are talking. Hello everybody and welcome to yet another OpenShift Commons briefing today as we like to do on Mondays. We like to have AMA ask me anything, questions about different aspects, technology initiative, different upstream projects. And today we have Jaya Ramatham and Yu Cao who work on our governance and security work at Red Hat. And they're going to talk a little bit about open policy agent, how and gatekeeper and how all that works within the context of some of our advanced cluster management product offerings. But we're going to have live Q&A at the end too. So wherever you are, please ask questions in the chat. It'll get relayed back to the speakers and we'll have some live Q&A at the end. So with that, Jaya, could you introduce yourself and you and take it away.  Jaya, there you go. Try that again. Still on mute you, Jaya. Hi everyone. Thank you, Diane. Hi everyone. Thank you for this opportunity. I am Jaya Ramatham. I am the Chief Security and Governance Architect for our Advanced Cluster Management Offering. And I have with me Yu Cao. He is the squad lead for our security and governance capabilities within both of us work on this project called Advanced Cluster Management for Kubernetes within Red Hat. And we also have an upstream community called Open Cluster Management. So we are here to talk about just some underlying principles and overall architecture of our security and governance capability. And then we will delve deep into OPA and gatekeeper and how that integrates with ACM. Okay. This chart basically talks about the various security and compliance challenges that customers face when they adopt cloud. Specifically, the key thing I wanted to highlight here is customers generally have to meet various enterprise standards as well as industry standards. For example, if they are in regulated industries like financial healthcare, etc, they have to meet standards like PCI, HIPAA, etc. And they also want to adopt open technologies. And they typically have to deal with more than one cloud provider. And they also need to go through multiple audits. So really what they're looking for is the ability to maintain security and audit readiness on a continuous basis. And they want to do this recording has started for open hybrid cloud. Should I start over or should I continue? You can continue. I can grab that last the first bit from from the live stream. Okay, awesome. So our approach to achieve that goal of continuous security and audit readiness is policy based governance. So what do we mean by that? Typically, if you take a particular cloud environment, say Red Hat OpenShift cloud platform and you want to secure it, you the customer would enable various security capabilities that OpenShift provides out of the box. And they may also want to use some capabilities provided by third party and some homegrown capabilities as well. And what they would like to do is to ensure that all these security controls are configured to industry best practices or their enterprise standards. And these standards could include standards from NIST like NIST CSF, NIST 853, and also like I mentioned, industry segment standards like PCI, HIPAA, etc. So the subject matter expert for a particular control knows very well how to get that control set up. But if you're talking about a SRE or a SecOps person who is responsible for ensuring that the configuration is set up properly, they may not be an expert on all the aspects of security. So how do we make this easy for them? So the way we make this easy for them is by ensuring that these best practices are represented as policies that result in a desired configuration state. So that's the overall approach and that's what we refer to as policy based governance. And in order to do this, what we have built out is an extensible policy framework that can be applied across the entire stack. It allows you to incorporate multiple policy languages easily. And so that's what we'll talk about in detail, the Gatekeeper OPA, which is one of the policy languages. And you will also show a demo on how that can be done. And we provide a lot of out-of-the-box content, but we want to make sure that content is customizable and we need the ability to easily integrate third party controls, etc. So that's kind of the overall approach of policy based governance. So I want to introduce some terminology here just to level set what you're talking about here. So if you think about policy based governance, right? So there is a policy authoring point where the policy is specified. Now this authoring point could be either the console or it could be a CLI or it could be GitOps. Our preferred methodology is GitOps. The reason being that allows you to manage policies just like your source code. So you define all the policies in Git. And then within our ACM product, you can define a subscription to pull those policies and deploy them onto the managed clusters. So that is our policy management point. So this distributes the policy, it consolidates policy violations across a fleet of clusters. It also allows you to integrate with enterprise tools from a central point. Because that is how customers view the cloud as just an extension of their existing IT infrastructure. So they want the management to integrate with their incident management systems, security operations center, their enterprise GRC tools, etc. And then the policy gets distributed to the managed cluster on the managed cluster, you have policy enforcement points. And these these consume the policy and they return the violations. So an example of enforcement point would be the Kubernetes Admission Webhooks. And also the runtime controllers, Kubernetes controllers themselves as well as several controllers that we provide. The configuration policy controller and the certificate management controller as well as any operator that runs on OpenShift Managed Cluster can also serve as a policy enforcement point. And one of the examples of the operator is the compliance operator that allows you to implement security profiles on your OpenShift clusters. So and then the policy enforcement point can optionally invoke a policy decision point to check whether a specified policy matches how control is configured. Now in some cases, the policy enforcement point may itself do this check. But in other cases, you could invoke a PDP. And the gatekeeper OPI integration is one such example and Kubernetes another example. So based on this terminology, here is the overall architecture. So as you can see here on the management hub, this is where the policies are defined. And as I mentioned, it can come through from Git, or it could be through UI or CLI. And then from here it gets distributed to the managed clusters. And then here you have the various policy consumers. These are essentially the policy enforcement points that I talked about. And then the these results are then collated back. And and so you have everything available in a central manner. There are a few roadmap items that we highlighted here, where we want the policy framework to associate ansible playbooks to trigger automated automated playbooks for policy violations. And we also want to integrate the policy violations and generate alerts to the observability component, which can then integrate with the enterprise incident management tools. And we also want to route audit logs to Sims for the security operations center. These are all the orange items in this chart or things that are roadmap items. So now I want to drill down into details of how we have integrated with Gatekeeper and OPA. So let me start with a quick overview of Gatekeeper and OPA. So Gatekeeper allows you to evaluate compliance of Kubernetes resources to specify policies. And what it leverages under the covers is OPA. And OPA is the policy engine that it uses. Now OPA itself accepts policies in a language called Regal. So think of Gatekeeper as providing the bridge from OPA to Kubernetes to the Kubernetes world. So it allows you to specify the policies as Kubernetes constraints, which can which can in turn contain the Regal constructs. And Gatekeeper can then consume those and because it registers itself as a policy enforcement point through the webhook. And so it's now able to pass on those Regal constructs to OPA and use OPA to do the actual checks of whether the policy is complied to. So two scenarios to consider here. One is the admission scenario. So this is executed whenever a Kubernetes resource is created or updated. And so think of it as once the Gatekeeper policy is in place, then any new resources that get created will be governed by this admission control. But what if some resources already exist before you put that policy in place? So that is the second scenario, which is audit scenario. So the audit scenario allows you to periodically evaluate existing resources against policies to detect any non-compliances. So in order to complete the picture, there were a couple of things we had to do in terms of how we integrated Gatekeeper and OPA into ACM. First of all, we are delivering going to deliver operator that can deploy Gatekeeper and OPA. And so this work is actually progressing in the upstream community. And what we have done is we have focused the community and made it part of our open cluster management downstream. So we will deliver this as part of the ACM product. So one of the cool things about the ACM product is our built-in policy controller, config policy controller, can pretty much distribute any Kubernetes CRs. Now the deployment of operators itself is represented as a CR. So by delivering Gatekeeper OPA as an operator, now you can just define an ACM policy that ensures that this operator is deployed on the managed clusters. So we are going to provide that. In addition, you can also use ACM to define policies on what Gatekeeper itself is enforcing. So the constraints that I talked about. So those can be also authored within ACM and propagated to the managed clusters. And then as I mentioned, there are two scenarios, admission and audit scenarios. So in both cases, we want to be able to detect policy violations. So in the case of the admission scenario, we have a ACM config policy that can process the events that are generated by the Gatekeeper webhook. And in the case of audit scenario, we look for the status field in the Gatekeeper constraints. So we are able to pull both this information back, as I showed in the architecture into the central ACM hub and display the results there. So this architecture diagram pictorially depicts what I talked about. So you have the ACM hub and then which is distributing policies to your managed cluster. And within the managed cluster, you have the config policy controller. And because we have this built-in config policy controller, the whole integration with Gatekeeper OPA is happening just through the authoring of these policies. So you really don't have to write any code. So we have a policy that we have authored to deploy the Gatekeeper operator. So that operator is then watches over this Gatekeeper CR. And then it registers this webhook that monitors the audit admission scenarios. And then you will also have a policy to deploy the Gatekeeper constraints. So and then we have a policy, as I mentioned, to detect the violations, two policies, one for audit and one for that mission scenarios. So U is going to give us a demo on these capabilities. But before I hand it over to you, I also want to highlight that we have also, we also have integration in place with ACM for the OpenShift Compliance operator, which is another, an example of an operator that can be deployed on the managed cluster. And through a RACM policy, we can make sure this operator is deployed. And we also have another policy that allows you to specify a profile, security profile that detects the compliance operator to perform the compliance checks and return results back to us. So we'll show a quick demo of that as well. That kind of is the quick short overview. And I have in this chart a link to our open cluster