It is time to get started. So this is the Coverno introduction and overview session. If you thought that you were coming to something else, I'm sorry to disappoint you, but I hope that we're able to delight you instead. My name is Chip Zoller. I'm a technical product manager at Nermata, and I'm joined by my colleague, Dala Sharma. So my name is Dulles, and I'm a customer success engineer at Nermata, and I'm based out of Halifax, which is in Oaxaca, Canada. And I'm also a Coverno maintainer. And I do have a couple questions for the audience just by a show of hands. You can just look up from your laptop from just a second. So first question, please raise your hand if you're running Kubernetes in production at least one way. Who is running Kubernetes in production? All right, hands down. Raise your hands again if you are using some policy for your production Kubernetes cluster. Who is using some policy? Okay, cool, good to know. All right, hand it over to Dala's. Thank you, Chip. Okay, so today we are gonna talk about Coverno introduction and overview. I will talk an overview of why we need policies and what is Coverno and Chip will later on dig deeper into types of policies and some interesting use cases. Okay, so starting with that. Wrong direction. Okay, I'm sorry. So let's start with why we need policies today. So if I have to give you a general example that why policy, you can look at an example that using a single cube cut will come on. How can a user get access to the entire host? So he or she can run just a single command and they can get access to the entire host. There might be different reasons this might be occurring. First is that you might not even know that this is a bad pod and you're not supposed to run it. There might be other reasons like we don't have any guardrails in this environment. So these kinds of requests are not blocked. There are no policies that are running that is actually blocking or auditing these kind of requests. And then as more people get involved, they have different backgrounds. They have their own tribal information that they come up and they don't know what to do and what not to do. And of course, Kubernetes is hard. So someone who is new to Kubernetes will find it difficult to get everything in the first code. So yeah, we need policies. We need policies to make sure that such kind of incidents or scenario doesn't happen or is blocked or at least audited. So what can policy deliver? Policy can define laws and it can define some guardrails that can help you to block such kind of request. It provides a proper check and it makes you visible to your security posture of your cluster. So what you can do is using policies, you can define some rules, you can define some guardrails and make sure that the security posture of your cluster is good. Once you have these policies, you can centrally control them and when you're applying them, you get consistency. So you're applying these policies and you're getting security-wise consistency for across all your environment. Once you deploy policies, you'll get violations, you'll get a report, you'll see what's failing, what's not working. This will give you more visibility into your cluster, into your environment. And then policies can perform automations. So policies can do couple of things, they can automate couple of things. We talk about such use cases deeper in next slides, but yes, that is one more interesting things policy can do. And all of this, actually, the important thing is deploying policies, what policies can deliver is it sets certain expectations of others. So if such kind of requests are blocked, people know that, okay, these are the expectations and we are not supposed to deploy something like that, which all in one saves your time, it's reliable and it makes the security side of the cluster very easy. So a little bit about Qverno. Qverno means govern in Greek. It's a CNCF incubated project. It's a policy engine, which is a Kubernetes admission controller. It's natively built for Kubernetes, that means it is easily integrated for Kubernetes. You do not require any programming language to create a policy or write a policy. So if you know Kubernetes, if you are good with YAML, you understand the YAML, the syntax, the format of it, you are good. You can write your policy. There are a lot of policies available, but you can start writing your policy from day one. And it's most popular by start in the policy engine and we have the largest policy library of a policy engine. So if you go to qverno.io and if you see the policies, we have a huge amount of policies there for maybe every use case. So what are the overview and what are some Qverno features on an overview level? So we have validation, Qverno can provide you validation, mutation and generation with the help of these policies. So you can set up some rules and you can validate with the help of the policies. You can validate those rules against with what you are applying. So it provides you validation on the clusters. It provides you mutation to the existing resources. So you can say that, okay, this happens. This is a trigger. It should mute it. Some resources that are existing in Kubernetes. So it provides mutation. It provides generation. So you can create your own trigger in the form of policies and it can generate when that trigger happened in Kubernetes cluster. We have some image verification that Qverno can provide you. So it really helps you in verifying your images and then it generates a report that is created centrally when you deploy Qverno. That means it tells you that what is violation? What are the violations? What policies are violated with all kind of, like what deployments are being violated to what policies? So you get more visibility there and then we have Qverno CLI. So Qverno CLI, you can easily point it to a cluster and maybe do a dry run before you are deploying any kind of deployment. You can easily integrate it into your CI CD pipeline. So before you do a deployment, you can actually verify it whether it's security wise, good or should you have to do any changes. And what can Qverno deliver? These are some use cases, real life use cases that Qverno can help you with. So we have seen some, in the initial slide, in the last couple of slides, we see that there was this, using KubeCuttle you were able to deploy a bad pod and you can get access to the host and you can do all sort of things. So Qverno can help you block such kind of requests. Qverno can help you, not only that, but it can deploy best practices, policies, PSPs in your cluster and you can block such kind of request or you can at least have an audit that okay, these are some of the pods and these are some security wise, not good pods that are running in your cluster. It provides fine grade RBAC, that means a user with a role may create secret with a label, such kind of use cases, something that Qverno can help you with. It helps you in your cost control, for example use cases like, you need to tag particular cost, particular cloud resources like your load balancers or maybe your EBS and you have to generate a cost based on the tagging. So Qverno helps you in automating, Qverno helps you in tagging those resources running in your Qvernities and also it can help you with