The recent local government elections in Edo state where the governing People's Democratic Party recorded a landslide victory demonstrates the need for governors to loosen up their grip on local governments for them to perform their constitutional roles across many states. The local government councils seem to be under tight grip of ruling parties of those states whereby the party in power wins all the seats even when they lose in the national elections. Expectedly too, opposition parties report allegations of voter suppression, harassment and results manipulation. These types of elections, the new norm in Nigeria and how can we combat this sham election? Joining us to discuss this is Kunle Laval, he's the Executive Director of the Electoral College in Nigeria. It's so good to have you join us. Kunle, good evening. Can you hear me Kunle? Yes, I'm here. I can hear you. Perfect. It's a pleasure to be here. Yes, because we don't have too much time, let's go straight to it. The issue of local governments and state governments especially continuously, it's seeming like they have no powers constitutionally to do their jobs except by the directive of state governors has been an issue that's been discussed right from under the Obasanjo administration. Almost at the close of that administration we also saw that local government elections were now optional for certain states and their governors and here we are today, was debating the issue of states carrying the day, whatever party is at the center, carrying all of, you know, having a landslide victory during elections. How easy will it be to be able to loosen that grip that state governments have over local governments? Kunle, can you hear me? So for me, this topic I'm always interested in. It's always, yes, I can hear you. This is a topic I've always been interested in and the local governments generally have always been clouded by the fact that the people, that's the electorate do not care. So you have participation in local government at less than 9%. Now, this is a big issue when you're looking at it technically. There's nowhere in the constitution that grants autonomy to states, but states are asking for a place in the constitution for local governments to be granted autonomy. This is upon the fact they are being given power over security over their local governments. They are being given power over markets, parks. They are able to attack businesses and control outdoor advertising within local government. And it's clear to see at this point that there is no local government in Nigeria that receives less than 130 million Naira per month from the FACA locations. So the question there is, what has happened? Well, that's also a big question to ask. But let's also look at, because again, if there is no oversight, most times if you go to local government offices, for example, issues such as sanitation and several other things, you know, local taxation, half the time when people go to their local government chairman or the local government offices, they keep saying, oh, the state governments are not giving us money. The state government is not letting us do this. The state government is not letting us do that. So maybe, yes, these monies have been put in the local government accounts, but they do not necessarily have the powers to disperse and use as they should if their principal, the governor says not to. So the truth is that there is nowhere it is written where local state governments control the funds of local governments. What is in the constitution is that on economic planning, local governments and state governments can come together on a cohesive front to do something that's instrumental in the state. But what has happened, as you've seen in, let's say, the case of Ogun state, it kidnapped the local government funds entirely. And you know, through the ministry of entire local government affairs. And that is where the demand money is from local governments, which are paid from federal directly to local government. So this machination always happens at state government level. And one of the things I think is the cause of this is that I think in its space of restructuring has also handed over local government elections to states. And because they take those elections, they dictate its outcomes and also dictate the service of local government. So there are two things that come into play here. First, the electorate's non-performance local government, that's the local government at the first time of democracy to the people, yet we have less than a 9% participation in local government elections across board. And then governors now driving on that same parameter that the people do not care about the local government to stifle and kidnap its funds. I'll be honest and state clearly that in the case of Ogun state, when this local government chairman refused to give money back to the to the state, they actually activated something that most of us think is dead. And that is councillors as a legislative arm of local government and suspended or has taken out now the local government chairman in Ogun state has refused to perform. So local... For that local government chairman, I have heard his interview twice. And he's talked about the fact that he challenged, you know, certain things that the governor did. And then, of course, like you said, this triggered the councillors voting against him and then, of course, asking for his removal. Now, all of these things happened. Again, it's the ignorance of the people that these politicians are capitalizing on. Because when you tell the average person or you ask the average person, do you know your councillor? Do you know the supervisor for education in your local government? Or many of them have no idea. I've heard a case where a local government chairman does not live in his local government, comes into the local government on a Monday stays in a hotel for the whole week and then on the weekend goes back to his family. How is he supposed to be in touch with what's happening in his community? And how are the people supposed to reach him if he operates from a hotel? I think I think this problem starts from the top and you cannot alienate even the fact that 99 Nigerian federal government decided to build a house or build an estate for people serving in the House of Rep and the Senate, stopping them from interacting with their constituents.  So what you're seeing, the anomalies you're seeing in local government is actually reminiscent of what happens upstairs at the federal level. Let's talk about redeeming what's left of what we call a local government. I think to add that what's most confusing is that you find state governors asking for... Go ahead. Kunle, can you hear me? I think you are having a very terrible network today. Let me just ask my last question so we can wrap this up. Unfortunately, you keep going on and off. How do we begin to redeem? Where do we start to redeem what's left of what we call local government, especially election wise? Because if you are the one who puts the man there, you're able to go to him for accountability. Education of the electorate is really key. What most of us do not know is that even at local government level, local governments at every level, that's the chairman and the councilors, are not even guarded by immunity. So it means that these monies which are being taken in directly and which are being kidnapped by these state governors, the federal government chairman can go to jail for these purposes and even the councilors. So I think first thing we need to educate the electorate, then first the electorate to hold them accountable and participate more in its elections, then we could get something from local government. Great. How do we also... Yes, we can be educated. Just for example, let me take for example the February elections, the presidential elections. Many people were educated. Many people were called out to come get their PBCs, go out and vote. The process will be seamless. It will be free, fair, and credible, even though many question if we've ever had free, fair, and credible elections in this country. But as much as people were educated, they still showed up to the elections. And many would still say the elections somewhat was a sham for them. There are others who would say also this election was credible. There are some who would say that the elections were skewed. Even if people get educated about this local government's elections, there's still that strong arm of the state government. How do we make sure that their hand does not become too strong? So for me, there's a very big difference. For me, there's a very big difference between education or participation of people in voting, which is voter awareness, and then education of what actually happens in politics. Most people not know what the House of Rep does, what the local government chairman does. They don't know that the councillors are of course the National Assembly of the local government. It is that education that needs to happen before we can begin to engage other systems. You can't engage a system you do not understand. And as regards the elections, there were many anomalies preceding the elections in the electoral act, like looking at submission of party members electronically and the hard copies which are not done by the 18 political parties, which was totally ignored by the Nigerian populace. And then at the end, you want a free and fair election. How can you do that? So for me, I critically say you cannot engage a system you do not understand. Well, Kunle, I wish we had more time to talk more on this issue, but we will revisit the issue of local governments and their importance subsequently. But I want to say thank you. Kunle Lawal is Executive Director, Electoral College Nigeria. Thank you so much for being part of the conversation. We appreciate it. Well, that's the show tonight. That's the show tonight. We want to thank you all for being part of our conversation tonight. We'll be back tomorrow on Bloss Politics, talking for development. I am Mary-Anna Kunle. Go on YouTube plus TV Africa and play catch up on all our previous episodes. Have a good evening.