management community. And you can connect with us there and ask any questions, etc. Before I turn it over to you, I also want to give you a quick demo of our open cluster management community. So as I mentioned, when I provided the overview of policy-based governance, typically you have various controls in place. And the controls could be for security, could be for resiliency, could be for software engineering. And you want to ensure that all these controls are configured properly to industry standards and enterprise standards. And in order to do that, our goal is to codify those standards as policies. And so it's very clear that Red Hat on our own cannot produce all the policies needed by all our customers. So that's why we have created this policy collection repo. So it's a spot for us to collaborate to build out these policies. So if you look at this repo, we have two folders, we have a community folder and we have a stable folder. So the stable folder includes all the policies that are delivered as part of the ACM product. They are fully supported by Red Hat. And these policies are organized in terms of the NIST 853 standard. So you have various controls within this security controls within this catalog. And then for each of the controls you can see we have defined policies. So and you is going to show us a demo of the compliance operator policy that can deploy the compliance operator and also this essentially a security profile policy that allows you to scan the managed cluster for this particular security profile. And then for Gatekeeper and OPA we have policies as well. And then there is the other folder here, which is the community folder. So the community folder is where we invite contributions from the community. And these policies are also organized in terms of the NIST 853 standard. And the Gatekeeper policies currently are in the community. And the reason is because we are currently working on an ACM release where we are productizing this capability. So they right now sit in the community. So you have a Gatekeeper operator policy that allows you to deploy the Gatekeeper operator. And then we also have other policies for Gatekeeper contributed here as well. So so you can see here we also have third party contributing policies here. So you will see here a policy from SISTIC. They have contributed a policy for their operator. So the reason I wanted to highlight this is to invite contributions from the community. So we are also working with various customers to have them contribute here as well. Jay, if people I think the OCM team group is meeting on a semi regular basis now, have they started the community meetings? Yes, we have started the community, the open cluster management as a community meeting that happens weekly. And definitely, you know, invite participation in that as well. So I can include that link as well into the chart. Okay, that would be great. And there's there's one quick question here before we go to the demo Tobias is asking if if the Gatekeeper community would announce mutating admission controller, will you integrate such an option into RACM? Yes. So we are active participants of the Gatekeeper community. You who is here on the call with me along with a couple of others from Red Hat are active contributors there as well. So we are watching the space there. And our goal is to keep up with any enhancements that are made in Gatekeeper and associate policies in RACM to adopt those. Yes, that's our goal.  Because I have that's that's a wonderful way to pronounce it. So I'm going to use that going for it. So thank you. That's a good point. Let me clarify RACM and ACM stand for the same thing. ACM is Advanced Cluster Management and RACM is Red Hat Advanced Cluster Management. The same product offering and our upstream community is the open cluster management community, which is this one. And Ginny just shared a link in the chat for the open cluster management community. There's a projects page in the repo that you can find the agenda and things like that for the upcoming meetings. So I'm going to stop sharing now. And turn it over to you. Perfect. Yeah, welcome for the questions as well. Thank you. All right. Let me share my screen first. Right. So hi everybody. My name is Yu Tao. So I'm the dev lead for RACM security and compliance team. So today I'm going to do a quick demo for how you can use RACM policy to install gatekeeper and then apply a gatekeeper constraint on the managed cluster and then report any violations it detects. So first of all, let me recap a little bit about the governance and risk architecture in RACM products. So if you go to our product documentation, there's an overall architecture diagram here. So if you click on it, you'll see a large diagram. So the governance policy framework we put in place, it really consists of multiple piece, right? So there's a one piece on the hub and there's a few piece on the managed cluster. So on the left, so on the hub, so we have policy propagator, which responsible for propagating the policy from hub to manage cluster. So how it how it does is so when you create a policy, you need to also create a placement binding and placement rule. So if you look at the sample here, so we have a policy CRD, which is the CRD that we use to embed your real policy. So if you look at the CRD definition here, so we have a field called policy templates. So inside templates, you define the actual policy you want to apply on your managed cluster. So you can create a policy with multiple policy templates using different policy language. And then once this is created, you create also create a placement rule. So since Reckham is managing the is a control plane that managing multiple clusters, right? So when you import a cluster, you can label a cluster. So the placement rule simply here is you can select a cluster either using the label selector. So we call cluster selector. But what really does is it's using labels on the cluster so that you can you can select a subset of cluster of a divine. For example, in this case is all your deaf clusters and then create a placement binding that find the policy and placement together basically tell our policy propagator to this policy needs to be applied to these clusters. So this is how we propagate policy to manage cluster. So the reason I explained this is so this is the framework that to distribute policies and the actual the actual policy that is being executed or evaluated on the managed cluster is we call it policy controllers or policy consumers on the manage cluster. So the framework propagates the policy to manage cluster, distribute them to manage cluster and then hand it over to the actual policy consumer installed on your manage cluster. For example, the gatekeeper policy consumer or compliance operator or the auto box policy controller that we ship, recommend ship, for example, the configuration policy controller. So once it is it reached the manage cluster, the actual policy consumer on the manage cluster will will apply evaluates the policy past past in and then return and then generate results. And the policy framework will retrieve those results and return it to hub so that you can you can view the results through single control plane using Recon console. So that's the governance framework policy framework and we put in place for Recon. So in terms of gatekeeper policy, so from this big picture, so gatekeeper controller is one of one of the policy consumer from Recon policy policy framework perspective. Now so now let's take a look at the actual gatekeeper policy. So we've talked about that we can use a Recon policy to install gatekeeper and we can also use a Recon policy to apply gatekeeper constraints and then which collect the results back to hub. So this is done through defining Recon policy. So as Jay mentioned in this policy collection report, you can find you can find the gatekeeper operator policy and also some a few other gatekeeper policy that actually apply certain constraints on your clusters. So let me take a sample. Let me go through in details. For example, the first the gatekeeper operator gatekeeper operator is is an F is an effort that we will be actually involved in the upstream community. So the gatekeeper what gatekeeper operator does is it packs if the gatekeeper is an open shift operator. The operator responsible for the lifecycle of gatekeeper so it can install gatekeeper it can delete gatekeeper. And of course we are we will we are also working on upgrading those kind of stuff. So it controls the whole lifecycle of gatekeeper. It simply makes installing gatekeeper easier. With gatekeeper being delivered as a gatekeeper operator in ORM or in OCP catalog, you can use Recon policy to to to to install gatekeeper across all your managed cluster. So what you need to do here is you define a policy CR, policy CR here and then includes multiple templates. So just very similar to how how you install an operator from ORM. So you create a namespace. We define the catalog source. Currently the gatekeeper operator is not published yet. So we have to define a cat custom catalog source. And then you create a operator group to tell operator which namespace to operate on. And then the subscription to subscribe to the the catalog to pull down the gatekeeper images.  This gatekeeper CR is part of gatekeeper operator. So it tells you how to configure gatekeeper. But if you create this CR, the gatekeeper operator will install the gatekeeper based on the spec the configuration provide. If you delete this gatekeeper CR, the gatekeeper operator will delete the gatekeeper instance on your cluster. So here as you can see, we are pulling an image from upstream gatekeeper. As this is and then we enable the admission events flag so that we can we can so that when there's a violation generally for for for any new when there's a violation generally for any new is a new resource created on my cluster that being that was that is blocked by this gatekeeper. It will generate a kubernetes events. So this is for the purpose. This is for the purpose for Reckham to be able to collect the result for admission admission scenario. So then so once this this this policy is created, you were and by created then it will based on the cluster selected here, right? So it will install the the gatekeeper operator on managed clusters. So for this is the Reckham console. So I have a gatekeeper policy operator policy installed here. So as you can see, this policy currently is being applied to this this managed cluster. So if you go to this managed cluster here, it was so this is currently being this policy is being forced and is compliant. So this means the operator has been installed on your managed cluster. So if you go to the ocp console here on this managed cluster, this is not managed cluster. Let me open. This is the managed cluster. And then if you go to operator here, go to install operator, you will see gatekeeper operator here. So it is so very simple. So the you just need to use this operator. You just need to use Reckham to install this operator for you. And then the gatekeeper is installed on a managed cluster. So now let's take a look at the how you can apply gatekeeper constraints and then report report violation back. So installing gatekeeper is just the first step, right? What what's really what really has value is you want to apply gatekeeper constraint and constraint template and then collect results back. So here we I create a sample. I create I create a gatekeeper sample policy here. So I think it's easier to look at in here in this code. So gatekeeper. So this is from the gatekeeper. This is from the policy collection repo. You can find it. You can find it in policy collection repo. So in here, we are using the same policy CR to distribute the gatekeeper constraint constraint template. As you can see, we have three templates here. If you look at the details, right, this, this is actually leveraging the configuration policy, which is the auto box policy consumership in Reckham. So what it does is what