use cases like, okay, the service type with load balancer should only create a load balancer in AWS which helps with the cost overall. It helps in ops automation. So use cases like, think the config map whenever the new certificate is generated, it helps you in these kind of automation by generating new resources, by doing some kind of automations for you and then you might have a use case where you're using a shared cluster where there are multiple applications running on the cluster. So you need multi-tenancy. So you might need that, okay, when I create a namespace, five different things should be created automatically. It should be, I don't have to do anything, it's just the trigger is the namespace. Once the namespace is created, we need what we need, tech of policy, we need quotas and all those multi-tenancy resources and new Qvernities automatically created and set up for the developer. Qverno can do that for you using generate policy and then we have supply chain security use case. So how do you make sure that you're assigning your image and then you're validating it with what cluster is consuming? So Qverno can help you in these kind of complicated use cases as well. And there are more to that but these are some standard use cases and top use cases that you can achieve using Qverno. And here there is a sample policy on the screen. Now if you see this policy, if you're familiar with YAML, you can actually read that policy. So it's quite simple, it's quite easy to read. You know that it's standard YAML just like a deployment or a pod YAML. So you'll see there's an API version, there is cluster, I'll not go entirely maybe, but you'll see that this policy is applied to a pod. So you have a rule over there, it's applied to a pod, and then there is a message that will be thrown whenever the policy is blocking a pod. And then there is some kind of patterns that are, its policy is validating. So this is a Qverno policy that you can see and all these validate policies are something similar. So they're easy to, you can write it, they're easy to customize as well. So these are very, very simple. It's basic YAML over here. And these are, this is the application Qverno component that will be deployed on your cluster. So you'll see that there is an API request and Qverno actually interrupts that API request based on what policies you have applied and it can validate, mutate, and rate according to that. So there are some validating Webhook configurations, there are mutating Webhook configurations, and then there is cluster role and cluster role binding. So if you want to strictly tighten the Qverno's application permission in your cluster, you can do that. You can change cluster role, cluster role binding and you can restrict Qverno's permission to a particular namespace or if you want to tighten it further. There are custom resource definitions that is config map. So you have a lot of features that you can customize using config map and there is service account secret, the standard stuff. The Qverno deployments over here comes with, they're at a single pod, but it comes with HA. So if you want to deploy Qverno using HA, you can go with that. If you have a standalone cluster and you just want single pod, we have both the flavors of Qverno's deployment and then there's a service, of course. So yeah, this is what the application looks like and that's how the components are deployed on your cluster. And this is a sample policy structure. So we have already seen in the last slide that that was a validated policy. So it looks similar, that's the standard of how a policy is gonna look like. So policy can have one or more rules and it has a match and exclude condition. So a match condition is gonna match with certain humanities resources. For example, there is namespace, there is also this entire group it can match with. And in exclude, if you have some exceptions like, okay, my Qverno should ignore couple of maybe namespace, couple of user group, you can put it in the exclude section and then it have different clauses after the rule. It can actually, it performs the clauses and the clauses, it can mutate, it can verify, it can validate, it can generate. So mutate is gonna mutate existing resources, generate is gonna generate to you.  I think the further section will be taken by Chip and he'll dig deeper into the type of policies and some pretty interesting use cases. Over to you Chip. All right, thank you, Dallas. All right, so let's take a look at in a little bit more depth each of these capabilities that Qverno has and Dallas kind of laid out from an overview what they are. So validation rules. Validation, this is probably the most popular type of rule if you're using any policy engine today. This is your quintessential yes or no response. Here's a resource. I have a policy that says it should look like this. Do you allow it or do you not allow it? Qverno obviously does that quite simple. This occurs during the validation admission phase. So when the API server sends a request to something based on the definition of a policy, it goes through a life cycle or a tube if you will, and two phases occur. The mutation phase occurs first and then the validation occurs second. All of the validate rules occurs surprise during the validation phase, which is the last phase before it's accepted into a cluster. This is the most common rule type. So all of your things when you're thinking about pod security, making sure that pods and containers they're in don't run as root, making sure that you don't run host path, that you don't have a user that's number zero, all these types of things. These all fall under validate rules. There are two failure behaviors that Coverno supports today. The first type is called audit. This is where we will allow the resource to be created if it's in violation of the policy, but we will tell you about it in a policy report, which I'll get to later on. The policy report is just another standard Kubernetes resource. The second action is in force. This pod or whatever the resources, custom resources included, fails the definition of the policy. We will deny its creation. And there are two styles that you can write validate rules in. One is an overlay style expression. And that's the example that Dallas showed a few slides ago. This is what most policies in the validate rule or indeed most policies written in Coverno use a simple expression or a simple overlay style. This is very similar to how customized does it because we're actually using customized in some cases under the covers where you specify the portion of the resource in which you're interested in matching, not the entire representation of the resource, just a portion of it. Second way to write validate rules is with a deny condition. So conditions in Kubernetes we're all familiar with those key operator value. Coverno has the same constructs. Using a deny statement, you can use these expressions to achieve even more power by pulling in some other advanced capabilities which we don't have time to cover, but two styles of a validate rule that you can write with plenty of flexibility to achieve any of those use cases. Mutation capability. Coverno has had mutation capability right out of the gate and it's very, very mature. This is as you