Efforts are underway by the Department of Defense in support of the Turkey-led relief operations following the October 23 and November 9 earthquakes in Van Province, Turkey. At the request of the Turkish government, the U.S.-European command is airlifting relief supplies to the area. Tech Sergeant Burke-Trainer explains. Following a short notice tasking for humanitarian assistance, a team from Marine Forces Europe prepares some equipment that is ready to go at moment's notice in Norway. The Marine Corps has had a strategic partnership with Norway for 25 or so years where we've had equipment prepositioned up here for contingencies that have been supported across three different continents over the last few years. In the last year, we've used the program here for two different disaster relief missions. The Marine Corps prepositioning program Norway is supplying 110 Arctic tents to be airlifted to Turkey in support of Turkish earthquake relief efforts. This is the first humanitarian mission for some of those involved. You feel like you're having more direct impact to the people. You know what you're helping, what you're moving, that people are actually going to get it quicker. It has more of an impact. About 28,000 pounds of equipment and supplies will be transported out of Norway by the C-130 behind me from the 37th Airlift Squadron from Ramstein Air Base. Different winter conditions in the earthquake-stricken area in Turkey make equipment such as this essential to those on the ground. A temperature of negative 10 degrees Celsius greets the C-130 crew in Turkey as they transfer over the relief supplies to Turkish authorities, enhancing U.S.-Turkey relations and providing vital supplies in the aftermath of disaster. Tech Sergeant Bert Rayner, Turkey.


Thank you very much for having me at this meeting. It's one of my favorite meetings that I get to go to because it's really with the Patients and that was such a great story, but you'll notice how the see how the cancer was found CT scan You know CT scan and that's how virtually every person who goes through the ER now gets a CT scan it's become a really I think almost indispensable diagnostic test and Unfortunately, there is a serendipitous finding but in this case hopefully everything will go well so I Work and UNC also and I work in abdominal imaging which I Predominantly everything below the diaphragm and above the hips a specialized in oncology and particularly gynecology and urology so I work in that area and So how do I try and help out the doctors? Well, the first thing you're gonna see here is our cancer board or tumor board So almost every major hospital will have a multidisciplinary conference and this brings all the doctors together So anyone who might be involved in patient care together and this includes the pathologists who look at the cells And you saw from dr. Kim and it calls including the radiologists who look at the cancers from that point of view and All of these people get together We get a consensus sort of agreement on how things are looking because we really learn from each other And we also yell at each other sometimes Because not everything has a single answer. There are often multiple ways to deal with something Oh, I think we have a picture of dr. Kim right here conference and We have to go through that and that way also you don't have to run around all different hospitals Right, you have one space and you get an opinion now when you get the opinion There you're gonna go over it with your physician team and I decide do I like this? Do I not like this but this gives you one place to go and so if I had a tumor I want to go someplace that has a multidisciplinary team So the goals for this lecture are really to describe the use of radiology in screening staging and planning therapy Treatment and follow-up because we're sort of involved in all of those areas and you're a very very organized audience But whenever I do a lecture, I was like to define what we're talking about So tumor equals mass equals cancer to me and in an oncology So we use these terms you might see them in your radiology reports So unless you know you have a benign disease Mass is always something to think about right tumor mass cancer an image just a picture, right? Cat scans are CT scans those are the ones that you go through you get the injection and they only take like I can do the whole body now in 19 seconds So very very fast. So it's a really fast thing regarding people sometimes say they have an allergy to the dye that we use It's pretty it's very uncommon now and when people ask me what the death rate is from the from an allergy It's the same as for penicillin. It's about one in a hundred thousand. So you shouldn't be worried about it Unless you know you've had a serious reaction in the past Then ultrasound is I think the easiest to undergo no dye no nothing you get to sit on the table and have a massage So that's good And then magnetic resonance imaging that has the scariest name we call it MRI but it's also another tube and you get to lie in the tube and It takes longer and it it sounds louder and we still usually give you dye Okay, why would I choose CT versus MRI and we'll go a little bit more into that But in general all of the literature supports that we have previously supports CT scanning So this goes back a long way, right? And so we have many many studies demonstrating exactly what each finding means Now during the last 10 years, which is as long as I think we've had good MRI imaging and it really changes almost every week practically I think you can use similar findings with MR It's particularly useful for certain kinds of tumors and also of course for the occasional patient who already has renal failure MR is a great option because when it still see a lot with patients with renal failure So renal obviously equals kidney and you also always gonna want to get reformatted images This is state-of-the-art now. It should be everywhere So that's when all the axial pictures little pictures are stacked up On top of each other and then we can cut it any way so we can look from the front which is a coronal or from the side Okay, which is a sagittal that's extremely helpful. So we get reformatted images on everyone So this is the renal mass, okay So this person unfortunately had already had a kidney out because I noticed it was done for a right lower quadrant transplant And so we take a look at the left kidney I always tell people ultrasound you're allowed to use the the labels because it's it's all looks kind of gray and this Ovoid thing is the kidney this whole ovoid thing and then there's a dark thing in the middle of it So the dark thing doesn't look like a cyst to me It looks like it's going to be solid and so it's actually a nice picture of a mass So we're seeing the word mass. I think it's most likely gonna be a cancer and then This person ended up getting an MRI and I'll show you why in a moment, but a lot of when we asked to say to that when you Last speaker said they want to see you from neck to pelvis It's because we find this kind of stuff too one We want to see if there are any metastasis anywhere else, but also we want to see if there's any other disease going on So in this patient, here's the cancer that we're looking at before But you see how the aorta which is the main aorta to main Supply to your body is split in half It's called a an aortic dissection So there's blood supply comes from the front aspect to the left and from the post your aspect to the right So we need to be able to know where that blood is going to come from so that when you have your surgery We know exactly what they're going to cut and where they're going to go Especially when they said the laparoscopic hand assisted Remember that when you're using that type of surgery the surgeons are going in through little tubes, right? Little little tubes and they're looking through the tubes and I got to tell them in advance. Whoa That that aorta split so we need to consider if it needs treatment before after and what we're going to do about it and This is what the chest X-ray looked on this patient So another thing that most people of renal cell carcinoma get at the very beginning is a chest X-ray and This thing up here. You're looking kind of sticks out, right? This is the right shoulder and the left shoulder This is the neck and this is where the abdomen starts There's the heart and there's this thing and that's the aorta That's where the dissection or the split starts so the order split in half very high up here and went down So looking at all the pictures together. We now have a Dissection we would call it that started at the top. We need to think about whether that needs to be Fixed before after dealing with the kidney. Okay, and then we have the kidney lesion and we know now which side the blood comes from So sometimes people we see lots and lots of you know, pretty healthy baby boomers But maybe they've got another disease We don't know about and even though we get there's a lot of discussion from Washington about Imaging and Lord knows I've been on the phone trying to get imaging agreed to in many many cases it is absolutely essential prior to surgery and last year because the government does things in such a wise way We got what's called a haircut in imaging. We got a 50% reduction