it does is it can create update, delete resources on on the cluster based on the template object definition you provide. So if you look at the the CR CR fields here, so you create a configuration policy, it has object templates inside the spec. So in this object templates, anything defined in this object templates template field is the actual CR you want to create in this example. So currently, we are we are using compliance type must have, which means you must have an object with this CR. So look at this. So this is the gatekeeper constraint template, right? So basically how we integrate is you are if you have good constraint template and constraint CR already, so you can use configuration policy to create an on the managed cluster. So what you just need to do is you just need to embed the constraint template inside a configuration policy and then put it into policy CR, which is responsible distributed across all the managed cluster. So that's how how the constraint template is delivered to manage cluster. So you don't you don't have to write any code, you just need to create this policy and embed your constraint template thing for the constraint here. Then the Reckham policy framework will create these two CRs on the cluster on the cluster and then and then gatekeeper gatekeeper instance, the controllers were taken over and evaluate these these two CR. So if you look at details of this CR, this is a sample namespace constraint template constraint I took from from gatekeeper gatekeeper website. So what it does is it requires any any names and a this regular basic defines any input resource resource needs to have a field called label and inside that label field, you need to have a you need to have a have a have a label with name with name with certain name. So the name is being exposed as a configurable parameter called labels. And in the inside constraint, so you're basically basically applying this constraint template. I'm here I'm applying on any namespace. And also I restrict the namespace to be these two these these two namespace because I didn't want to apply all want to apply to ordinary space. But if you remove these it will it will be all namespace. And that and then I want the actual labels to be gatekeeper. So so for so for example, if if if so if we want to test this this policy that this gatekeeper constraint, basically we can just go ahead and create a namespace without label gatekeeper, then it will be blocked. So let me do do that. Here I believe I've already logged on the log in on to the gate the the manage cluster. So let me double check. So here on my manage cluster, for this this deployment, I'm actually applying to these two namespace. So if I try to create a namespace, if I do this directly, it will create a namespace without any labels. So you can see here, the gatekeeper actually detect that and block the creation of this namespace. So that means the gatekeeper constraint constraint template that we are that we are applied that we are applied using Recom policy is actually in place and and and working. So that's how we distribute and apply a gatekeeper constraint constraint template from Recom console by using a Recom policy. You don't have to log into each manage cluster and apply it. You just need to do it centrally through Recom control plane. Then it's the violation part. We want to be able to collect violations. So if you look at look at the the other two templates that we are embedding in this policy CR. So here, as you can see, we create another configuration policy, right? This is for audit scenario. We name it policy gatekeeper audit. So what it does is it it is looking for any CR on the managed cluster called KS required label. This is the constraint that we created in previous object template. But additionally, we are adding additional fields to it. So what it means is we want we want it is we are using must have compliance type here. So what it does is we require we require on your cluster you need to have a CR called NS must have gatekeeper with this kind in API version. Additionally, we expand the status field with total violation zero. So this is for audit scenario. So the way it works is so once this is this constraint is being created on the managed cluster. So gatekeeper audit controller will start to scan your entire cluster and then try to figure out if you have every any pre existing by a non compliance exist. So if there is any, it will actually update the status field to tell you, oh, there's some some violations pre exist. So it will increment the number here. So currently we expect the number to be zero. So if it's not zero, then this this policy will return non compliant. That's how we collect the results. So if for for that's how we collect results for audit. And then let's look at the dimension scenario for the mission scenario saying we are creating another configuration policy and we are looking for events events for this constraint template for this constraint case required labels and then with name and as must have go gatekeeper. So basically so as you can see here we are using compliance type must not have. So we expect there shouldn't be any events with these annotation on the managed cluster exist on the managed cluster. If it exists that means there's violations. There's there's something wrong. So this policy will return non compliant. So now let's come back to the console here. So as I did as previously I did this, I try to create a namespace without label. So now as you can see here it is for this this admission template is report reporting non compliant and it tells oh there's an event exist in the gatekeeper namespace system. We can click on view details and take a look at what what exactly it is. So oh there's a this is this is what is violating this part of this policy. So this event exists but it should it should and if you click on your YAML it is going to pull the details of this event. So as you can see it tells you admission webhook that basically the request is being denied by this constraint from gatekeeper. So this is exactly the same error you've seen here in the command line. So this is how we implement gatekeeper with Recon. So we implement we integrate gatekeeper not only just installing the gatekeeper and then creating the gatekeeper constraint constraint template but we also collect the result for both an audit and an admission scenario. Okay that's my part for the gatekeeper demo. Just to quick mention thanks to the power of the out of box configuration policy controller shipped with Recon. So we are able to also of course install any operator. So for example compliance operator here. So compliance operator. So if you look at the YAML here this this policy is also you can also find an in-policy collection repo. So you can find it here so a very similar concept we use configuration policy to create namespace create operator group and create subscription. So then the compliance operator is installed on your managed cluster. And then you can trigger you can trigger a scan. So from using certain profiles. So here if you look at the the EA scan policy here basically this policy triggers trigger this policy triggers an essential a security profile scan on your managed cluster. And we are also using configuration policy to achieve that. So by just create using configuration policy to create scan-stated binding compliance suite and then collect the result back. So this is all done by doing just creating configuration policy. So you don't have to write any code. You just need to create a YAML of the policy and then you can integrate with compliance operator and as well as gatekeeper. Okay that's it from me. That's great thanks you and if I could this is Kirsten Newcomer if I could chime in just for a minute at the end of our conversation about the client compliance operator. There was in chat a conversation about the difference between the compliance operator and gatekeeper. And I think both Jaya and I weighed in and you did a nice job also summarizing that here. So the compliance operator is specifically focused on on regulatory controls technical controls that map to regulatory frameworks. I just want to share just because we're really excited. In addition to the E8 profile which is an essential 8 profile from Australia. There are some the the compliance profiles available with the OpenShift compliance operator includes some controls that meet NIST 800 53 regulatory requirements including at rail core OS not just the Kubernetes layer and we just shipped a profile for that is inspired by the CIS Kubernetes benchmark. So check that out if when you get a chance and I don't know if there are other questions. I've kind of been thinking of a few that I wondered if whether they might be helpful to folks and they kind of tie back to OPA versus gatekeeper versus the compliance operator. Jaya you mentioned kind of three types of policies policy categories. You mentioned security resiliency you also mentioned software engineering. I think we have I think maybe it would be useful to give some examples of each of them. Yeah does that make sense? Yeah can I can I share grab the share again? Please do. I think you should be able to see my screen right? Coming there it is. Okay so this is the policy collection repo and then if you go down to the bottom of this repo this page we have a lot of blogs here and one of the blogs I wanted to highlight here is this blog and this blog talks about how you can implement policy based governance using our configuration management capabilities right? And here we talk about like Christian you were asking there are best practices for three areas that I outlined which is security resiliency and software engineering and this blog goes into the details of how you can of examples in each of these categories right? So for example for security security regulatory compliance of the first one we list obviously is the compliance operator right? So we talk about how that can be configured using RACM and then we talk about the HCD encryption so there's a policy that's available to ensure that the Kubernetes HCD database is encrypted right? And and also you can remove the cube admin because the best practice obviously is to not use a single administrative account right? You want to be able to use different accounts for different users to have accountability and then policies for role-based access control and SEC security constraints etc right? So these are examples of security oriented policies but you can also have policies for resiliency so for example if you want to make sure that the logging operator is installed because you want to be able to collect logs to check the health of clusters etc so you can do that and many of the gatekeeper policies that we have as examples here I have to go back to the community. So there are gatekeeper policies for ensuring liveness check is in place and make sure you're using the latest container image you know these kinds of policies readiness probe is in place these are all resiliency related policies right? So so those are examples of that and then and then you can also set up policies for software engineering which is things like you know making sure that Kafka is in place because that is your standard for streaming right? So so those are the kinds of things you can actually author and as you was mentioning and the key point of this blog if I go to the conclusion here is right? The point is all of these policies can be put in place without programming and I wanted to really highlight that because our built-in config policy controller as I mentioned earlier can distribute any CRs so as long as you are able to represent a capability say for example as an operator an operator can be deployed using a CR right? And then you can configure the operator as long as it takes configuration as given it is the resource you can configure it and if it returns the results back as CRs we can process those as well that's really like you are showing in this demo we were able to integrate with gatekeeper