may or may not know be the ability that defines the modification of a resource. So going back to the phases of admission review this occurs first in the mutation phase. So when a resource comes in, if there is a policy that says you should mutate this, mutation will occur there, then get shunt to the validation phase later on where there may or may not be a policy to apply additional validations on that. Mutate rules like validate can be written with an overlay style. That is, if you're only interested in applying a specific portion of the resource you can do that by specifying with overlays which is the easiest and simplest way to go about doing it or you can use standard 6902 JSON patches. And these are non-adulterated JSON patches. Coverno supports those perfectly well. And using those JSON patches, you can do things like remove values or change values in a lot of different cases. And by the way, all of these things that we're talking about and this is a common question that comes up work for custom resources as well as standard Kubernetes resources. So it doesn't matter what type of Kubernetes resource it is. Coverno can validate it, can mutate it, can verify images stripped away from it, can generate it, et cetera, et cetera. Mutate also supports the ability to mutate existing resources. So you have existing resources that are in the cluster and you need to provide some sort of retroactive mutation against them rather than performing all new mutation based upon an event on that and be that a create or an update. Coverno has the ability to, via a policy definition, apply retroactive mutations based upon your design. The generation rule type. This is one of the most popular rule types in Coverno and one of the things that really differentiates it from a lot of other policy engines. Coverno has the ability to create new resources of any type based upon a trigger that you define happening in the cluster. The source of that can be either a clone. Here's an existing resource that's somewhere in the cluster. I want you to put it over there in number of times or it can be defined in the policy in what's called a data structure. And in the data structure you define I want my resource to look like this including things like variable templating and expressions and all sorts of things that can go in there. And then when that trigger occurs it will create that resource upon that definition and whatever the defined target is. It also supports synchronization so it can watch the source resource be that defined in the policy or the source resource in the case of a clone and if that changes it can immediately synchronize those contents down to the downstream locations. This also enables things like tamper resistance. If somebody tampers with the downstream resource and synchronization is enabled Coverno will see that and immediately revert the resource back to its previous state. This also works on existing items. This is great for if you have brown field environments which everybody does, you've got existing namespaces and you wanna generate resources into existing namespaces without having to manipulate them or even worry about creating new namespaces Coverno can do that as well based on the same simple policy definitions. This is obviously great for multi-tenancy and indeed this is one of the most popular uses of it where even if you're not using true multi-tenancy you're using soft multi-tenancy for things like applications. If you are using multi-tenancy for separate teams or even separate customers Coverno can be a full namespace provisioner and generate all the resources that you need in order to get that namespace into production quickly. Image verification. This is Coverno's ability to verify the image signatures in an OCI registry of the images that are being proposed to be run in the cluster. Coverno internally uses the Cosign project from Sigstore. Anybody heard of Sigstore recently? Yeah, it's been a lot. Cosign is used to sign the images. Coverno uses Cosign to verify the signature of those images. This is integrated. All of these things that we're discussing are integrated directly into Coverno. There's no bolt-ons. There's no additional things that you install. If you don't want the behavior, you don't get it. As soon as you want it, all you have to do is write a policy. It enables the behavior. This also supports things like attestation checks. Anybody here attesting to their images in any way, shape, or form right now? So a couple brave souls. All right, hopefully at some point in time we get to do more things like provenance but anyhow, we're ready for that. It's already there. And Coverno supports the ability to check attestations of any predicate type, even custom predicates, and you can verify any portion of the attestation payload using any form of expression that Coverno supports of which there are many. All of this works with any OCI registry. There's no isolated list of these only specific ones. If it's an OCI registry and it conforms to the OCI spec, Coverno will work with it, pull those images and look at the image signatures and attestations on them. And you can do some complex multi-way checks. So any keys, all keys, at least one or at least two keys. So you can do things like my entire organization is required to sign all images, but if they're going into a PCI namespace, additionally the security team has to sign off on those images and based upon whatever policy design that you want, it can ensure that anything that goes into that namespace maybe gets two signatures that they have to validate, otherwise it's just one. So policy reports, I talked about this on the validate slide, but policy reports are a standard Kubernetes custom resource that shows the results of validate rules placed in audit mode. So if a validate rule is in audit mode and a resource violates a policy, the resource will be allowed to create, but it will log that in a policy report. This is an open standard from the Kubernetes Policy Working Group. This isn't some esoteric standard that we created just to give you yet another CR. The Kubernetes Policy Working Group defines a standard policy report structure that's by the way adopted by several tools that are out there in the ecosystem. And what this enables is the separation of those who can write and see policy and those who can write and see policy reports. They aren't crushed together in the same thing so somebody has to parse out the results of the policy. They're cleanly separated. The roles that you wish can separate based on whatever desire that you want. Policy report comes in two flavors, a namespace policy report and a cluster wide policy report. Things that are namespace scoped appear in a namespace policy report. Those that are cluster scoped, for example, Node or some other custom resources will appear in the cluster policy report. Policy reports are written in two modes, admission review. That's if the policy is in audit mode and also what we call background processing mode. If you create a rule with background processing enabled, Coverno will on a scheduled basis go and check all of the resources that pertain to that in an existing cluster and if they're in violation, we'll write that into a policy report. So you can do things like drop in a