on american history and I think this will be a great time for me to kind of like do world and american and for us to really dive in deep to different movements and really what made america america so I'm really excited about this unit I've seen it a lot on youtube especially from Michelle g's channel and I also seen it from uh instagram I forgot where her name is but I'm going to pop her tag um either up here or down below of where I seen them do a flip through of this and it made me be really really interested to go ahead and start a power of the people and also one of my homeschool mom friends she told me about mitt and bloom as well we chat all the time and I was like you know what I definitely want to add this into like our loop when it comes to her my oldest order seven for a year so that is one of the digital pieces of curricula that I do have now um when I went to go visit my sister she lives out of town now she just moved away from Georgia and when I went to go drive to visit her we've seen me and my mom seen Ollie's and I heard so many things about Ollie's bookstores and you guys we went inside of there and we were in that store kid you not for like hours and I picked up a few things from Ollie's and I just really didn't know like how I wanted to share with you guys some of the books that I got from them I just have a few books and I'm going to share with you guys some of the titles it's really really random because I mean most of the books are just like all over the place and it's really really cool being able to dig and find treasures and things like that so I found two books for my oldest order and I found a few picture books for my younger too so for Brielle my oldest I found this book it's called Hope Project Middle School and any any book that I can find right now talking about middle school I definitely love her reading since she you know is now officially a middle schooler so um she actually already started this book and I'm going to ask her how it is but uh this is the first book that I got and it was only $2.99 so I had to snack this from Ollie's another book that I picked up for her is called Turn the Tide and this is another free verse novel um I when I was in Ollie's I looked on my phone on Amazon and I love like reading a Star Reviews real quick before actually pick up the book to see if it's good and this book got four and a half stars and I definitely think Brielle will love it she read a book this year called Alone and it was written in free verse and she said that was like one of her favorite like independent fund readers she's read so I definitely want her to get exposed to a little bit more free verse type of story since she really enjoyed that last year now for my littles I picked up this book it was so cute it's from Pretty Books and it's called How Do You Feel um definitely around this time it's great to continue to talk about emotions so they really can distinguish like how they're feeling and to be able to express them um instead of really like uh resorting to like tantrums especially like my youngest one my three-year-old you guys so um I definitely was happy when I found this book about feelings as we are going to talk more about them when we hit into like January and start of our new semester now I seen this other book it was so cute it was only $1.99 and it's called Don't Touch My Hair and I thought it was so cute because even my girl all of my girls are curly girls and even amongst themselves they get mad when each other touches their hair so I thought that this was a cute book to read to them so um I can't wait to dive into this one right here I picked up this book it's called All Are Welcomed and we checked this one out from our library the same author wrote another book called Big Fillings and my kiddos I mean when I checked it out from the library I think I checked it out three times already and at that point it's definitely time for you to purchase the book and this one was only $3.99 at Ollie's so I definitely had to snag this one up because on Amazon right now I think this book is about $16 so it was so crazy to see like the big discount as far as the book so hopefully my kiddos will be excited that we actually own this and won't have to check it out from the library anymore I picked up this Tinker Active Science and it's for first grade and it has it's like a little mini curriculum where it has like all these different science tinkering activities inside of it and I thought that my um middle daughter Leia will enjoy this and maybe this will be a way for us to incorporate like science and steam in our house and really a fun and simple way and when I seen this book for only $2.99 I was like you know what I'm just gonna go ahead and grab it science is definitely my weakest subject in my home school at least the subject I feel like I have to work the hardest in and being consistent and I think something like this will be fun for us to do even over the summer so I just grabbed the first grade level instead of kindergarten because I want something to grow with her so um I'm really excited about this little cute workbook and then the last book that um I picked up was one that my oldest daughter Brielle found it's called Flying High and it's a picture book about Simone Bowles and she was really really excited so I can't wait to read this one with the kiddos so you guys that is everything new that I picked up uh in the month of November and December for my home school and I really hope you guys enjoy seeing like my little mini uh mid-year curriculum haul I am I'm excited you guys about entering into our new semester in January but right now I'm I'm just really flourishing in our season of rest and while we're resting I'm still being mindful that I am home school mom and I'm doing my best to do little mini preparations for next semester so when January hits I don't have a whole bunch of stuff bombarding on me so this was one last little task that I had to do before I can officially close the home school room up put the books down and we can do like our arts and crafts and have fun and really enjoy our Christmas season so you guys as always thank you so much for watching and I look forward to seeing everybody in my next one bye