in payment for all readings and all hardware costs Wham across the board. So they're obviously careful thoughts occurred in that and that's why we have to spend so much time on the phone Right the goal of insurance companies is not to make sure you're healthy Goal of insurance companies right now is to make sure they're making money for their stockholders And also the government is not really a thoughtful group right now and everything is changing all the time So I would also advise all these other things that you get an advocate for yourself in the financial realm too and that you make sure What how things are going to go and ahead of time? And I think that there's usually a financial services person at the hospital You may also want to network and talk with other people who've been through it because you don't want to get a $10,000 bill If it could have been handled earlier. I know you're scared I know things are rough, but the last thing you're going to need is a $10,000 bill when you have things to do So make sure you know what's going to happen But literally we took the haircut as we said last year and we have not decreased our services at all But that's you know, that's not going to happen forever So we'll have to see how that works out Okay renal cell carcinoma everybody's telling you okay, there's so many of them. What's going on? I don't know some of them are increasing for some reason maybe in our environment But a lot of it is that everybody gets a CT scan and it turns out I find one centimeter or two centimeter tiny CT tiny renal cell carcinomas all the time and Then there comes up later on which is the whole teams decision out there what to do about it Some people like choose to hang out with it. Some people say whoo, it's cancer. I want it out of me and Some people are sort of in between they'll watch it for a little while and there are some Rules and guidelines, but this is the case where you're making the decision on this the final call will be yours And so it's good to know what the guidelines are and your physicians can go over that with you And that's why I advise having the team approach with high quality physicians who do this all the time Because they will know what the current guidelines are So is there a screening test for kidney cancer? No, I don't have the silver bullet You know and there are some that are coming up now in imaging We're finally there where we're doing molecular imaging and Dr. Rathmell and I have done some work combining some of the medications with some findings on there, but Ultrasound or CT we do those patients with the genetic disorders like we talked about von Hippel-Lindau and other family syndromes We're gonna be screening those people so we're gonna see that and overall ultrasound is great for detection So a lot of people will have that early on we saw the black thing usually you can see it But CT is good for treatment planning. So you'll probably have those along the way How is CT done you've all had this okay every place is kind of different, but I usually obtain three sets of pictures The first two sets are basically used to determine the cancer how vascular is it versus how not how other things And then finally when I stack them all together I talked about making reformats That's when I decide on how many arteries there are how many veins there are is there any Complicating factor are there lymph nodes is there anything in the liver or is there a secondary lesion that I need to see Can MR be used instead? Yeah, if you're at a place where people read MR all the time so again Our hospital happens to have a very strong MR section that may not be true everywhere But CT is a really good test and I use only MR as a second choice test So what about pet and kidney cancer dr. Rathmill and I were talking about that and it's always been like no no no But now I think it's like soon, you know, and you're going to be hearing later on I think from a speaker specifically about that Right now we don't use it as a routine Okay, but I think pretty soon things will be changing But this is just a patient that I've treated not I've treated I've seen who has vulvar cancer and metastatic disease to the left chest wall and so We have the vulvar we have the bladder here actually the vulvar cancer has been removed These are the kidneys and you see how you're looking from the front now So this is right left superior inferior and this would be under the arm axilla and The chest wall so now the patient gets some therapy and This looks better But we have a new site in the spine So Pet CT or any pet relies on a snapshot of glucose in your body So if there's someplace that's very active with blood and sugar, okay, which tends to be most cancers It takes a snapshot of that location. And so that's really what you're looking at So pet is a nice whole body scan It doesn't really focus on little pieces and you also can't measure the size of the patient So sometimes we have to do two things or one thing one time in the CT the other time But pet is very useful for identifying you can see those bright things you could really see that but you can't measure the size Which is also critical for making a decision This is new technology. Dr. Rathbell and I will be publishing some work on this soon And we happen to have a combination of a hybrid pet and MR scanner So we're using the MR underneath in here. This is a normal kidney There we saw some blood supply there. This kidney is obviously abnormal much larger This particular case has a tumor in it and what we do is put the pet scan over it So we always put pet scans over CT scan That's how we started out that you still couldn't measure things the concept here is I can use this part of the scan Do all the accurate measurements and stuff and then we could use this part of the scan to see which parts of the tumor are active So we're trying now to put those two together. We have one of these machines There's now I don't know 30 or something like that. I still don't know if it's going to be a clinical Tool, but for certain people for children. I use it all the time There's a little book up there that said Wilms tumors really at the beginning. That's a special cancer of children It's a great tool. No radiation So you have a child who's going to live a long long life from a Wilms tumor. You don't want to rate You don't want to radiate that child So reading the scan I try to tell their your doctor is what they want to know how big the tumor is where it is How many there are and sometimes patients have a familial story? the relationship to the Arteries and veins and ureters how many there are where they come off again for the surgeons who are look going to be looking through those little tubes the presence or absence of enlarged lymph nodes measure those and find them and All distant disease I'm going to take a look at the liver and the bones and those kind of things So it really has a big sort of shopping center list for that So I just wanted to show you a couple pictures This is one of the very first patients I saw 12 years ago when I came to UNC 44 years old with a large mass and we needed to do some good Staging on this person and we I just got the right equipment for it at that time So this is the normal kidney here. This is the right kidney and this is the left And that's a big tumor right so quite a good size But hard to see where everything went I knew what where most of the vessels were but I really wanted to see the pancreas and some other things over it So here this is when I told you I stacked them up together all the pictures and now we're looking from the front Okay, and I can see that actually this tumors just in the upper half of the kidney And I can see that this arrow points to a piece of the pancreas so I can tell the surgeons It's right on it so when you're going to go in there watch out for the pancreatic tail And I can say oh here are the adrenal gland that's that little upside-down Y thing it's not involved So these are sort of just different things and over the years. I've learned to what people want to know I Don't use the the ones from the side as much, but it's really critical for me to get the ones from the front and How about what kind of cancer it is sometimes I can be helpful sometimes So here I know there's something wrong if you pick it pick a kidney that's wrong This looks like the good one looks like the abnormal kidney something's going on here But it looks like there might be a little clot in there Here's a more tumor and I was deciding which kind of kidney cancer it was there's certain, you know signals that I'm looking at but the presence of The clot was what really made the difference for me and that's where I saw it the best So this is the big vein coming from the the bad kidney and there is the clot inside it And that only happens with your standard renal cell carcinoma. There's another type of cancer called transitional cell carcinoma Also occurs in the kidney doesn't make clots And then also I wanted to tell like where the lymph node was oh here it is look It's at the lower pole of the kidney This is where the big vessel is and it looks like we can figure that out nicely and This one is where we learned a little bit about again other things This time the kidney was Here this one's a little bit smoother and denser, but