policy in audit mode and get an understanding of the disposition of the resources in that cluster without any admission requests having to come into it. Results are pass, fail, warn, error, and skip. Again, these are all defined in the open standard of the policy of the Kubernetes policy, WG and Coverno supports all of these. CLI, Coverno has a CLI. It allows you to test policies outside of a cluster. The way this works is in two primary fashions. This allows you to check against a defined manifest. As in, I have this policy, I have this or these resources and I expect this result to occur when these are evaluated. If that result is not achieved, it'll be deemed a failure or you can just YOLO and say here, there's a policy, here's a resource, tell me what happens and it'll give you the output. And by the way, that works with things like mutate and generate, here's a policy, here's a resource, give it to the CLI. It should come out if it matches to it. It'll show you the full representation of the generated or mutated resource. This is obviously great in CICD pipelines because now you can shift left and put in the CLI so that your authoring experience is the same and you're able to reason about that process all the way through to the running in the cluster. So whatever the CLI reports, you can do things like deny your, you can fail your PR and this is a very common use case and in fact in the documentation, we have a sample GitHub action that this is all plumbed up for you. You can go and copy and paste it right now as a way to get started. And it's simple enough where you can use it in any project, it's very standard. This is a GoBinary. It's available as a Qt control plugin via crew, via homebrew, lots of other installation methods. Very easy to get started and to install it. This is part of Coverno. This is not an isolated utility that was sort of whipped up to evaluate Coverno's language separately. The code that executes in the CLI is the same code that executes in the webhook. It's just in CLI form factor. All right, so some things that are new in Coverno 1.8. For those that are not aware, we released 1.8 technically a couple of weeks ago, but we had the release blog that we put out there earlier this week. There's a new pod security sub rule. How many of those here are familiar with the either pod security admission or pod security standards? No, I do not mean PSPs. Pod security admission or pod security standards? Pod security admission being the technology which implements the PSS standards, okay. So pod security admission is a new feature. As of Coverno 1.23, it reached stability in 1.25, which was the same version in which pod security policies were removed. So for those who are not aware, pod security policies are gone. That is not deprecated, gone in 1.25. The same libraries that power pod security admission, which is the Kubernetes replacement for PSPs, we pulled that library into Coverno and made a much simpler abstraction using this pod security sub rule. So you can do things like apply the entire restricted profile of the pod security standards in one single rule. Another thing that we added in 1.8 is YAML manifest signature verification. So I talked about the ability to verify image signatures and attestations from the six-door project using Cosign. They also have a sub project which is the signature and validation thereof of YAML manifest. Coverno has brought that feature in and allows you to sign YAML manifest and verify, well Coverno won't do the signing, Coverno will do the validation of those YAML manifests before they're allowed to come into your cluster and also allow you to do things like exclude certain fields. So for example, if you wanna sign a deployment to prevent, ensure that tampering does not occur from the time that that is signed to the time that that's run, but you wanna allow users to only change replicas, you can define that in a simple YAML-based policy and Coverno will validate that signature before allowing it to run. None of that involves any programming language on your part. Coverno also now has the ability to clone multiple objects in a generate rule. So prior to this feature, generate was sort of a one-to-one mapping. You triggered on one resource and you got one resource, but now this allows something like create a new namespace and in the same rule clone out 10 things, for example. You can do that in just a single rule definition now. GitOps friendly pod controller rule autogen. I didn't talk about autogen, but Coverno has an ability whereby you can write a rule for a pod and we will automatically translate that for all of the standard Kubernetes pod controllers. That means that you don't have to write separate rules for deployments, demon sets, stateful sets, jobs, or cron jobs. Coverno will automatically do that if it sees that you're only trying to match on a pod. In this version, we moved that auto generation capability from the spec object up into status. So those of you that are using GitOps tools to deploy your Coverno policies, you can do that very simply without having them go to war or providing any exceptions. We overhauled the reporting system. We completely rewrote the reporting system to be faster and more accurate. Lots more there. Open telemetry support. For those of you who already had Prometheus support, now we added open telemetry. GRPC is what's supported right now. We didn't talk about the James Path system. Those that are familiar with JSON path, there's a similar system out there called James Path. And Coverno completely brings in the James Path system, but we also create brand new filters that are only endemic to Coverno. And in this release, we added two more filters random, the ability for you to create a randomized string based upon a regex pattern that can be as simple or as complex as you want. So for example, if you wanted to generate an API key, if you wanted to generate a pod hash, Coverno can do that internally with no other logic that you need. X509 decode, the ability to decode an X509 certificate and parse out the YAML in any policy definition. So for example, you can now do things like, I wanna know in a policy report, perhaps, if any of certificates that are in my cluster are going to expire in the next 30 days. And I invite you to get involved. Coverno has over 3000 stars. There is a contributing guide. We have good first issues that are labeled and we keep those up to date. Documentation you can find at Coverno.io. Our policy library, there's over 230 sample policies and that grows and these are for ecosystem tools far beyond just Kubernetes itself. So Istio, LinkerD, we've implemented their best practices. Argo, Flux, CertManager, some AWS, I don't even know all of them and it grows all the time. Also that policy library is community driven. Any of you can write a policy maybe for a tool that you don't see for your own use case. We will gladly accept it. We will work with you to test it and make sure that it's solid and then we'll add it to the library and make sure that everybody can access it. We have a weekly contributors meeting. We have a quarterly end users meeting. We have two channels that are on Slack. One is on Kubernetes Slack with Coverno and Coverno Dev. On Coverno, there's about 1400 users and