Welcome to the last session of FSE. It will be a session about new designs, and there will be free talks. The first talk is Adiantum, Length Preserving Encryption for Entry Level Processes by Paul Crowley and Eric Biggers. And Paul will give the talk. Thank you very much for the introduction. I want to talk about a problem. I'm on the Android platform security team. And I want to talk about a problem myself and my colleague Eric faced and what we did about it. This is going to be one of the less technical talks. It's the last day. We're all tired. But also, Adiantum is not a deep technical advance. It's a combination of well understood techniques. And what I want to talk about is the practical problem that we faced and why we chose Adiantum as a way of solving it. So any of you who have Android devices in this room, undoubtedly those devices will be encrypted. And those devices will have something like ARM cryptographic extensions, or perhaps even an inline crypto engine that makes AES super fast. And so those devices will be encrypted using AES. But for a lot of devices, not in this room. Devices being, for example, being used in developing countries or IoT devices or something like that, they have processors like the Cortex-A7 processor, which lack the AES-CE extensions. And on those devices, AES is just not an acceptable performance. And so this affects storage encryption, which is my area. But it affects all sorts of things like, for example, TLS connections. And in TLS, the solution to this was RFC7539, which uses Dan Bernstein's primitives, Chacha Poly 1305, to build a fairly straightforward AEAD mode that you can use for these kinds of applications. And it is, I'm afraid I don't have benchmarks, but there's similar benchmarks I'll show later for Adiantum, is way faster than AES on these devices. And that gives users an acceptable performance. And so for an internet connection, for network connections, RFC7539 solves this problem. Trouble is, because it's an AEAD mode, the ciphertext has to be larger than the plaintext. There has to be room for a Mac, and there has to be a non-switch is not reused. For storage encryption, we have to have a ciphertext, which is the same size as the plaintext. And I'll get onto why that is. So the most familiar example of storage encryption is the full disk encryption. For every physical sector on the device, we have a virtual sector. And a write to the virtual sector, which has to be exactly four kilobytes, because that's what the software expects, is encrypted, and is sent to the hardware as exactly four kilobytes, because that's what the hardware supports. If we had flash storage that gave us a little bit more room, we could have a few extra bytes in our sectors, then we could use an AEAD mode to store these extra bytes. That would change the picture there a little bit. I've been saying this since about 2000. I've been having this conversation with, like, if the storage manufacturers could just give us a bit of extra room here, we could really do something different. Even if they were to turn around tomorrow and say, OK, we're going to do it, it would take a long time for that hardware to become available. And to me, this problem is urgent. There are devices out there that are not using encryption because we don't have a solution to this. Now, on a lot of more recent Android devices, we don't use full disk encryption. We use file-based encryption. And at first, I hope that this would give us another way to address the problem. It would allow us to, the file-based encryption could mean we could have a bit more flexibility format, and maybe we could make room for a little bit of extra storage for a Nultz and a Mac. Sadly, it doesn't really work that way. First of all, that would be a major engineering effort by itself to write a file system that could make room for this. It would be a pretty deep change. But even given those deep changes, there would be certain circumstances where you would see a major hit. So databases, for example, they expect that if they have a multi-gigabyte database file, they can go to some four-kilobyte line sector and make a change and see a single write. If we have to update a Nultz and a Mac for that sector, making it a little bit larger, that means it's got to be at least two writes. And when they read from it, at least two reads. That halves the speed. It breaks atomicity, makes it a major challenge to update this in a way that is atomic. But worse than that, it's really bad for the flash devices. The lifetime of a flash device is measured in writes. If under these circumstances, we're doubling the number of writes, it will halve the lifetime of the flash device, which would be a serious inconvenience for users. So even in the file-based encryption scenario, we can't get away from this problem that we have to have the ciphertext the same size as the plaintext. In order to call itself an Android device, a device has to pass what we call the compatibility definition document. And for many years now, the CDD has required that Android devices be encrypted. But there's a carve-out. And there's a carve-out so that people in developing world countries can have a full-fledged smartphone operating system on the hardware that people there can afford. That carve-out says that if you encrypt AES at below 50 megabytes a second, you may ship an unencrypted device. Now, that's sad in that lots of people have unencrypted devices. But it also provides some pretty weird incentives. If you can just slow down AES in your device to 49 megabytes a second, bingo, you can ship that device unencrypted. And now your device is faster than the device that runs 51 megabytes a second, which is unencrypted. So I was pretty unsatisfied with this. And I wanted to fix that. So here's what we did. So given that the ciphertext has to be the same size as the plaintext, we can't achieve formal properties of an AEAD mode. It has to be deterministic because it's a bijection. We rewrite new content to old sectors so there's no way to store a nonce that isn't reused. And the best we can achieve is a tweakable super pseudo random permutation. We want, for every sector, we want there to be a bijection between the plaintext and the ciphertext, which