I couldn't tell what cell type it is from looking that I don't have that magic glasses All I can do is tell you where it is and kind of what it's going to be but then this is important stuff How many vessels so if you're going to have your kidney removed that surgeon wants to know how many vessels and where are they? so usually I mean they're supposed to be one 25 percent of patients have two and Most of the time actually they go to the superior inferior poles We call it of the kidney, but these are all right in the middle It's gonna be a tough if you're gonna remove tough part of it and then while I was there I found out they had a kidney stone on the right Which doesn't seem like a huge yield that was why they came in pain You know on one side and find this other thing on the other side So another patient remember our dr. Kim was talking about dialysis patients who get cysts on their kidneys This patient we did a CT scan on and we had this thing is let's kind of solid kind of hard to tell This is how we measure the density 35 is about soft tissue is like oh might be and then it needs to assess what happens to it when we add Contrast material so now all of these dark things are cysts But look at this thing and when I measured it it doubled in density when you increase the density It's a cancer. It's a tumor and so I was able to find the one this that was problematic versus all the other ones So that's also trying to help out on what to do next and then just a couple other things that we can help out with This is a cancer.  It's pretty good the it's about 90% rate of Cure with this type of tumor compared with the surgical Approach, but we use this on particularly difficult cases very obese patients that sort of thing and as I said with dr. Rath mal and her colleagues We looked at some of these drugs that dr. Kim was talking about Sinitinib and seraphinib and those kind of things and when the patients got this This drug it's kind of interesting We've always used size as a very important indicator of whether the kidney is getting better or not, right? So this patient this is their kidney with the tumor in it and this is after they got The Sinitinib so there's all this dead tumor in there, but it's not very much decreased in size Even though there's been a really good response. So that's where radiology is changing in this area we have the Same type of thing going on, but this guy is A non-responder no real change in density or size Non-responder and this patient has plenty of tissue here complete very good response on this patient very dark so even though the size is the same the density is different and that may eventually come into staging and And you saw this from dr. Kim earlier We had different types of tumors and he showed you these different types of cells One of the things dr. Rathmell and dr. Kim work on is deciding which drug works for which Tell cell type because not everything is everybody. So thank you so much for listening and I'll be happy to talk with you Okay, thank you


Hi everyone. Hi Jim. How are you? Very good. How are you? Good morning. How are you? Doing alright. How about you? Another wonderful day in quarantine. Yep. So I see we had a presentation on the agenda from a Red Hat team. I was seeing that myself. Yeah, I added that. They reached out to me. We're directed from, what's his name? Anyway, they have a, it's from the IVM originally project actually, the multi cluster management or something. They have a policy component and they were interested. And I said, yeah, come on by and then asked if they wanted to present what their project was and how it relates to policy. Cool. Oh, which they're asking you about access. Does that sound like something I need to do? Zoom should be wide open. The only change Zoom has made recently is you have to kind of log in your Zoom account, which is just your personal thing. I'm not aware of any other. I unfortunately don't have access to the CNCF Zoom account. So I'm just a Joe user. Yeah, let's see if that works. Are they still having difficulty getting in? Yeah, they're just signing up now for Zoom. I don't know why Zoom made that change, but that's what I'm like. I think it was all the Zoom bombing at schools. Right. Yeah, Zoom is no longer just that it's now a thing. She's pretty crazy. Hi, Erica. This is Jaya. I was able to join. Hi, great. I know that was a little bit of technology glitch as usual, but yeah. Yeah, sorry, they were just talking about Zoom added the requirement to sign in pretty recently and we forget. Sorry for not letting you know so you could do that ahead of time. Okay, I'm going to give the same instructions to my team. Okay, I think we have only half an hour, right? So I think we have the whole hour registered, but okay, I mean, we have other things to discuss. That's fine. Yeah, so whenever you're ready for my topic, I think that's good. I think I have my team on the call. So I think you're good. Okay, let's check the agenda. Make sure we see if we have any other little items. So if you want to introduce yourself and talk about project or I'll hand it over to you. Awesome. Hi, everyone. Thank you for the opportunity to present in this forum. My name is Jaya Ramanathan. I am the Chief Security and Governance Architect for Red Hat Advanced Cluster Management, which is a new offering for Kubernetes cluster management that we released actually last week as a technology preview. So we're pretty excited about it. It is based on technology that is accessed originally in a multi-cloud manager product offering within IBM and we have brought it over to Red Hat and we have integrated and delivered it last week as a technology preview. So what I wanted to do today was to take you through a quick intro of the overview of the product and also do a quick demo. And I also have on the call several folks in from Red Hat who are also working in the space on security and compliance aspects. So why don't we have you, Oz and Jacob, you guys go ahead and introduce yourselves. All right. Thanks. All right. So my name is Juan Antonio Sorio Robles, but Oz is the shorter version. So I recommend you use that. I work in security and compliance at Red Hat and we are mostly doing open shift. So not a lot of upstream Kubernetes just yet, but hopefully that'll change. Happy to be here. Jacob. Yeah. I work on the same team as Oz. I don't have actually much to add to what he says, the same team, same job. So work on this open shift compliance operator. Yeah. That's pretty much it. Okay. Yeah. Hi, everybody. My name is Yu Tao. So I work with Jaya. We work on the same team, Red Hat Advanced Cluster Management. I'm the main engineer for the governance capability that you will see in a few minutes. Happy to be here. Okay. Awesome. So let me go ahead and share works. Okay. Looks like I will have to come back in because sharing permission for Zoom is not enabled in my thing. So let me go back. I'll come back in in a minute. Okay. Sure. Maybe we'll have a minute since we're a small group. Robert and Jim, you want to introduce yourselves to the new people? I think the other people, they know me. Yeah. Absolutely. Hi, everyone, and thanks for joining. I'm Jim Baguardia from Nermata and have been working with this group on some structure and I guess common machinery around policy management. So one of the open source projects that we lead is Kivirno, which is a policy engine for Kubernetes. And a definition that we are proposing as part of this working group is to standardize or have some common way of reporting policy violations. And also, you know, I guess policy execution reports, which based on gender, we can, and based on time, either we can discuss in this session or an upcoming session. Robert Fagalia, I've been active in the CNCF Sig Security Group now for, gosh, it's been close to a year, helping with the security assessment activities around new CNCF projects, and also active in this policy work group as well. And I also have recently started working with the Linux Foundation on Kubernetes training topics. Okay. Looks like at least it seemed to work. Can you all see the screen? Yes, we can. Okay, good. Let me put into presentation mode here. Okay. And I assume you can also hear me. So let's go ahead and start. So basically, the topic I'm going to be covering today is governance capabilities that we have within the Red Hat Advanced Cluster Management offering. And it is also part of the open cluster management community project. And so there is a way for, so that's our way to encourage collaboration across Red Hat as well as other third party products as well, and third party vendors, et cetera. So the whole idea of, I'm sure, since you're all part of the security work group, you're very familiar with these concepts. So I'll just quickly cover them. So by governance, what we mean is a structured way of operating an IT infrastructure based on well-defined processes, policies, and procedures, et cetera. And typically, that's what most enterprise clients do. So they have internal standards as well as, depending upon which industry segment they are in, they also have to deal with external standards, whether it's PCI, HIPAA, et cetera. So they have well-defined policies and use tools to implement those policies, et cetera. And the R in GRC obviously stands for