on CNCF Slack. And with that, I wanna thank everybody for coming and we will be glad to take questions. Dallas has the mic. Please wait for Dallas to bring the mic to you. Raise your hand if you have a question. We'll be glad to take that with the remaining time. Hi, thanks for the talk. Is it possible to write a policy for one resource where it's evaluated against another resource in that same namespace? Absolutely, okay. Coverno has the ability to do API calls to the Kubernetes API and get any resource that you want. And it has a rich variable system that allows you to store that as a variable to perform transforms against it and to substitute that variable at basically any point in the policy that you want to. Any other questions? One down here or whatever you're here. Thanks for the talk. Can Coverno, as part of its triggers, send a web hook to a different service and have that service send back a year or nay? No, it does not do that today. That's an interesting use case. Come and talk to us in the Coverno booth. I'd like to understand a little bit more about your use case. Thank you for the talk. Is there a way to put timeouts when I have too many rules and just takes too long to validate something like that? Yeah, so Coverno exposes a field on the policy, on every policy where you can set the web hook timeout behavior that you want, in addition to the failure behavior. So if you'd rather fail open for some reason, you can configure that on a policy. If you want to change the web hook timeout from the default, I think it's like 10 seconds to the maximum, which the API server allows us, 30 seconds, you can easily do that. Those are just the additional two fields that you define. Hello, thank you for the talk. So I have two questions. One is I'm new to Coverno, so first question is how much different it is from OPA or we hear about an open policy agent all the time. And the second question I had is like, can Coverno create attestations for images or any of the other artifacts that you might have? Yeah, so two different questions, very different questions. The first is how does it relate or differ from OPA and OPA with and without Gatekeeper? Coverno was written from the ground up only for Kubernetes. Coverno is not a general purpose policy engine at this stage, and that's a conscious design decision, not a mistake or not something that... And the reason that we wanted to do that is because we wanted to shift the burden away from users of having to write and maintain a programming language. Even if you're capable of doing that, we wanted to shift that burden so that that process is easier. It's easier to maintain, it's easier to reason about. Maybe you who are capable of writing a programming language can collaborate with your security team who is not and everybody be on the same page, you can reason about policies and also you can use your existing tools to manipulate and even write those policies. So if you wanna use customize to do things like add additional exclusions, add additional preconditions, which we didn't talk about, add additional conditions to a deny statement, there's no block scalar with a bunch of YAML underneath it that you have to manipulate. You can do that with existing tools and processes that you have today. The second question is, is Coverno capable of creating attestations? No, Coverno does not create attestations nor does it sign images. It is in the runtime path of ensuring that the attestations and signatures are present and are valid based upon your definition. Any other questions? Hi, at what point are we doing too much YAML and we should use a real programming language? Like is there a recommended boundary or? I don't know that, so I'll start with one thing anecdotally. I'm very involved in the Coverno community. Maybe those of you who use Coverno have probably seen or maybe received help from me from Slack. I'm also very involved in the Kubernetes community in a number of different ways. In the time that I've been, I mean at this point in time, listening to real world use cases from thousands of people, I only know of two use cases that Coverno has no way to accomplish. Both of those are tracking for completion in the next version. So at what point, where is the inflection point between trying to wrangle YAML and having to go to a programming language? And the answer is, that really depends on you, your skill set and what you're trying to achieve. If you have highly, highly complex policies with a bunch of, I can't even come up with a concrete example, a lot of conditional checks that need to just be totally off the wall, that might be better a purpose served for a policy engine that's capable of exposing a programming language. I will also say that we have on the roadmap and we are trying to work towards the ability for Coverno to support a language like Q-lang or cell or something like that. That's not today, but we're looking at that for tomorrow. Thank you, you actually touched on something. I was very interested to see the CoSign implementation there and I can really appreciate that. CoSign does have the ability to kind of do some policy evaluation itself. How does it overlap with what you're doing in Coverno, like for a use case, being able to validate provenance on an image within Toto access stations? Yeah, so Coverno does support checking the in Toto attestations, but one of the differences, and I will not pretend to be knowledgeable to a certain extent on their admission controller, but I believe that there's requires for attestation checks use of Q-lang to be able to validate them. Coverno does all that without Q-lang today with simple expressions using James path or just simple patterns. We have time for one more question and then the moderator's gonna kick us out. I was just trying to understand two parts. One is given that you have multiple policy documents that might match a given resource. Is there any ordering constraints? Yes. Coverno applies. Yes, good question. So two important constructs about Coverno and this is important to take away. There is no possibility in Coverno for one rule to usurp or countermand another. Rules only serve to extend the failure domain, but within a policy there is an application order. If you want that behavior, you can define, I wanna start at the top and evaluate down and only one or the first one must match or all of these must match. You can change that behavior, you can leave it default, it's up to you, but no matter what behavior you choose, you can't have one policy countermand another.  The related question was, given that you can have these generated policies, there becomes a kind of a nasty debugging infinite loop potential in there where something could generate a policy, a generator could generate a bunch of other resources which go through Coverno and generate more resources and on and on it goes. How do you debug something like that? We have internal protections in logic built in to catch situations like that so it doesn't cause a runaway train. I don't have full details on that, but we thought of that problem, we experienced it and we have some logic that will prevent that loop from occurring. All right, thank you everybody for coming to this talk. We'll be available here for additional questions.