is indistinguishable from a random permutation. And for all of those sectors, we want it to be a family of permutations that's indistinguishable from a family of random permutations. And that's assuming the attacker has access to the encryption and decryption functions. So an example of a tweakable super pseudo random permutation is AESXTS. And this is what we use on modern Firebase encrypted devices. To encrypt a four kilobyte sector, we simply apply AESXTS 256 times in parallel units. And so the tweak comes in two parts. There's a part for the offset into the sector and there's a part within the sector, for the offset within the sector. However, on the devices we target, we see performance of around 59 cycles per byte, which is like 20 megasecond, which is way too slow for our user's experience. If they're loading an app or something, it takes really visibly too long. And so we can't expect that our users won't accept it. We can achieve a better security guarantee if our super pseudo random permutation is applied to the entire four kilobyte sector. So a change to any bit of the plain text in that sector affects the entire cybertext and vice versa. And for every tweak, it should appear to be a completely new permutation. Not only does this give us better security properties, it gives us an opportunity to be faster. Because we're operating in a much larger bulk on the data, we can use primitives that work in bulk and give us greater speed in bulk. An SBRP has to read every byte of the plain text before they write anything. So you have to have at least two passes. Because we want it to be super pseudo random, we need the same property in the decryption direction, which means a minimum of three passes. So we've gone for a hash or hash structure, simply because the hash is faster than the ZOR. And so doubling up the hash is faster than doubling the ZOR up. And we're inspired by examples like, I mean, there's a lot of interesting work in this area which is cited in the paper. We're inspired by examples like H counter and HCH, which, like the other work that we looked at, is based on the assumption that you're going to use AES and you're going to use multipliers in GF108. H counter and HCH have this hash or hash structure. They have a narrow 16 byte block on the left. And they hash the wide block on the right to a combined block on the left. They use that to generate the nulls that goes into the counter mode encryption. And then they hash again on the other side. And there's a single block cipher call on the thin block on the left to defeat the Lubey-Rackoff attack on the three-round FISCAL structure. But because, like the other things I looked at, this is based on AES and GF2 to the 128, it achieves better security properties, but it doesn't perform better on our hardware. So the work we did was simply to take these ideas in H counter and HCH and combine them with the ideas from RFC7539 with the high performance primitives we have. And so that means we changed the hash combiner on the left to a addition, mod 2 to the 128, because that's the combiner that works well with our hash. But the structure is basically very similar. We also, because Chachar is very well behaved compared to AES and counter mode, we can achieve a slight optimization where we don't have to achieve a slight optimization where Chachar and AES can run in parallel in the decryption direction. So that we sacrifice the symmetry of encryption and decryption, but it can give us an opportunity for a slight speed up in decryption. And so that gives us a massive performance boost. 17.8 cycles of bytes well over twice as fast as AES XDS. And that was a big win. But we needed it to be if we were going to the discussion we were going to have with OEMs trying to make sure this feature was mandatory was going to be a lot easier for every cycle of a byte I could shave off this mode. So the first change we made was we switched from Chachar 20 to Chachar 12. The currently the best attacks on Chachar break seven rounds. And that's been the case for over a decade now. And it's seen a lot of crypt analysis in that time. So every round of Chachar adds a lot of strength. And so we felt good about choosing that mode. That gave us 13.6 cycles of byte, which is a significant improvement. But there was room for one other improvement, which is that while Poly 1305 is very fast, there are still faster epsilon almost delta universal functions on this hardware. And so we looked at NH for hashing the bulk of the data. NH is blindingly fast around 1.5 cycles of byte. NH's output is variable length. The more you hash, the larger its output. So we use NH essentially as a compression function to reduce the amount of data we feed to Poly 1305. And then Poly 1305 handles the final hashing stage. And that's then combined with the tweak. And that gives us our mode adiantum at 10.6 cycles per byte. And so this is the overall performance where so because of the single AES encryption, we get faster the wider the block we're encrypting. But we're still fairly acceptable evil on the 512 byte sectors that used to get on all devices. And we're faster than not only faster than AES, but faster than other block ciphers such as Noakeon and SPAC. And there's a larger performance table in the paper. I think I've got time to talk a little bit about the proof. It's fairly straightforward. So this is the main step in the proof where the adversary is trying to distinguish between two worlds, World X and World Y. They can make plain text and cipher text queries of any length and tweak. So World X is essentially adiantum, except we replace the block cipher AES with a random permutation pi, and we replace cha-cha with a random function f. In World Y, for every query the attacker makes, they get a random reply of the appropriate length. And we're going to use the H coefficient technique, which is, thanks to one of my reviewers for suggesting that. And so after the final query, we're gonna make the attackers life a little bit easier. We're gonna give them the hash key, which can't hurt and can only help them. Once the attacker has the hash key, one thing they can do is calculate all of the intermediate hashes inside adiantum. So you've got this diagram where you've