because it met all those characteristics right? So we didn't have to really write code we just had to author policies so I think that's the beauty of this approach is it's very easy to put these best practices in place for your day-to-day operations without writing a lot of code. Yep Jaya are there out-of-the-box policies that are available that in the gatekeeper community I know you showed us the community for Wreckham the community branch what does gatekeeper provide out-of-the-box? I think many of the policies that we have put here in our community were contributed by our community of practitioners great right so they have their own community where they based on customer requirements they're building out policies right and then once they feel that the those policies are stable enough they then contribute into this community right okay and and then the next progression is if we find that there are enough customers asking us for a fully supported version of that policy then we promote that policy to stable right and it becomes part of our Wreckham product so that's kind of the three-step progression of how we are building our policies and moving them into fully supported versions. Great that sounds good let's see so you answered those example and another thing you mentioned early on in the conversation you kind of mentioned but you used three different words and I just wanted to see if there was clarity you said that there are of course admission controllers runtime controllers and then later you talked about admission and audit so I wondered I think the admission controllers were fairly clear could you give us an idea of what some of the runtime controllers are yeah or is that the audit yeah yeah let me go back to my to sharing my deck Jaya we lost your voice again can you hear me now yep perfect just going and getting my deck okay you can see my deck so I think if you look here let me go into that okay so the policy enforcement points right these are the these are the entities that consume the policy and return violations so this is where you know you have the admission webhook so anything that is plugged in into the admission webhook now gatekeeper is one example of that right that is plugged into that now somebody could write another webhook that is processing policies for example right as long as those that entity that is configured as a webhook is able to accept its configuration or policy as a community cr then you can use our built-in power config policy controller to distribute that to that right so that is one example right and then there are communities obviously is has its own runtime controller so for example when we propagate a policy for it cd encryption that is actually being enforced by communities itself right we don't have to do an external controller to enforce that right but then we have certain other controllers like the certificate management controller is something that we provide and that allows you to detect whether certificates are expiring whether certificates have wildcard certificates are being used etc right those are policies that you can define and that can be detected using that specific controller and compliance operate is another example right so okay I had thought of things like falco so so it helps me to understand that you mean it more broadly so right the afalco is here as well so that's another example of a runtime controller right thank you also just really quickly because I know you and I responded to Carolyn and chat but but maybe we'll just verbalize for for everybody else as well Carolyn had asked whether open shift is required on all clusters in order to use policy-based governance and no as as Jay said in chat ACM itself runs on an open shift cluster but ACM can manage other kubernetes distributions besides open shift today the compliance operator is only running on open shift it is designed to the content that's available which is written in scaps secure content automate security content automation protocol this is a standard that's required by a number of our customers which is why the compliance operator is written in scap it today we only have content for open shift and the operator mostly works on on open shift we want to extend it to other coop clusters in the future likely or at least share it upstream to make it easy for others to extend it although of course the project is is open source so you can do that today but again ACM itself can can manage both open shift and other kubernetes clusters with other kubernetes distros just to complement so the the policy framework the governance policy framework so the hub piece does require OCCP cluster but the the piece on the managed cluster we do support other kubernetes kubernetes flavor but also so but the outer box controllers for example the configuration policy controller it also support other kubernetes flavors so that means if you want to integrate something that it's not running on on kubernetes cluster but it can be integrated using configuration policy it is you can still do that and and also to add the gatekeeper operator also works on non-kubernetes environment non-ocp kubernetes environment so of course if you want to use OLM way to install it you need to install OIM but you can also install it without OIM so the upstream version actually supports multiple way to install gatekeeper yeah those are all excellent points you I think yeah I wanted to add here like if you go to this open cluster management policy collection report the very bottom that's where we have listed all our blogs so you can take a look at it also this is the open cluster management community so if you if you're interested in trying out this capability that's a good place to start and we have community meetings so you can definitely get engaged there and like you said you know for example if you want to try this out on a non-open ship cluster at least on the managed cluster side definitely you're welcome to do that I have one question this is Shana I have a customer who is running currently right now 311 I noticed ACM Rackham supports 3.11.200 and above and some of the policies when I install it it actually require like let's say image vulnerabilities and it will require container security operator on the managed cluster and I was just wondering like would all the policies will install operator for the managed cluster if there isn't or it is kind of a pre-rex depends on what policies that you apply to the cluster you want that makes sense like because there there are times that I would not know what my managed cluster has as an admin I will want policy A, B, and C and then when I create those policies and I figure out oh those clusters doesn't have it would like for a gatekeeper you will deploy the gatekeeper for the cluster but gatekeeper is actually only support 1.14 and above and so there isn't is that mean that I cannot have gatekeeper policies on the 3.11 cluster so yeah I can take that so yeah so as I mentioned previously there's two pieces the framework itself and also the policy consumer so the framework does work on OCP on OCP 311 but the policy controller or consumer on managed cluster it might not support OCP 311 so it's really case by case so if you try to create a gatekeeper on 3.11 then since it's using configuration policy it will try to apply the those CRs but since those CRs don't even exist on 3.11 it will return non-compliant okay so we'll have to all right so I'll have to figure out which one is useful and which one is not yeah and I think this is where I think the placement rule applies right so when you when you are applying a policy to a managed cluster you do that by using this concept called placement and one of the things that you can use is you can assign labels to your clusters and you can say that apply these this policy to a cluster that matches this label right so so what you could do is you could assign labels to your clusters depending upon what version they are etc right and that will kind of determine you know which policies get applied where okay that's a good idea thank you just thinking aloud is there's real customer questions they they are on 3.11 I just want to kind of pick your brain ticking the three last three minutes opportunities and so they they want to follow the needs standard right and so they're running they are moving to four but they not yet they're still on 3.11 what what are the policies that you would recommend them to start on doing with ACM if there is any documentation I can just take the link and read about it yeah I think the the the blog that I was sharing could be a good place to start let me I'll put that link in the chat so nice I want to go read I read them over the weekend they are super okay yes yeah so yeah we know the the compliance operator is not supported on OpenShift 3.11 there is a hardening guide for OpenShift 3.11 but there's not automation that I'm aware of does ACM have checks for OpenShift 3.11 like that mapped to NIST 853 or some other NIST framework I think the encryption policy at city at city encryption should work on 3.11 right did you support did OpenShift 4 support sorry yeah both OpenShift 3.11 and you can encrypt at CD in both OpenShift 3.11 and OpenShift 4 how you do it is slightly different however there are differences in implementation I just didn't know whether any of your other checks yeah I mean the other check is the certificate expiration that definitely should work I think that's another area that you could look at yeah so Shauna if it's for 3.11 this is Kirsten Newcomer feel free to shoot me a note knewcomer at redhat.com I'll see what I can do to to help you out okay thank you so much appreciate it great tool thank you and there's one question from Tobias in in the chat right now a question regarding the roadmap item in terms of audit etc does this include having a result that could state deny but not denying the actual resource creation and rather just firing a violation alert to SIEM meaning yeah okay you read that I think the gatekeeper audit scenario obviously we support right meaning when I say support that should work the roadmap item related audit was more on the hub being able to generate audit logs for policy lifecycle events and have them routed to Sims so that is something we are we'll work on in the future but the if you're talking specifically about the gatekeeper audit scenario that'll be fine you should be able to use that with that help now at the top of the hour and I'm sure both Paul and I who are trying to follow all of these projects in the CNCF and the new ones are incredibly grateful for you guys taking the time to explain all of this and it's really been helpful I will upload this video and get the slides from Jaya and put them together and tweet them out shortly and put them on somewhere we maybe we'll put them in a blog post as well somewhere so you can get them this was really really good and we definitely sounds like we're going to have to have you back as the OCM community grows and more of these policies are out there this is just a deep dive here and very good you thanks very much for the demo it was quite quite good so thanks thanks again and thank you everybody for taking the time and asking great questions so that I didn't have to this was this was good and thanks Kirsten for for jumping in there take care thank you everyone bye-bye see you


Carbon-based nanomaterials such as full arenas, CNTs, especially SWCNTs, and gonanoparticles have shown potent antimicrobial properties, with direct contact affecting microorganisms, cellular membrane integrity, metabolic processes, and morphology. The high surface-slash-volume ratio, large inner volume, and unique chemical and physical properties of carbon-based nanostructures make them promising for future antimicrobial research, and their uses-carriers for ordinary antibiotics may decrease resistance, enhance bioavailability, and provide targeted delivery. This article was authored by Salma's Maliki Dijic, Afsani Mennaati, Samira Jafari, and others.