to 5 Minute Flashbacks. My name is Jasmine and I am your host. So let's just jump right in! Continuing our Halloween theme for October, I wanted to cover one of the most legendary, most long-running, and unfortunately most controversial Halloween shows that has ever run at any theme park that I can think of. Bill and Ted. Now, in order to start at the beginning, we have to go way back in time. All the way back to 1989. I bet you thought I was going to say 1992, didn't you? Well, if you did, I can see why. 1992 was the year of Halloween Horror Nights 2, the second ever Halloween Horror Nights event at Universal Studios Orlando, and the first ever run of Bill and Ted's excellent Halloween adventure. But we can't get too far ahead of ourselves here, because Bill and Ted would never have an excellent Halloween adventure if they didn't first have Bill and Ted's excellent adventure. So back we go to 1989. Now, for you youngins, I'm not going to spoil the plot. I don't really care when you were born, but if you haven't seen Bill and Ted's excellent adventure, you're really missing out and you need to watch it ASAP. But to summarize, it's a hilarious tale of time travel starring Keanu Reeves, Alex Winter, and George Carlin. Like most great comedies, the film was panned by major critics at magazines and newspapers like Variety, The LA Times, and The New York Times, following its 1989 release, with some calling it a quote, painfully inept comedy. So naturally, it grew a cult fanbase. And it wasn't long before a sequel came along in 1991. And so when Universal Studios was looking to expand and rebrand their experimental 1991 Halloween event for the 1992 season, since side note and fun fact, a lot of people don't seem to know that in 1991, Halloween Horror Nights was actually called Fright Nights. And I just thought I'd mention that since last week's episode, I actually covered a similar Halloween event rebrand with Canada's Wonderland. So if you didn't see last week's video, make sure to go and watch that. Anyways, like I was saying, when Universal was rebranding Fright Nights to Halloween Horror Nights for its second season in 1992, they decided to have everyone's latest favorite duo host a new show for the event and add some comedy and Hollywood antics. Now I would go more into why they chose Bill and Ted to host this particular show, but I think the tagline for the first year's show perfectly sums up the experience. And the tagline was quote, bodacious stunts and awesome surprises take you on a trick or treat through time. And if you've seen the movies, you'd know that there are no better hosts for a show with that kind of vibe than Bill and Ted. Bodacious is the word. The show itself was a pretty wild departure from the rest of the Halloween Horror Nights event, which at the time was heavily reliant on gore for shock and scares and honestly a lot less dynamic than the Halloween Horror Nights that we all know and love today. And I think that's exactly why Bill and Ted's show was such a hit. It brought some much needed levity and humor to the event and was a really memorable part of the night for guests. And how could it not be? The show was a crazy mashup of PG-13 style entertainment with references and influences from all corners of pop culture. No IP was safe. And aside from the hanging event at Knott's Berry Farm, which was all the way in California, this was the only adult PG-13 and Upstyle Halloween show at any major theme park on the continent at the time. But I'm getting ahead of myself because spoiler alert, we'll talk more about that next week. Anyways, like I was saying, no IP was safe from Bill and Ted at the time. These days, you'd never see Universal use a Disney IP in their parks without some kind of legal agreement. So honestly, I'm not sure how they got away with it for so long, but they featured more and more iconic characters over the years as they expanded on the show and leaned even further into the cultural and parody elements, including an expansion into their Hollywood location in 1997. You never knew who might make an appearance in one of these shows. Captain Jack Sparrow, Dr. Evil, Superman, and celebrity parodies like Usher, Miley Cyrus, Katy Perry, and even political parodies like Monica Lewinsky. Oh, this is the part where I talk about the controversy and the cancellation. Yeah. Alright, here we go. So we all know that there's a fine line between funny and offensive. And while for many demographics, Bill and Ted's show launched over that line multiple times. Some people took offense to the scantily clad and over-sexualized dancers, but I don't think that was the main or irreparable issue. For The Hollywood Park, it was homophobic jokes in the show that got the show temporarily suspended right in the middle of its 2013 run permanently. Yes, it was a permanent, temporary suspension. It just never came back. And while it's unsurprising that my fellow Floridians never really got offended at all at the show, this is Florida after all. The show at Universal Orlando was also cancelled a few years later in 2017. Universal never gave an official reason for the cancellation, saying only, quote, but now the time has come for these most outstanding dudes to find adventure in other places and other times. And I mean, it's an epic statement, but the lack of a clear reason from Universal left many speculating on the reasons for the show ending. Continued backlash over controversial humor, issues with the venue, finally being sued for copyright infringement. Honestly, I think that did play a part. I mean, YouTube launched in 2005 and people like me started uploading random travel and vacation videos in like 2006. And in 2006 to 2007 is when Universal started implementing strict no filming policies for the Bill and Ted shows. But five minutes on YouTube, even today, will show you how well that ban worked. Rumor has it that by the end of 2006, both Disney and Warner Brothers were considering legal action against Universal over the use of their IP in the shows. In hindsight, it's really kind of impressive that Bill and Ted's excellent Halloween adventure ran as long as it did, given how brazenly it broke so many social and legal rules. And maybe that's exactly why people loved it. I mean, how many other shows can you name that have run for 26 years? But that's where I'm gonna end today because I have a feeling this video is already going long. So please share your thoughts on Bill and Ted in the comments below, whether it's on the movies, the shows, your personal experience. If you got to see the show, I would love to hear your story. And what are your thoughts on the cancellation? Do you think it deserved to be canceled or would you like to see it brought back? And if it was ever brought back, what kind of changes would you make? Let me know down below and I will see you next Friday. Bye everybody!