got these hashes being either side of AES, and we're gonna allow the attacker to calculate those. So they can put in the plain text at the top, tweak at the side and get the plain text hash, and the same thing for the cipher text at the other end. Having done that, they can look for collisions either in the plain text hash or the cipher text hash. It doesn't matter if a plain text hash collides with the cipher text hash, only matters that if there's a collision in a specific layer. And if they find such a collision, they're going to win. What's the probability? For whatever queries they do, we can bound the probability of finding such a collision. And because the wonderful thing about the H coefficient technique is we only have to consider the probability in worldwide. This is the effort that it saves us. So for the result, it's pretty simple. The result is totally random. So the right hand side is totally random, and it's combined with whatever the hash value is, but the result is totally random. So the probability of colliding with any specific previous query is two to the minus 128. This is assuming a plain text query, it's all the exact opposite for a cipher text query. For a plain text query, it's the epsilon, we were applying the epsilon almost all universal property of the hash function. We forbid pointless queries. So given it's plain text query, either the plain text or the tweak or both must, for any given previous query, they have to, one of those two has to be different. And so the result is the probability that the hash will differ by any given amount is at most epsilon, meaning the probability there'll be a collision in the plain text is at most epsilon. And so across all pairs of queries, the probability that we'll see such a collision is at most epsilon plus two to the minus 128 times q choose two. If that happens, we call that a bad transcript. And so supposing we get a good transcript, what's the probability, given the queries that attack them, for a given deterministic attacker, what's the probability we'll see a particular set of responses. In world wide, it's pretty simple. For a given response, the probability is two to the minus p. All responses are equally lightly. The length of the response is the length of p and two to the minus the length of p. In world X, it's almost the same. We'll see a particular response. First of all, if f has exactly the correct output, to zore into the content on the left-hand side to convert it to the expected content in the ciphertext, probability of that is two to the minus the length of p minus 128. On the right-hand side, pi has to encrypt in just the right way. For the first query, the probability of that is two to the minus 128. As the queries go on, because this is a good transcript, it's always producing a value that it's never produced before and it's always guaranteed to produce a value that it's never produced before. And so the probability of getting it right goes up by a tiny bit every time. And so that's one over two to the one to eight minus i, where i is the number of queries before this one. And I should mention that the reason why we can say, make the assertion I did about f is because the nonsense being fed to f is unique every time. And so its output is always independent from all previous outputs. And these two probabilities are also independent. So overall, the probability we'll see this, well it's this formula here, it's the product of the two. But the important thing is, this is always either the same, depending if it's one query, or just a little bit bigger than the probability in world y. And these sum across all queries. So now we can play the H coefficient technique. Every good transcript is at least as likely in world x, world y. We've bounded the probability of a bad transcript and that bounds the distinguishing advantage, which is at most epsilon, plus two to the minus one to eight, times q choose two. So epsilon depends on the sum bound on the length of the message and the tweak the attacker sends. We're using polynomial hashing, so the longer the message gets, the longer the tweak gets, the larger epsilon gets. But we plug that into our formula and we add terms for PRP, PRF, bounds and four to char and AS. And we get this rather large expression, but the key thing is that it is linear in the message and tweak length, and it's quadratic in the number of queries, and it's small. The good news is, adiantum is already part of the length's 5.0. So I don't really think in terms of years.  So this year's release was Android Pi, and we have added adiantum to Android Pi and some devices will be using that. And in Android Q, which we don't know what it'll be called yet, if you know of a dessert that's called after the letter Q, please let me know. There will be no carve out. We will require encryption on all devices and where AAS is too slow, those devices will use adiantum. Thank you very much. Any questions from the audience? So then I will ask a question. I was wondering, so you said it has some favorable properties compared to XTS. So could it be also interesting to use it on the devices which have AES support and then replace the charger call with AES in counter mode or something? Is that something you looked at or? Where are you using some AES instructions that's very appealing. A lot of these devices have inline encryption engines and they're as hard to make changes, but also an SPRP mode is a terrible fit for an inline encryption engine. They want to be able to stream the data past, oh, excuse me, they want to be able to stream the data past and decrypt it as it goes. And SPRP mode totally rules that out. You have to read everything before you get to write anything. And so maybe that's possible, but I think that will take a little bit longer to land. Okay, and maybe another question I was interested in, maybe could you give some ballpark figures like how many percent of Android devices this would be deployed in the next year? I know it's many millions, but I think I'm not allowed to say. So we take this question offline. But it's a lot. I mean, it's the next billion users we're aiming this at, it's a lot of people. Okay, any questions from the audience? Then let's thank the speaker again.