Welcome to the Fiji Symposium 2019 in Cairo in Egypt, and I'm very pleased to be joining the studio today by Kwame Barachem Four, who is the chair of the ITUT Study Group 12 for Sandalization. Kwame, welcome to the studio. Thank you. Now, this symposium is all about digital financial inclusion. I wanted to ask you, in particular, from your experience, what role can governments play to enhance the usage of digital financial services at national level? From the study before Fiji, which was on the focus group on digital financial service, then we realized the ecosystems and among the governments were the regulators for the financial sector and also for the telecom services. But as we have this measure of mobile and money, which traditionally is of two government entities, this kind of measure, even though the ecosystem looks at it that way, should be again reviewed for the factors that I imagine out of this collaboration because now there are new stakeholders who are coming in, such as a phanteks, and then the consumer behaviors are changing. Again, if you look at how the roles each of them have to play, it should go beyond the memorandum of understanding and among the service providers between both the regulator of the telecom sector and the financial sector, how service level agreements are shared. So these are the critical factors which are needed among governments for them to bring more team ministerial, more team industry and stakeholder approach into their implementation and review of their digital financial inclusion. And the methodology that's been submitted to the ITUT study group for standardization, what would be the benefits of this new standard and how will it help telecom regulators? This is a new area. So testing identification of parameters has not really been done to the deepest extent. So there were a number of propositions of parameters for end-to-end identification of their mobile money transactions. So with this, there has been the methodology more of a field trial to see how the means of measurement is done. Many countries have already rolled out digital financial service, but how do they measure them? It could be over 100 different means. So it comes into study group 12. It's the way for member countries of which ITU has over 190 member states and with the various sector members who are into this to bring their ideas to bear on how best these parameters can be measured, especially for service level agreements, consumer protection and also certain targets. What has happened is that knowing the state of the market can only be measured with parameters. And especially now that countries, they are cross-border digital money transactions. It is important that the fields between either countries is known and what parameters they are measuring to know what levels are appreciated by the consumers. It is for this reason why it is very important that the work we are currently going on at ITUT and study group 12 member states and sector members who contribute to this work. And there's a lot of meetings that are organized obviously on a regular basis by ITU and its partners. What do you hope will come from this symposium? This symposium is very exciting. I've been to the previous ones and I see the lineup of activities that are for this symposium. I see that there's a lot more study and experience being shared and I think it's an opportunity for the ecosystem to network further, discover deeper and let financial inclusion be not just for a few, but for the purpose of that it is a global effect on us all. Fine words. Well thank you very much indeed for joining us in the studio and we look forward to catching up with you the next one. Thank you.


CHAPTER 27 MENA HARKER'S JOURNAL ONE NOVEMBER. All day long we have travelled, and at good speed the horses seem to know that they are being kindly treated, for they go willingly their full stage at best speed. We have now had so many changes and find the same things so constantly that we are encouraged to think that the journey will be an easy one. Dr. Van Helsing is laconic. He tells the farmers that he is hurrying to bistrits and pays them well to make the exchange of horses. We get hot soup or coffee or tea, and off we go. It is a lovely country, full of beauties of all imaginable kinds, and the people are brave and strong and simple and seem full of nice qualities. They are very, very superstitious. In the first house where we stopped, when the woman who served us saw the scar on my forehead, she crossed herself and put two fingers towards me to keep off the evil eye. I believe they went to the trouble of putting an extra amount of garlic into our food, and I can't abide garlic. Ever since then I have taken care not to take off my heart of veil, and so have escaped their suspicions. We are travelling fast, and we have no driver with us to carry tales. We go ahead of scandal, but I dare say that fear of the evil eye will follow hard behind us all the way. The professor seems tireless. All day he would not make any rest, though he made me sleep for a long spell. At sunset time he hypnotised me, and he says that I answered as usual, darkness, lapping water, and creaking wood, so our enemy is still on the river. I am afraid to think of Jonathan, but somehow I have now no fear for him, all for myself. I write this whilst we wait in a farmhouse, for the horses to be galt-ready. Dr. Van Helsing is sleeping. Poor dear! He looks very tired, and old, and grey, but his mouth is set as firmly as a conqueror's. Even in his sleep he is instinct with resolution. When we have well started I must make him rest whilst I drive. I shall tell him that we have days before us, and we must not break down when most of all his strength will be needed. All is ready. We are off shortly. Two November. Morning. I was successful, and we took turns driving all night. Now the day is on us, bright though cold. There is a strange heaviness in the air. I say heaviness for want of a better word. I mean that it oppresses us both. It is very cold, and only our warm furs keep us comfortable. At dawn Van Helsing hypnotised me. He says I answered, Darkness, cooking wood, and roaring water. So the river is changing as they ascend. I do hope that my darling will not run any chance of danger, more than need be. But we are in God's hands. Two November. Night. All day long driving. The country gets wild as we go, and the great spurs of the Carpathians, which at Varesti seemed so far from us and so low on the horizon, now seems to gather round us and tower in front. We both seem in good spirits. I think we make an effort each to cheer the other. In the doing so we cheer ourselves. Dr. Van Helsing says that by morning we shall reach the Borgal Pass. The houses are very few here now, and the Professor says that the last horse we got will have to go on with us, as we may not be able to change. He got too in addition to the two we changed, so that now we have a rude forehand. The deer horses are patient and good, and they give us no trouble. We are not worried with other travellers, and so even I can drive. We shall get to the pass in daylight. We do not want to arrive before, so we take it easy, and each have a long rest in turn. What will tomorrow bring to us? We go to seek the place where my poor darling suffered so much. God grant that we may be guided aright, and that he will design to watch over my husband and those dear to us both, and who are in such deadly peril. As for me, I am not worthy in his sight, alas I am unclean to his eyes, and shall be until he may deign to let me stand forth in his sight, as one of those who have not incurred his wrath. Memorandum by Abraham Van Helsing. For November. This to my old and true friend John Seward, a midi of Perfleet, London. In case I may not see him, it may explain. It is morning, and I write by a fire which, all the night I have kept alive, Madame Mina aiding me. It is cold, so cold that the grey heavy sky is full of snow, which when it falls, the settle for all winter as the ground is hardening to receive it. It seems to have affected Madame Mina. She has been so heavy of head all day that she was not like herself. She sleeps, and sleeps, and sleeps. She who is unusual, so alert, have done literally nothing all the day. She even have lost her appetite. She make no entry into her little diary. She who write so faithful at every pause. Something whisper to me that all is not well. However, tonight she is more vif. Her long sleep all day have refreshed and restored her. For now she is as sweet and bright as ever. At sunset I try to hypnotise her, but, alas with no effect, the power has gone less and less with each day, and tonight it fell me all together. Well, God's will be done. What other it may be, and with or so ever it may lead. There to the historical, for as Madame Mina write, not in her stenography, I must in my cumbreous old fashion, that so each day of us may not go unrecorded. We got to the Borgo Pass just after sunrise yesterday morning. When I saw the signs of the dawn I got ready for the hypnotism. We stopped our carriage and got down so that there might be no disturbance. I made a couch with furs and Madame Mina lying down yield herself as usual, but more slow and more short time than ever to the hypnotic sleep. As before came the answer, darkness and the swirling of water. Then she walk, bright and radiant, and we go on our way and soon reach the pass. At this time in place she become all on fire with yield, so no guiding power be in her manifested, for she point to a road and say, this is the way. How do you know it? I ask. Of course I know it, she answer, and this oppose add. Have not my Jonathan travelled it and wrote of his travel? At first I think some that strange, but soon I see that there be only one such by road. It is used but little and very different from the coach road from the Bucovina to Bistritz, which is more widened hard and more of use. So we came down this road, when we meet other ways, not always very sure that there were roads at all, for they be neglect and let snow have fallen, the horses know, and they only. I give rain to them, and they go on so patient, by and by, we find all the things which Jonathan have note in that wonderful diary of him. Then we go on for long, long hours and hours. As the first, I tell Madame Mina to sleep, she try and she succeed. She sleep all the time, till at the last I fear myself to suspicious grow and attempt to wake her, but she sleep on, and I may not wake her though I try. I do not wish to try too hard lest I harm her, for I know that she have suffer much, and sleep at times be all in all to her. I think I drows myself, for all of sudden I feel guilt as though I have done something. I find myself bolt up with the