Hey everybody and welcome back to a plan with me video today. We are working on Monday, September 5th through a Sunday, September 11 Sorry about the nasal enus in my voice. I'm super sick I was actually planning on filming this last night But I actually went to bed like super super early because I took a half day at work And I slept through the entire thing like I just woke up and it's five o'clock in the morning So I have to get this done because I'm going out of town this weekend Actually before we do this let's look at last week. So here is last week and here is yesterday This is me being sick I was gonna be doing a planning session and I needed to get that done because tonight I am going out of town So I'm filming it today and we're gonna upload or not upload but edit today And then get this up for you guys on Monday because I will still be out of town on Monday So I did want to recap. I did have some fun things that happened this week So as I wanted to say I did have a date We're gonna go into that as I do the plan with me because it's a story, but it's a good story and I started looking at new apartments last week and I Got to sign a new lease on a new apartment. So I will be moving. I apologize for Telling you guys that I was gonna like start doing all of these like home improvement projects around my own apartment Honestly, the reason I'm moving there's many reasons But the rent is too high for like the market that I'm in and I don't need as much space as I currently have So that's like the main reasons why I'm moving because I mean who doesn't want to save a little bit of money every month And then also like I never really felt super at home in this apartment unit Like I don't know why but I never really felt like connected to it I know that's kind of crazy because it's obviously not mine, but whatever. So yeah, I'm moving and It's gonna be awesome, but I'm not moving until October. So you will see all of those shenanigans in October Okay, so we need to put in all of the things this week. Oh My goodness, I'm sorry for all the sniffles like in advance you guys. Oh so many sniffles so many sniffles Okay, so let's do this So I'm still gonna be in Minnesota on this day on Monday, but I need to like go home at some point So I'll just kind of put this in the middle of my day I don't really know what I'm going home But I like to get an early start if I can on Days that I have to you know drive or whatever. So I don't know takes me about three to four hours to drive it Okay, so let's see. I was a good girl again, and I pulled out some of the things that I'm going to be using So that's always a good sign But I know I sound really really weird right now, but I actually feel so much better like so so much better All right, so oh and the wash you I'm gonna use this week I am like so out of it you guys that I'm just gonna use some I don't know some this wash sheet I don't know it's like multicolored and then I'm using this like navy that kind of goes with this like little navy pedal on here I don't know. I'm pretty sure they're both from Hobby Lobby, but I don't know I'm not 100% sure the reason I'm using this is because I can just use whatever and not even really have to think about it Because I can't think today.  So yeah All right. So back to Fargo. Oh So let me tell you guys about the date So we met at caribou, which if you guys don't live in the Midwest, I don't know where they have caribou's all over the place We it okay, so caribou is caribou coffee, but it's it's like Starbucks, but it's not Starbucks I don't know. I don't drink coffee I mean, I know that's kind of crazy to be like a planner girl and not drink coffee, but whatever So yeah, we met there He ran a little bit late because he he says he got like Cornered by his boss before he left and thought it was gonna be like a five-minute conversation And it turned out to be like a 25-minute conversation about something. I don't know what anyway That was fine. I was already there when he had Like messaged me through like the dating app like we don't have each other's phone numbers Like it's just like all the dating app. So anyway, I was like, yeah, that's no problem He was only like five minutes late. So it wasn't a big deal. So anyway, um He comes and says hello like I had already ordered my Smoothie that I that I had purchased and so he seemed kind of disappointed that I had already ordered because he's like I wanted to buy you a coffee. I'm like, well, that's okay I don't drink coffee it took me a while to figure out what I actually wanted to drink here blah blah blah So he's like, oh, okay. He's like, sorry. I didn't know I'm like, no, that's okay I'm like when I explain to people that I don't drink coffee then People are like what you don't drink coffee coffee just makes me like really sick So it's just not great for my digestive tract. I'll just put it that way So that is why I don't drink coffee But I do drink tea, but it was later in the evening It was like 6 30 or so when we met up So I did not want any caffeine because I would have been like up all frickin night and We don't need that so anyway, we Hung out had a really good conversation Felt like it went well. He is very much like a numbers nerd, which is good Works for an insurance company, which I already knew that so the conversation seemed to like flow pretty well I think in my own opinion. I mean, I don't know what his opinion was of it He knows that I am out of town this weekend, which you guys aren't seeing this till Monday But I'm talking about like the weekend previous and then he is actually in Bismarck the next weekend And then I have friends coming into town for a concert on Friday night And then they're gonna be in town probably until Sunday morning So yeah, so he's like, I don't know when we can get together again You're always so busy and I was like, well, yeah, I know like you can just I'm like we can make it work Like I'm sometimes available in the evenings But you know just just let me know what you're thinking and I did say to him like this is my own like Issue like I've got problems, but you guys probably know this if you watch my videos So when I'm dating like the first couple of dates, I don't follow up on those dates I have the mentality that if you want to see me, you'll make it a point to see me Like you can message me on the dating app and then I will either ignore you or I will Say yeah, let's go out again. Okay. I don't know why but I've always been that way like always and you know, I Think that's okay. I like that's my only like weird like kind of girly thing that I do So, yeah, I don't know. I'm just kind of odd in that way But I did tell him upfront like this is how I am like I will you will not be seeing a message for me And I'm like and it's not because I don't like you it's because If you want to make this happen you have to make it happen. I'm like I I just don't Um follow up on first dates or sometimes even second or third dates after that then I feel comfortable enough to actually like Not put myself out there. That's like kind of the bad thing to say But you know like if you want to if you want to see me bad enough Like you'll just make it happen. So sorry to be redundant. Oh and in the course of doing that I totally messed this up. Okay, so He's like, oh, okay. I understand.  