risk. So the idea is you want to be able to identify risk areas and the priority of the risks so that IT operations can prioritize and remediate them as needed. And compliance, compliance is a very broad term. It is used in different ways. In the context of the work that we are doing, when we refer to compliance, we're talking about the governance that we put in place by means of defining policies, or we complain to those policies or not. So this is more focused on, I would say, technical controls and operational policies. So that's really the focus here. As opposed to compliance is also referred to in the context of external standards like PCI, HIPAA, FSMA, et cetera. So that's a different level. So there are two levels if you think about it. And as I walk through the architecture, you will kind of get a flavor of how we address both aspects. So the governance framework that we have put in place, we have several goals there. One is we want, we obviously want to deliver out of the box policies as many as possible for specifically the controls that we provide. So for example, if the OpenShift platform has security capabilities, we want to be able to deliver policies so that those can be configured correctly. And obviously the same set of policies, some of them also apply to vanilla Kubernetes environments as well, not just OpenShift. But at the same time, we want those policies to be customizable. And so that's one of our goals. The second goal is we want the ability to integrate data from third party controls, because we won't be the ones, we meaning Red Hat won't be the one providing all the controls. So and clients typically have security offerings and products that they already have in place and they may want to integrate those. And so we do need the ability to integrate third party. And then we have the overall dashboard and API for the posture and deviations from policies. And the dashboard itself has to be customizable for various standards. And you will see that when I show you the demo. The other goal we also have is we want the ability to add policies for different controls without having to make changes to our core policy framework. And that is another goal we have accomplished as well. And the other thing I also wanted to point out here is, though, you know, this group obviously is focused on security. When we talk about governance, it is not just for security controls. Governance could also apply to controls related to resiliency could be applied to controls related to software engineering standards and other aspects. So the policy framework is designed in a way that, you know, the policies can be applied across the board for all these aspects. So this is the overall governance architecture that we have. So if I start on the right hand side, we have three different ways in which you can incorporate policies into this architecture. The first is using this governance dashboard UI. So we have a policy UI, you will see that in the demo. And you can go and create policies there and then bind them to clusters where they apply using our placement policy. And so that's possible. You can also author policies using YAML and then import them using our CLI. And you can also use this mechanism called subscription, which is another concept we have within RACM. And the subscription allows you to tie a particular store. In this case, I'm showing GitHub where policies could reside, the YAML files. And then you can basically establish a channel for the subscription to go and retrieve the policies from GitHub. For example, it could also be an object store or some other repository. And then the subscription can then apply those policies to the hub, which in turn deploys them to the managed clusters. So the three different ways in which you can incorporate policies. One of the beauties of using GitHub kind of mechanism is it then allows the policy lifecycle to be managed, just like you would manage lifecycle for source code. So that is one of the advantages of using that approach. So those are three ways. And then once the policy is deployed at the hub, and then using the placement policy specify which managed clusters it applies to, the policy then gets deployed on the managed cluster. And that's the one on the left-hand side. And though I'm just showing one box here, obviously there could be multiple managed clusters here. And then within each managed cluster, you have a set of controls. And some could be had provided, others are provided by third party and clients. And then you have policy controllers that consume the policy. And then check the state, depending upon what control they are managing, they would check the state against the control and then return back violations. So those violations can be reported on the Rackham hub. So that's the overall governance architecture. So after this chart, I'll pause and take some questions. So the overall technical approach is to open source the policy framework and the sample policy controllers and policies. And the way we are doing that is through the open cluster management organization. So that is our GitHub project. And then for technical controls provided by Red Hat, we want to deliver out-of-the-box policy templates. And then within each policy there are annotations that allow you to specify their standards, controls and categories. So for example, you could imagine an enterprise client who is in the healthcare industry, they have to deal with HIPAA. They also have to deal with FISMA if they are interacting with Medicare and so on and the federal government. So when they put technical controls in place and they want to govern those controls using this framework, they want to say, okay, this policy applies to this control but it applies to both HIPAA and FISMA. So that is what these customizable annotations allow you to do. So this way they can get an overall posture view for various compliance standards. And this allows them to continuously monitor the security and audit posture. And then as I mentioned, the framework allows you to integrate policies for a third party. And the other thing I also wanted to point out here is we really are not tied to a specific policy language. So the way when you see our AML file, you will see that the specification for the policy for the control is actually wrapped by additional pieces that allows RACM to actually shift the policy to the managed clusters. But the actual policy itself could be, for example, written in OPA. It could be written in any other language. So in fact, you who is on the call here with me has authored a paper that shows how you can integrate OPA policies into this framework. Can I have one quick question there? Yeah. So just on that topic and we've been kind of discussing different policy frameworks and engines. So but what is the native you said with the best practice policies that you would provide what is the native engine used for that? So it's basically our policy framework. So one of the things is we support any policies for Kubernetes objects. So as long as you have a spec for a Kubernetes object, we can manage that. So that is one example, right? So we have a configuration policy controller that can manage configuration for various Kubernetes resources. So but then, you know, we also have policies for certificate management, etc. So those are they are defined using our own syntax. You want to add to that what I just said? Yeah, I want to add that we don't really tie to a single policy engine. So the framework we are providing is the governance framework. And then it allows us to propagate policies to different manage to manage cluster and then collect status back. So in terms of the policy engine, we can include them as part of our policy framework. And then the policy gets applied on the managed cluster and and the engine deployed on that managed cluster will be will be responsible for executing that policy. So we don't really tie to one single policy engine. Okay. And do you and these policies can act as admission controls or as, you know, sort of runtime policies? Do you support both modes or? Currently, our our our auto box policy are most mostly the the runtime ones. Okay. Great. Thank you. Any other questions? I'm just kidding. Is there kind of a dry run or a static analysis execution mode? So before you apply a policy, can you kind of see what the impact would be? Yes, we do support two modes. One is informed and one is enforced. The other is enforced. So informed is kind of dry run. It will just tell you what it looks like, what the violation would be once you apply it. This is kind of like a dry run. Yeah. Okay. I just have a couple more charts and then I'll switch to demo mode. So this kind of summarizes the governance lifecycle. So basically policies are created, as I mentioned, three different mechanisms and they can be propagated to the managed clusters using our placement. One of the things with respect to the placement policy is you can, for example, assign labels to the various managed clusters. So you could designate certain clusters as dev, certain clusters as broad, etc. And then the placement is you can either place a policy based on the label or you can place a policy on a specific cluster, etc. So it's pretty flexible in terms of how you determine which clusters the policies apply