reins in my hand, and the good horses go along jog jog just as ever. I look down and find Madame Mina still sleep. It is now not far of sunset time, and over the snow the light of the sun flow in big yellow flood, so that we throw great long shadow on where the mountain rise so steep, for we are going up and up, and all is oh so wild and rocky as though it were the end of the world. Then I arouse Madame Mina. This time she wake with not so much trouble, and then I try to put her to hypnotic sleep, but she sleep not, being as though I were not. Still I try, and try till all at once I find her and myself in dark, so I look round, and find that the sun have gone down. Madame Mina laugh, and I turn and look at her. She is now quite awake, and looks so well as I never saw her since that night at Kerfax when we first entered the Count's house. I am amazed, and not at ease then, but she is so bright and tender and thoughtful for me that I forget all fear. I light a fire, for we have brought supply of wood with us, and she prepare food while I undo the horses, and set them, tethered and shelter, to feed. Then when I return to the fire, she have my supper-ratty. I go to help her, but she smile, and she tell me that she have eat already, that she was so hungry, that she would not wait. I like it not, and I have grave doubts, but I fear to affright her, and so I am silent of it. She help me, and I eat alone, and then we wrap in fur, and lie beside the fire, and I tell her to sleep while I watch. But presently I forget all of watching, and when I sudden remember that I watch, I find her lying quiet, but awake, and looking at me with so bright eyes. Once, twice more, the same occur, and I get much sleep till before morning. When I wake I try to hypnotize her, but, alas, though she shut her eyes obedient, she may not sleep. The sun rise up, and up, and up, and then sleep come to her too late, but so heavy, that she will not wake. I have to lift her up, and place her sleeping in the carriage when I have harnessed the horses, and made all ready. Madame still sleep, and she look in her sleep more healthy, and more redder than before, and I like it not, and I am afraid, afraid, afraid, I am afraid of all things, even to think, that I must go earn my way. The stake we play for is life and death, or more than these, and we must not flinch. 5 November morning Let me be accurate in everything, for though you and I have seen some strange things together, you may at the first think that I, when passing, am mad, that the many horrors, and the so long strain on nerves, has at the last turned my brain. Only yesterday, we travel, ever getting closer to the mountains, and moving into a more and more wild and desert land. There are great frowning precipices, and much falling water, and nature seem to have held some time her carnival. Madame Mina still sleep, and sleep, and though I did have hunger, and appeased it, I could not waken her, even for food. I begin to fear that the fatal spell of the place was upon her, tainted as she is with that vampire baptism. Well, said I to myself, if it be that she sleep all the day, it shall also be that I do not sleep at night. As we travel on the rough road, for a road of ancient and imperfect kinds there was, I held down my head and slipped. Again I vegged with a sense of guilt and of time past, and found Madame Mina still sleeping, and the sun low down, but all was indeed changed. The frowning mountains seemed further away, and we were near the top of a steep rising hill, on summit of which was such a castle as John Tellov in his diary, at once I exalted and feared, for now, for good or ill, the end was near. I voked Madame Mina, and again tried to hypnotize her, but alas, unavailing till too late, then ere the great dark came upon us, for even after sun down the heavens reflected the gone sun on the snow, and always for a time in a great twilight. I took out the horses and fed some in what shelter I could. Then I make a fire, and near it I make Madame Mina, now awake and more charming than ever, sit comfortable amid her rugs. I got ready food, but she would not eat, simply saying that she had not hunger. I did not press her, knowing her unavailingness. But I myself eat, for I must need now be strong for all. Then, with the fear on me of what might be, I drew a ring so big for her comfort, round where Madame Mina sat, and over the ring I passed some as a wafer, and I broke it fine, so that all was well guarded. She sat still all the time, so still as when dead, and she grow whiter and ever whiter till the snow was not more pale, and know where she said. But when I drew near, she clung to me, and I know that the poor soul shook from her head to feet, with a tremor that was pinned to feel. I said to her presently, when she had grown more quiet, will you not come over to the fire? For I wished to make a test of what she could. She rose obedient, but when she had made a step, she stopped, and stood as one stricken. Why not go on, I asked. She shook her head, and, coming back, sat down in her place. Then, looking at me with open eyes, as of one waked from sleep, she said simply, I cannot, and remained silent. I rejoiced, for I knew that what she could not, none of those we dreaded could, though there might be danger to her body, yet her soul was safe. Presently the horses began to scream, and tore at their tethers till I came to them, and quieted them. When they did feel my hands upon them, they veneered low as enjoyed, licked at my hands, and were quiet for a time. Many times through the night did I come to them, till it arrived to the cold hour when all nature is at lowest, and every time my coming was with quiet of them. In the cold hour the fire began to die, and I was about stepping forth to replenish it, for now the snow came in flying sweeps, and with it a chill mist. Even in the dark there was the light of some kind, as there ever is over snow, and it seemed as though the snow flurries, and the wreaths of mist, took shape as of women with trailing garments, always in dead grim silence, only that the horses veneered and cowered, as if in terror of the worst. I began to fear, horrible fears, but then came to me the sense of safety in that ring, wherein I stood. I began, too, to think that my imaginings were of the night, and the gloom, and the unrest that I have gone through, and all the terrible anxiety. It was as though my memories of all Jonathan's hard experience were befooling me, for the snowflakes and the mist began to veal and circle round, till I could get as though a shadowy glimpse of those women that would have kissed him, and then the horses cowered lower and lower, and, mundane terror as men do in pain. Even the madness of fright was not to them, so that they could break away. I feared for my dear Madame Mina, when these weird figures drew near and circled round. I looked at her, but she sat calm, and smiled at me. When I would have stepped to the fire to replenish it, she caught me and held me back and whispered, like a voice that when hears in a dream so low it was, No, no, do not go without. Here you are safe.  Thereat she laughed, a laugh low and unreal, and said, Fear for me. Why fear for me? None safer in all the world from them than I am. And as I wandered at the meaning of her words, a puff of wind made the flame leap up, and I see the red scar on her forehead. Then, alas, I knew. Did I not? I would soon have learned, for the veiling figures of mist and snow came closer, but, keeping ever without the holy circle, then they began to materialize till, if God have not taken away my reason, for I saw it through my eyes, ever before me in actual flesh, the same three women that Jonathan saw in the room, when they would have kissed his throat, and knew the swaying round forms, the bright hard eyes, the white teeth, the rhodicolor, the voluptuous lips. They smiled ever at poor dear Madame Mina, and as their laugh came through the silence of the night, they twined their arms and pointed to her, and said in so sweet tingling tones, that Jonathan said, for of the intolerable sweetness of the water-glasses, Come, sister, come to us, come.  God be sank, she was not yet of them. I seized some of the firewood which was by me, and holding out some of the wafer, advanced on them towards the fire. They drew back before me, and laughed their low, horrid laugh. I fed the fire, and feared them not, for I knew that we were safe within our protections. They could not approach me, whilst so armed, nor Madame Mina, whilst she remained within the ring, which she could not leave no more than they could enter. The horses had ceased to moan, and lay still on the ground. The snow fell on them softly, and they grew whiter. I knew that there was for the poor beasts no more of terror. And so we remained till the red of dawn, to fall through the snow gloom. I was desolate, and afraid, and full of woe, and terror, but when that beautiful sun began to climb the horizon, life was to me again. At the first coming of the dawn the horrid figures melted in the whirling mist in snow. The reists of transparent gloom moved away towards the castle, and were lost. Instinctively, with the dawn coming, I turned to Madame Mina, intending to hypnotize her, but she lay in a deep and sudden sleep, from which I could not wake her. I tried to hypnotize through her sleep, but she made no response, none at all, and the day broke. I fear yet to stir. I have made my fire, and have seen the horses. They are all dead. Today I have much to do here, and I keep waiting till the sun is up high, for there may be places where I must go, where that sunlight, though snow and mist obscure it, will be to me a safety. I will strengthen me with breakfast, and then I will to my terrible work. Madame Mina still sleeps, and, God be sanct, she has come in her sleep. Jonathan Harker's Journal 4 November, evening. The accident to the launch has been a terrible thing for us. Only for it we should have overtaken the boat long ago, and by now my dame, Madame Mina, would have been free. I fear to think of her. Off on the walls near that horrid place. We have got horses, and we follow on the track. I note this whilst Godolming is getting ready. We have our arms. Thus Goni must look out if they mean fight. Oh, if only Morris and Seward were with us. We must only hope. If I write no more, good-bye, Mina. God bless and keep you. Dr. Seward's Diary 5 November. With the dawn we saw the body of Goni before us dashing away from the river with their litawagon. They surrounded it in a cluster, and hurried along as though beset. The snow is falling lightly, and there is a strange excitement in the air. It may be our own feelings, but the depression is strange. Far off I hear the howling of wolves. The