to. And then the policy controllers are deployed on the managed clusters. So the out-of-the-box policy controllers that we provide, they are auto deployed on the managed clusters when a cluster is imported or created using RACM. But other policy controllers obviously can be deployed later. So that's fine. And then like you was mentioning, we have an inform mode and an enforce mode. So this allows you to kind of decide how you want to deploy the policies. Obviously, some of the controllers support the enforce mode and others don't. For example, one of the policies we have relates to how many users have cluster admin access. And obviously, if that policy, we only support inform mode today because if the limit is exceeded, then the corrective action will have to be taken by the ops person, depending upon whose access they have to do some investigation to determine why the excessive access was there and take appropriate remediation. As I mentioned, the policy violations, when you see the demo, you will see they are organized by the compliance standards and control categories. And this is very key, which is other policies can be added without having to make any changes to the framework. So these are examples of some of the out-of-the-box policy templates that we provide. And in this chart, I've kind of mapped them to the NIST 853 control categories. And you will see some of these when I show the demo. The key thing I wanted to mention here is, though I've listed a few of the Kubernetes resources here, the framework is rich enough that it can pretty much manage policies for any Kubernetes resource. But I'm just showing examples here based on the mapping for the particular control categories. One of the things I wanted to highlight here is we do have a policy for CIS, but that currently works only for OpenShift 3.11. We are working on enabling it for OpenShift 4. We also integrate with a container security operator for vulnerability scanning. So we have a policy for that. So this allows you to detect vulnerabilities on pods if you're running on the managed clusters. And the certificate management policy, this allows you to specify a time bound within which it certificates expire until flag a violation. So you can keep an eye on certificate expiration. Okay, so the same set of out-of-the-box policies templates are mapped to the PCI control categories here. And this is the last chart. So as I mentioned, we have a community project, which is the open cluster management data project. And so basically RACM is derived from technology that's available there. We have not completely open sourced all the pieces. We are in the process of doing so. Some of them are already open sourced and the rest will be coming in our roadmap. As I mentioned, this technology has been derived from an existing product offering within IBM and it got moved over to Red Hat. So as part of that, the move happened this year. So we are slowly open sourcing all the various pieces with a goal to fully open source it. In this community project, we have a repo called Enhancements. And this is where we invite contributions from third party. And there is also a repo there for how to write a custom policy controller, which you has put together. So definitely welcome feedback on that as well. Before I switch to the demo mode, are there any other questions? And also Oz, you and Jacob, do you guys want to add anything at this point? Not at the moment. Okay. So one of the things, so just to mention, I know the chart really didn't point out the compliance operator work that Oz and Jacob and team are working on. So part of that project is based on the compliance as code community project. And what we are working on right now is to integrate RACM with that. So that basically means that you will be able to come in into RACM and author policies, and then have the compliance operator enforce and enforce session from those policies and return back results. The difference between the policies that we have and the policies that we would author for the compliance operator is the two levels that I talked about, which is the current policies that we have are all based on for specific controls and their operational policies. Whereas for the compliance operator, we'll be authoring think of it as a policy profile that actually specifies a set of rules for multiple controls. And the policy profile could be for example, for FSMA or PCI or things like that. So that's the concept we are going to be introducing. So this will then allow you to layer the compliance policy profile on top of the operational policies so that you can then answer questions such as, is this cluster operating to PCI readiness? Is this cluster operating to HIPAA readiness? And you will kind of be able to say that, I'll take the example of PCI. You'll be able to say, okay, there are 12 controls for PCI. You have governance enabled for maybe five of the 12 controls. And then for each of those five controls, here are the policies you have deployed. And here is the current posture. So this way, an enterprise client who is in the financial industry will be able to then tell how their cluster is operating to that particular standard. The other thing I also wanted to point out is the policy framework that we have here. As I mentioned in the first chart, we want this applied end to end across the entire hardware and software stack. So the idea here is that it can, though Red Hat is going to be delivering policies for Kubernetes clusters, the same framework can be used to bridge, for example, to Ansible and then manage policies for VM layer as well. And also, you know, middleware layers. So and we have some prototypes that IBM research has done that kind of show that that's possible. So and again, done with no changes to our policy framework. So this framework is pretty rich. And so that's kind of the intent here is to apply it across the entire stack. Okay, so let me go to demo mode. So you all can see the screen of the demo, right? Yes. Okay, so this is our Red Hat Advanced Cluster Management for Kubernetes. Also, we refer to it as RACM, which is just acronym. So this is the console. And so if you go to the console, it actually supports three life cycles. The first life cycle is cluster life cycles. So you can actually come in and you can import clusters and or you can create a cluster. We also support an application life cycle where you can come and define applications, which are made up of various pieces like a database, runtime environment, etc. And then you can use placement policy to deploy the various pieces to the various clusters that RACM is managing. And then the third piece is governance and risk, which is what I'm focusing on here. So the governance panel is what I'm showing here. And you can see at the very top, you see a summary that is based on standards. So as I mentioned, when you first deploy RACM, actually you won't see any policies. Because what we provide is a policy framework and a set of order of the box templates, but we don't deploy it, deploy policies out of the box.  I'm doing a live demo.  And then you pick a namespace. Now the namespace here is the namespace on the RACM hub where the policy is stored. And what this means is it allows you to assign different users access to different namespaces based on Kubernetes RBAC and allows you to segregate policies into different stores, different namespaces. So an example use case of this is if a customer has deployed a cluster and they want to share it across multiple departments and they want to have different policies deployed for the clusters, then what they can do is they can create a cluster for department one, another cluster for department two, and then they can import both those clusters into RACM or they could create both those clusters using RACM. And then they can create a bucket of policies for department one, another bucket for department two, and they could have different users doing that if they choose to do that. And using this namespace on the hub, you can enforce the RBAC. That's what this is doing. This doesn't represent the namespace on which the policy is deployed on the managed cluster. That is actually specified within the policy file itself. Okay. And then you can choose one of the out of the box templates that we support. And this is the specification here. So as you can see, we have a policy for certificate expiration, one for CIS, and we have a IAM policy for the limits. We also have a policy for image vulnerability. And then we have a set of policies all based on Kubernetes objects that for which you provide out of the box templates. So I'm going to choose the certificate expiration as an example. So then when you select the particular template here, the YAML file automatically gets populated on here. And you can see here for the certificate management policy, the expiration time is specified here. And you can actually change that. So this is where the customization can happen. And this namespace here, this is the namespace that determines which namespaces the policy applies to on the managed cluster. You can provide a list of namespaces that are included and namespaces that are excluded. And then you can see here that since we provide the certificate policy template out of the box, we auto fill in the standards categories and controls for it. And based on the NIST cybersecurity framework. But you can come in here and you can add additional standards. And essentially, all the standards are comma separated. And you can specify standards, controls, and categories. And this is how you can take a same policy and apply it to multiple standards. And then you can come and click here, whether you want to enforce the policy, if supported. So this is something, you know, you kind of have to check whether our auto box template supports enforced or not. And if it does, then you can click that here.  The cluster binding, this is the one that specifies the placement. So you can specify, you can select a particular cluster, which is in this case, department one prod is a managed cluster that is imported into this outcome. So you can select a specific cluster, or you can select a label. And so you could say, you know, apply this policy to all clusters deployed on Amazon, for example. Or you can say, you know, apply this policy to all OpenShift clusters. So, so this gives you the flexibility on how you specify the binding for a given policy. So once you do this, then the policy, then the policy will show up in this list. So what you see here is we have defined a set of policies using that mechanism. And as I mentioned earlier, the UI is just one way to do it. You can also just author the policy as a ML file and import it using CLI, or you can use the subscription mechanism as well. So, so in this case, the certificate expiration policy has, there is a violation. So you can see that the violation, so when you come to that particular policy and you click on the violations tab, that's when you see the violation. And in this case, you see that we have a certificate that expires in less than the time period that was specified in that in that namespace. And so it kind of shows you that. Another example is the image. Let's go and take a look at that one. So the image vulnerability policy, it is this one. So if I go and do an edit on it, you can actually see this policy. So what we have done here is we have added a policy to manage the container security operator, which is an operator that is delivered. It's available on operator hub and you can deploy it on the OpenShift clusters to detect image vulnerabilities on the running parts. So what we essentially have done here is we have defined a policy that ensures that that operator is running. And it also detects whether there are any violations. The way it detects violations is that operator actually creates this image manifest vulnerability object if there is a violation. So we have defined a policy, we have defined in this YAML that there shouldn't be any such objects existing. So if the objects exist, then we know that there is a vulnerability. And so that's what you're seeing here, where it's basically saying that there is a violation. So when there is a violation, let's see it should be showing the object name. Okay, maybe you can help here. But typically what you see here is a message that shows the object ID. And I'm trying to make sure that shows up and it's not coming up here. But anyway, so what you will see is the ID of the object or there it is. There always has to be a demo glitch. So what it shows here is this ID. So then what you can do is you can go to the OpenShift console for the particular managed cluster. And you can go and look for that particular object by searching it under this custom resource definition. And then when you go into the details of that object, you can actually look at the violation details. So essentially what we are doing here is the container security operator is running on the managed cluster. We are using RACM to define a policy that detects, first make sure it runs. And then secondly, if that operator detects any vulnerabilities, in which case it will create those custom resource objects for the image, manifest vulnerability type, then it will show up as a violation on RACM. And then that will then give you the ID. You can then drill down using the OpenShift console to get the details of the violations. So the compliance operator work that Oz and Jacob and team are working on, we are going to be doing a similar integration with RACM so that you can define a policy for it using RACM. And then the compliance operator will then enforce that or enforce, inform that policy and then return back violation results. I think it sums up what I wanted to show. And you can see that in the summary, or let me go into some of the details here. So this summary can be viewed either as a standard or you can view it by categories. So when you view it by categories, what you're seeing here is the NIST CSF category. For each category, how many clusters are in violation as well as how many policies are in violations. And you will see that both for the NIST categories and the PCI categories. Or you can view as a standard. And as I mentioned, you can add additional standards here. So if I'm a healthcare customer, you know, maybe I won't be interested in PCI, but instead what you'll see here is HIPAA or FSMA. Awesome. Maybe we can take questions real quick and then... Yep. I was curious, I may have missed it. Did you say that the policy violation results are a custom resource? Or there are some other persisted data? Yeah. So that is really the nice segue, right? The custom resource that I showed you, that is just for the container security operator. So they have defined their own custom image vulnerability type, right, to return the results back. One of the things, the reason I'm coming to this forum, or we are coming to this forum, is because we want to collaborate with you all to define more standard way to return compliance results, right? That applies not just to one control, but it also applies to multiple controls. And also have a way to do that so that, you know, we can slice and dice for standards, controls, and categories as well, right? So we don't have a standard definition yet. And I know that this workgroup has been working on such a definition. So what we really wanted to do was to contribute to that and implement that standard. Yeah, that is a good segue. And definitely we can, you know, kind of dive into some details on that. So one other question I had on the demo and so when you were going through, you know, the policy definition, it had something about enforce if available or there was a label like that. So what is that mapped to? And so I guess going back to also my earlier question on the runtime versus admission control, if some of these are applied as runtime policies, for example, if you're checking for things like, you know, resource quotas, etc., how would those be enforced at runtime? Yeah, so the enforce if available, as I mentioned, not every policy can be enforced easily, right? Some can be. And others are more, a little more complicated. So that's why, you know, if available, basically means the, whoever is deploying the creating and deploying the policies have to check whether this particular policy supports it or not. Right now it, right? And then if it's supported, then they can enable it. But we don't today support it for all the policies. Okay. And if it's supported, it's again, in the context of runtime definitions, what would that mean to a workload? So let's say I deploy a workload in a cluster and it's not compliant to a policy, what would enforcement mean? It will actually, depending upon what you specified in the YAML file, it will reward the cluster to what was specified there. So for example, you what would be a good example we could use to illustrate that which policy can I use? Let me share again. You can, I think you can use any like configuration policy, just enforce it, then it will create an object. So, so namespace is an example, right? In fact, let's see here, if I look at this namespace policy. So the namespace policy in this case, right, it is specifying that there should be a namespace, because it says must have, that has a name prod. Okay. So if the, now right now it is set to inform, but if this was set to enforce, then if the managed cluster did not have a namespace called prod, it will automatically create the namespace. So that's just an example, right? So you can essentially specify here any Kubernetes custom resource definition that you want to enforce. And it will basically reward the configuration on the managed cluster to what is specified here. Does that make sense? Somewhat. Okay. So this is more like just applying, this would apply that configuration that you've set up in the policy. Exactly. Okay. I see. And there would be then, if there's some variations, et cetera, that have to be handled, is there some way to then templatize that or specify those variables? I think so, meaning what you mean is, so as long as it fits into the specification of a Kubernetes resource object, then we are relying on, we'll just create that object on the managed cluster, right? And then whatever the underlying Kubernetes runtime that consumes that CR enforces, we automatically get it. So what we are managing is the configuration to the Kubernetes runtime. Does it make sense? Okay. So we'll just apply this particular configuration that's specified in this policy. Exactly. Exactly. Okay. Right. Yeah, go ahead. We do support multiple verbs. Like