snow brings them down from the mountains, and there are dangers to all of us, and from all sides. The horses are nearly ready, and we are soon off. We ride to death of someone. God alone knows who, or where, or what, or when, or how it may be. Dr. Van Helsing's Memorandum 5 November afternoon I am at least sane. Thank God for that mercy at all events, though the proving of it has been dreadful. When I left Madame Mina sleeping within the Holy Circle, I took my way to the castle. The blacksmith's hammer, which I took in the carriage from the rusty, was useful, though the doors were all open I broke them off the rusty hinges, lest some ill intent or ill chance should close them, so that, being entered, I might not skit out. Jonathan's bitter experience served me here. By memory of his diary, I found my way to the old chapel, for I knew that here my work lay. The air was oppressive. It seemed as if there some sofferous fume, which, at times, made me dizzy. Either there was a roaring in my ears, or I heard afar off the howl of wolves. Then I besought me of my dear Madame Mina, and I was in terrible plight. The dilemma had me between his horns. Her, I had not dared to take into this place, but left safe from the vampires at Holy Circle, and yet even there would be the wolf. I resolved me that my work lay here, and that as to the wolves, we must submit, if it were God's will. At any rate, it was only death and freedom beyond. So did I choose for her. Had it been, but for myself, the choice had been easy. The maw of the wolf were better to rest in than the grave of the vampire, so I make my choice to go on with my work. I knew that there were at least three graves to find, the graves that are in habit, so I search and search, and I find one of them.  Ah, I doubt not that in old time, when such things were, many a man who set forth to do such a task as mine, found at last his heart fail him, and then his nerve. So he delay, and delay, and delay, till the mere beauty and fascination of the wanton undead have hypnotized him, and he remain on and on till sunset come, and the vampire sleep be over, send the beautiful eyes of the fair woman, open, and look love, and the voluptuous mouse, present to a kiss, and man is weak, and there remain one more victim in the vampire fold, one more to swell the grim and grisly ranks of the undead. There is some fascination, surely, when I am moved by the mere presence of such and one, even lying as she lay in a tomb threaded with age and heavy with the dust of centuries, though there be that horrid order, such as the layers of the count have had. Yes, I was moved, I, Van Helsing, with all my purpose and with my motive or hate, was moved to a yearning for delay, which seemed to paralyze my faculties and to clog my very soul. It may have been that the need of natural sleep and the strange oppression of the air were beginning to overcome me. Certain it was that I was lapsing into sleep, the open-eyed sleep of one who yielded to a sweet fascination. When there came through, the snow-filled air, a long, low veil, so full of woe and pity, so that woke me like the sound of a clarion. For it was the voice of my dear Madame Mina that I heard. Then I braced myself again to my horrid task, and found by wrenching o' way, tomb-tops, one-other of the sisters, the other dark one, I dared not pause to look on her as I had on her sister, lest once more I should become to be enthralled, but I go on searching until presently I find in a high great tomb, as if made to one much beloved that other fair sister which, like Jonathan, I had seen to gather herself out of the atoms of the mist. She was so fair to look on, so radiantly beautiful, so exquisitely voluptuous, that the very instinct of man in me which calls some of my sex to love and to protect one of hers made my head whirl with new emotion. But God be sanked that so veil of my dear Madame Mina had not died out of my ears, and before the spell could be wrought further upon me, I had nerv'd myself to my vile work. By this time I had searched all the tombs in the chapel, so far as I could tell, and as there had been only three of these undead phantoms around us in the night, I took it that there were no more of active undead existent. There was one great tomb, more lordly than other rest, huge it was, and nobly proportioned, on it was but one word, Dracula. This then was the undead home of the king vampire, to whom so many more were due. Its emptiness spoke eloquent to make certain what I knew. Before I began to restore these women to their dead selves through my awful work, I laid in Dracula's tomb some of the vapor, and so banished him from it, undead, forever. Then began my terrible task, and I dreaded it. Had it been but one, it had been easy, comparative. But three, to begin twice more after I had been through a deed of horror, for if it was terrible with the sweet Miss Lucy, what it would not be with these strange ones who had survived through centuries, and who had been strengthened by the passing of years, who would, if they could, have fought for their foul lives. Oh, my friends John, but it was butcher work, had it not been nerved by sorts of other dead, and of the living over whom hung such a pall of fear, I could not have gone on. I tremble, and tremble even yet, though till it was all over, God be sanct, my nerve did stand. Had I not seen the repose in the first place, and the gladness that stole over it, just ere the final dissolution came, as realization that the soul had been one, I could not have gone further with my butchery.  I should have fled in terror and left my work undone, but it is over, and the poor souls I can pity them now, and reap, as I think of them plastered each in her full sleep of death for a short moment are fading. For, friend John, hardly had my knife severed the head of each before the whole body began to melt away and crumble into its native dust, as those deaths that should have come centuries ago had at last assert himself, and say at once and aloud, I am here. Before I left the castle, I saw fixed its entrances, that nevermore can its account enter there undead. When I stepped into the circle where Madame Mina slept, she woke from her sleep, and, seeing me, cried out in pain that I endured too much. Come, she said, come away from this awful place, let us go meet my husband who is, I know, coming towards us. She was looking sin and pale and weak, but her eyes were pure and glowed with fervour. I was glad to see her paleness and her illness, for my mind was full of the fresh horror of that ruddy vampire sleep. And so, this trust and hope, and yet full of fear, we go eastward to meet our friends, and him, who Madame Mina tell me, that she know are coming to meet us. Mina Harker's Journal 6 November It was late in the afternoon when the professor and I took our way towards the east, once I knew Jonathan was coming. We did not go fast, though the way was steeply downhill, for we had to take heavy rugs and rubs with us. We dared not face the possibility of being left without warmth in the cold and snow. We had to take some of our provisions too, for we were in a perfect desolation, and so far as we could see through the snowfall there was not even the sign of habitation. When we had gone about a mile I was tired with the heavy walking and sat down to rest. Then we looked back and saw where the clear line of Dracula's castle cut the sky, for we were so deep under the hill whereon it was set that the angle of perspective from the Carpathian Mountains was far below it. We saw it in all its grandeur, perched a thousand feet on the summit of a sheer precipice, and with a seemingly great gap between it and the steep of the adjacent mountain on any side. There was something wild and uncanny about the place. We could hear the distant howling of wolves. They were far off, but the sound, even though coming muffled through the deadening snowfall, was full of terror. I knew from the way Dr. Van Helsing was searching about, that he was trying to seek some strategic point where we would be less exposed in case of attack. The rough roadway still led downwards. We could trace it through the drifted snow. In a little while the Professor signalled to me, so I got up and joined him. He had found a wonderful spot, a sort of natural hollow in a rock, with an entrance like a doorway between two boulders. He took me by the hand and drew me in. See, he said, here you will be in shelter, and if the wolves do come I can meet them one by one. He brought in our furs and made a snug nest for me, and got out some provisions and forced them upon me, but I could not eat. To even try to do so was repulsive to me, and much as I would have liked to please him, I could not bring myself to the attempt. He looked very sad, but did not reproach me. Taking his field-glasses from the case, he stood on the top of the rock and began to search the horizon. Suddenly he called out, Look! Madame Mina! Look! Look! I sprang up and stood beside him on the rock. He handed me his glasses and pointed. The snow was now falling more heavily and swelled about fiercely, for high wind was beginning to blow. However, there were times when there were pauses between the snow flurries, and I could see a long way round. From the height where we were it was possible to see a great distance, and far off, beyond the white waste of snow, I could see the river lying like a black ribbon in kinks and curls as it wound its way. Straight in front of us and not far off, in fact so near that I wondered we had not noticed before, came a group of mounted men hurrying along. In the midst of them was a cart, a long leader wagon, which swept from side to side like a dog's tail, wagging with each stern inequality of the road. Outlined against the snow as they were, I could see from the men's clothes that they were peasants or gypsies of some kind. On the cart was a great square chest. My heart leapt as I saw it, for I felt that the end was coming. The evening was now drawing close, and well I knew that at sunset the thing, which was till then imprisoned there, would take new freedom and could in any of many forms elude all pursuit. In fear I turned to the professor. To my consternation, however, he was not there. An instant later I saw him below me, round the rock he had drawn a circle which we had found shelter in last night. When he had completed it he stood beside me again saying, at least you shall be safe here from him. He took the glasses from me, and at the next lull of snow swept the whole space below us. See, he said, they come quickly, they are flogging the horses, and galloping as hard as they can. He paused and went on in a hollow voice. They are racing for the sunset. We may be too late. God's will be done. Down