here, you see must have, and we also have must only have and must not have. So must have basically, it will make sure the whatever template you specified, the one that's actually created on the managed cluster matches whatever you're specifying the template. So for example, if the template you specified here is a subset of what's actually being created on the managed cluster, then it's compliant. So must only have means it should be an exact match and must not have basically simply means it should not exist. So this is three types of verbs we support. Like unlike OPA, that it actually provides you a language, right? Program, it's kind of like a program language that supports, it's more flexible. So we actually make it a little bit simple for user to use. So without having to learn how to use Rigo. Okay. All right. Thank you. Awesome. Thank you, Yu. Any other questions for us? Just a real quick one. Oftentimes as an auditor, I want to see not only the violations, but I want to see the explicit evidence that resources are in compliance. Is there a kind of a view or a dump of that perspective? Yeah. So right now we don't have the historical view yet, but it's definitely something in our roadmap. And I know Yu is actually actually actually working on that. So the idea there is that when you have a particular policy, it will kind of, because the policy controller is essentially checking the policy's compliance periodically, right? And today it only returns the current state or whatever is the point in time state, right? At the time it did the check. What we are also looking at is to maintain historical views so that you kind of know whether the compliance changed over a period of time, which I know is needed for audits, right? Which is have you been maintaining this for six months or whatever, right? So I think that is definitely in our roadmap and we understand that is needed. And the other thing we're also looking at is further more details, right? As opposed to just saying compliant and non-compliant, being able to have some additional details on the policy itself, etc., which are all needed for audits. So the audit evidence collection is something we will look at in our roadmap as well. But our initial focus is more on ensuring that the clusters are configured properly, right? For best practices and providing that visibility view. So that's the first, then we want to get historical stuff and then thirdly, get into more of the audit evidence collection. Just hoping in real quick, because I think it's really relevant what was the question that RF, I don't know who it is, but Robert, right, that Robert presented, which was my main concern with the proposal. I mean, Erica pointed it to me some time ago. And the only thing that besides wanting to look at more use cases, the only thing that in my opinion is lacking from the proposal, not Rackham, but I mean the proposal for the object that's going to represent policy violations is that exactly that. A lot of the times you don't really care about just the what failed in a policy, but there's more states to it, right? Usually you have like an informational warning or informational message. Oftentimes we'll have the policy passed and so on. So the way that we went around this, I mean we have yet another operator that does policies and like that could maybe in the next weeks explain about it because it's its own separate thing. But the way that we addressed it is by having something called the compliance check result and that contains both the severity of the check, the what do we have severity, the status if it passed fail, errored out, was not checked, was skipped and I don't remember exactly how many states do we have, but I mean I could present actually what we have real quick. Let's see if I can share my screen. Desktop, there you go, share, just something super quick. Do you see my screen? Yep, yes we do. Oh yeah, sorry about that. Gonna remove this one and there we go. So OC get compliance check results. So I ran, I was working on this and I ran a scan and it's just gonna tell me everything that happened for the cluster. So audit rules are failing in this cluster. Some audit B configuration is passing and so on. Ultimately what I do want is to know what failed. So I can see that effectively. In this case, maybe I want to check this specific rule in YAML format, please. Thank you. And this is basically what we have currently, right? The severity, status, what was the suite? We have a concept of compliance suites that run a bunch of checks. What was the suite that triggered this check? It has a name. What else does it have? Yeah, that's basically it's severity, status, some identification that is gonna appear in your compliance document or your audit results and a description of what was done there, right? So that having something like this would be really useful. We could easily just migrate to whatever you guys have, but ultimately it's something a bit more flexible than just violations. Right. Yes, so there is a, not sure if you got a chance to see this house, but there is a new version of a proposal I just shared on the channel as well as I put a link in the agenda. Could you share the agenda because I didn't get that link somehow. Yeah, I can, and I'll share the link again too, just to kind of quickly show what, so this is more like taking into, so I started updating the other document, but then figured it was just easier to write a new one because there were just too many different comments and changes to manage in the Google doc. So this proposal takes, so some of the main comments we got in addition to what you mentioned to provide a way to not just capture the violations, but even the results in terms of which policies were applied, what time, things like that also provide some flexibility in aggregating these results. I think there was another comment from, I think somebody else at Red Hat, right, Erica, if you're on aggregating these for like nodes. So that was, this new proposal allows aggregating results at different levels. And then also, you know, being more flexibility in terms of other custom data that we might want. So just to quickly show an example, and I was just trying to map it to, let's say you want to run a CIS, Gubernati CIS benchmark, right. And what's interesting in this case is it doesn't relate exactly to a Kubernetes object or resource, but it's relating more to components in the control plane and the worker nodes, so on. But the idea here would be to keep this reporting mechanism flexible enough to cover that, as well as I took another example, this is more for a workload like from Guvernum, where we're just reporting failures for pod security, right. So again, we're just showing a failure year, but the idea could be that you could also add success results, like which checks actually passed. And for each, you would have like a pass, fail, warn, info, and we can customize the categories. So anyways, I know we're coming up on time, but would be great if you want to take a look and we can exchange ideas on either the Slack or if you want to set up even a separate meeting before our next bi-weekly meeting. Happy to do that, because I think this would be good to hammer out and come up with something which is flexible and reusable, yeah, from different frameworks. All right, that sounds a bit more like what we were looking for. So I'm going to take a look at that and comment as soon as possible. Thank you so much. As we're running low on time, and if we do have a lot to discuss, we used to meet weekly, and then we moved every two weeks. Should we move back to weekly while we have lots of agenda items? Since we kind of ran out of time today. Thoughts or is it two weeks okay? Are we not that rushed? So I think if we can just maybe get comments and make progress even outside of these meetings, that may be better. Every two weeks is a good rhythm to kind of aggregate those. I think that sounds great. Yes, I posted the link here and again, in the Slack channel, I'll also add the link again and the agenda for the meeting has that. So definitely let's discuss more and then maybe by the time we have the next bi-weekly meeting, we'll have a more sort of finalized version and we can even draft up a CRD for it. Sounds great. Jerry, could you add links to your project in the agenda notes? And if you have, if the slides are public, that'd be great too. I linked the agenda in the group chat. Okay, did you? Yeah, there I see it. I'll do that. Thank you. All right, I'm super excited to see the, do we change the name now? It's policy report. Right, because it's no longer just violation. So yeah, and of the suggestions for better names, of course, we could augment that. Although it's policy, we need to make it sound very bland. Pureaucratic. No, this is, I'm really excited. Again, you know, glad to get hooked up into this work group. And I think the work is very timely because we are trying to, like I said, integrate this compliance operator and drag them together. And this is something we have to do. So it'll be great to make it a standard. So, you know, we're not doing proprietary. So it's great. Absolutely. Sounds good. Thank you for the presentation. That was awesome. Thank you very much. Thank you, Jim. Thanks, everyone. See you in two weeks. Bye. Bye.