came another blinding rush of driving snow, and the whole landscape was blotted out. It soon passed, however, and once more his glasses were fixed on the plane. Then came a sudden cry. Look, look, look! See, two horsemen follow fast, coming up from the south. It must be Quincy and John. Take the glass. Look before the snow blots it all out. I took it and looked. The two men might be Dr. Seward and Mr. Morris. I knew at all events that neither of them was Jonathan. At the same time I knew that Jonathan was not far off. Looking around I saw on the north side of the coming party the two other men, riding at breakneck speed. One of them I knew was Jonathan, and the other I took, of course, to be Lord Goodalming. They, too, were pursuing the party with the cart. When I told the professor he shouted in glee like a schoolboy, and, after looking intently till a snowfall made sight impossible, he laid his winchester rifle ready for use against the boulder at the opening of our shelter. They are all converging, he said, when the time comes we shall have gypsies on all sides. I got out my revolver, ready to hand, for whilst we were speaking the howling of wolves came louder and closer. When the snowstorm abated a moment we looked again. It was strange to see the snow falling in such heavy flakes close to us, and beyond the sun shining more and more brightly as it sank down towards the far mountain tops. Sweeping the glass all around us I could see here and there dots moving singly and in twos and threes and larger numbers, the wolves were gathering for their prey. Every instant seemed an age while we waited. The snow came now in fierce bursts, and the snow was driven with fury as it swept upon us in circling eddies. At times we could not see an arm's length before us, but at others, as the hollow-sounding wind swept by us, it seemed to clear the airspace around us so that we could see a fall off. We hard of late been so accustomed to watch for sunrise and sunset, that we knew with fair accuracy when it would be, and we knew that before long the sun would set. It was hard to believe that by our watches it was less than an hour that we waited in that rocky shelter before the various bodies began to converge close upon us. The wind came now with fiercer and more bitter sweeps and more steadily from the north. It seemingly had driven the snow-clouds from us, for with only occasional bursts the snow fell. We could distinguish clearly the individuals of each party, the pursued and the pursuers. Strangely enough those pursued did not seem to realize, or at least to care, that they were pursued. They seemed, however, to hasten with redoubled speed as the sun dropped lower and lower in the mountaintops. Closer and closer they drew, the Professor and I crouched down behind our rock and held our weapons ready. I could see that he was determined that they should not pass. One and all were quite unaware of our presence. All at once two voices shouted out to HALT! One was my Jonathan's, raised in a high key of passion. The other, Mr. Morris's strong, resolute tone of quiet command. The gypsies may not have known the language, but there was no mistaking the tone in whatever tongue the words were spoken. Instinctively they reigned in and at the instant Lord Godolming and Jonathan dashed up at one side and Dr. Seward and Mr. Morris on the other. The leader of the gypsies, a splendid looking fellow who sat his horses like a centaur, waved them back, and in a fierce voice gave to his companions some word to proceed. They lashed the horses which sprang forward, but the four men raised their Winchester rifles and, in an unmistakable way, commanded them to stop. At the same moment Dr. Van Helsing and I rose behind the rock and pointed our weapons at them. Seeing that they were surrounded the men tightened their reins and drew up. The leader turned to them and gave a word at which every man of the gypsy party drew what weapon he carried, knife or pistol, and held himself in readiness to attack. Issue was joined in an instant. The leader, with a quick movement of his reign, threw his horse out in front and pointing first to the sun, now close down on the hill-tops, and then to the castle, said something which I did not understand. For answer all four men of our party threw themselves from their horses and dashed towards the cart. I should have felt terrible fear at seeing Jonathan in such danger, but that the ardour of battle must have been upon me as well as the rest of them. I felt no fear, but only a wild, surging desire to do something. Seeing the quick movement of our parties, the leader of the gypsies gave a command. His men instantly formed round the cart a sort of undisciplined endeavour, each one shouldering and pushing the other in his eagerness to carry out the order. In the midst of this I could see that Jonathan, on one side of the ring of man and Quincy on the other, were forcing away to the cart. It was evident that they were bent on finishing their task before the sun should set. Nothing seemed to stop or even to hinder them. Neither the levelled weapons nor the flashing knives of the gypsies in front nor the howling of wolves behind appeared to even attract their attention. Jonathan's impetuousity and the manifest singleness of his purpose seemed to overaw those in front of him. Instinctively they cowered aside and let him pass. In an instant he had jumped upon the cart, and with a strength which seemed incredible, raised the great box and flung it over the wheel to the ground. In the meantime Mr. Morris had had to use force to pass through his side of the ring of Skani. All the time I had been breathlessly watching Jonathan I had, with the tail of my eye, seen him pressing desperately forward and had seen the knives of the gypsies flash as he won away through them and they cut at him. He had parried with his great bowie knife, and at first I thought that he too had come through in safety, but as he sprang beside Jonathan, who had by now jumped from the cart, I could see that with his left hand he was clutching at his side, and that the blood was spurting through his fingers. He did not delay notwithstanding this, for as Jonathan, with desperate energy, attacked one end of the chest attempting to prize off the lid with his great kukri knife, he attacked the other frantically with his bowie. Under the efforts of both men the lid began to yield, the nails drew with a quick screeching sound, and the top of the box was thrown back. By this time the gypsies seeing themselves covered by the Winchester's and at the mercy of Lord Godolming and Dr. Seward had given in and made no resistance. The sun was almost down on the mountaintops, and the shadows of the whole group fell long upon the snow. I saw the count lying within the box upon the earth, which the rude falling from the cart had scattered over him.  As I looked the eyes saw the sinking sun and the look of hate in them turned to triumph. But on the instant came the sweep and flash of Jonathan's great knife. I shrieked as I saw it shear through the throat whilst at the same moment Mr. Morris' bowie knife plunged into the heart. It was like a miracle, but before our very eyes and almost the drawing of a breath the whole body crumbled into dust and passed from our sight. I shall be glad as long as I live that even in that moment of final dissolution there was in the face a look of peace such as I could never have imagined might have rested there. The castle of Dracula now stood out against the red sky and every stone of its broken battlements was articulated against the light of the setting sun. The gypsies taking us as in some way the cause of the extraordinary disappearance of the dead man turned without a word and rode away as if for their lives. Those who were unmounted jumped upon the litawagon and shouted to the horsemen not to desert them. The wolves which had withdrawn to a safe distance followed in their wake, leaving us alone. Mr. Morris, who had sunk to the ground, leaned on his elbow holding his hand pressed to his side, the blood still gushed through his fingers. I flew to him for the holy circle did not now keep me back so did the two doctors. Jonathan knelt behind him and the wounded man laid back his head on his shoulder.  He must have seen the anguish of my heart in my face for he smiled at me and said, I am only too happy to have been of any service. Oh God! He cried suddenly, struggling up to a sitting posture and pointing to me. It was worth for this to die. Look, look! The sun was now right down upon the mountaintop and the red gleams fell upon my face so that it was bathed in rosy light. With one impulse the men sank on their knees and a deep earnest, amen, broke from all as their eyes followed the pointing of his finger. The dying man spoke. Now God be thanked that all has not been in vain. See, the snow is not more stainless than her forehead. The curse has passed away. And to our bitter grief, with a smile and in silence, he died. A gallant gentleman. Note. Seven years ago we all went through the flames and the happiness of some of us since then is, we think, well worth the pain we endured. It is an added joy to Mina and me that our boy's birthday is the same as that on which Quincy Morris died. His mother holds, I know, the secret belief that some of our brave friend's spirit has passed into him. His bundle of names links all our little band of men together, but we call him Quincy. In the summer of this year we made a journey to Transylvania and went over the old ground which was, and is, to us, so full of vivid and terrible memories. It was almost impossible to believe that the things we had seen with our own eyes and heard with our own ears were living truths. Every trace of all that had been was blotted out, the castle stood as before, reared high above a waste of desolation. When we got home we were talking of the old time, which we could all look back on without despair, for Godolming and Seward are both happily married. I took the papers from the safe where they had been ever since our return so long ago. We were struck with the fact that in all the massive material of which the record is composed there is hardly one authentic document, nothing but a mass of typewriting, except the later notebooks of Mina and Seward and myself, and Ren Helsing's memorandum. We could hardly ask anyone, even did we wish to, to accept these as proofs of so wild a story than Helsing's some did all up, as he said, with our boy on his knee. We want no proofs. We ask none to believe us.  Already he knows her sweetness and loving care. Later on he will understand how some men so loved her that they did dare much for her sake. Jonathan Hawke, The End End of Dracula by Bram Stoker Recording by Corinne LePage