He's like, well, I'll be sending you a message I just don't know when blah blah blah. So I don't I mean, I haven't checked this morning But I'm pretty sure he hasn't messaged me back at pretty much because you know, I don't know if we're gonna go out again um, that's like I said that's up to him not me but Also, I um I'm not a or I'm out of town. He's out of town. So whatever. We'll figure it out But I'll let you guys know if we end up meeting up again I mean, he was a nice guy and I'm definitely go out with him again It's just a matter of him pulling the trigger on it. Not me. So yeah I know a lot of you were curious on instagram how it went So I figured I had to had to recap it in this video Oh and by the way, like as the date was wearing on I was getting like sicker and sicker and sicker And I didn't like sound super horrible until like early thursday morning Which was kind of nice because the the date the date happened on a wednesday, but Yeah Anyway, what do you do? Okay, so I have a dentist appointment on my sorry on wednesday I need to Put this in Like can I just not go to the dentist? Is that like a possibility? I'm pretty sure it should be. All right. So smile solutions at 2 p.m I'm just realizing like none of my stuff is matching today, but I like legit don't even care right now So I need to Do a little don't forget I don't want to go so i'm putting that in okay, and I absolutely hate writing on wednesdays But we're gonna have to write don't forget my guard. I have to bring my guard So I think we are good to go. All right, so that is Done Okay, so all my work is done Work work work work work work We are done with work work work. All right. Um, oh I have to work my other job Probably on sunday the schedule is not up, but I'm just gonna put it out anyways because I tend to always work on sundays if I'm available. So we're gonna do 11 30 to 6 30 That's like the only shift on sundays Which is kind of nice that I already know this so yeah And my friend's gonna be in town, but she usually leaves pretty early on sunday morning So i'm not too worried about that little bowtie there cute little thing Okay, and then another really fun thing that's happening on friday is friday night We are going to the ludicrous concert, which i'm like super pumped up about And like I can't like brain today at all So i'm gonna use some christian designs because it's stuff's just like so functional and easy. Oh crap I gotta do laundry at some point uh Let's do laundry on Sunday, I think that'll be a good day to do laundry. Okay. Just put that up there whatever Okay so All right I can't believe ludicrous is coming to fargo you guys like that's pretty amazing um It's also kind of hilarious I'm very looking forward to actually who shows up to the ludicrous concert that lives in fargo Um, yeah, oh crud and I forgot to take out this richman thing. Okay. I need to take this out as well I also need to do some editing this week, but I'm honestly, I don't know what day I'm gonna do it on yet So I'm probably not gonna put that in today Just because I don't know. Um, I've already got my Wednesday video already uploaded and scheduled for you guys. So that will be good Um, but I'm just really not sure What I'm gonna be doing editing of other stuff because friday is gonna be my state fair vlog for you guys So like what I did this past weekend that hasn't actually happened yet Per me filming this, okay There we go. All right And if you guys are ever interested in what I use this is called undo I have a link um to amazon below for you guys if you're ever interested in getting this This stuff is amazing if you put down something And you need to lift it back up a lot of the like planner stickers If you put them down you can usually lift them right back up like in a second, but unfortunately, you know If you've had them in there for a while like I've had that one in there for a while It's difficult to do without actually ripping the page and um, this is almost completely dry I want to put down here that um, Amanda and um her daughter Olivia are gonna be in town So I'm gonna just Put that in Real quick and then I think that's gonna be it for this week Okay So my friend and her daughter are gonna come and hang out for the weekend and then we're gonna go to the concert, which will be awesome Here we go. So unfortunately, I do have to work at my main job on that saturday, but that's okay um They will they'll have you know, they're gonna have their vehicle here So and they've been to town a million times So they'll either just hang out until one o'clock or they'll go out and do something And then I can join them for the rest of the day So yeah, the ludicrous concert was kind of like a last minute thing Okay, and then the last thing I need to put in my chiropractic appointments I'm pretty sure was it yeah, wednesday and friday Little skinny event stickers. I've got way too much christian designs, but I guess one can never have too much christian designs in their life Okay so I don't know let's Let's do green All right nice All right, let's put my Videos back in here, and then I am all done. I'm pretty sure there's always something I forget, but whatever Um, so yeah, that is going to be it. I hope you guys enjoyed Sorry for the nasoliness and all that good jazz But I wanted to get this up for you guys So I didn't miss a monday since I will be out of town If you like this video make sure to give it a thumbs up just to let me know that you liked it And then also feel free to subscribe I do videos every monday wednesday and friday And I hope that you guys are having a fabulous day wherever you are And I will talk to you all in my next video. Bye guys


Hello, welcome to Kwok Talk, I'm Crystal here in Think Tech. This Tuesday we're going to talk about some Chinese issues. Now there's a real stereotype out there, or cliche maybe even, that a lot of Chinese moms are tiger moms. Now what does it mean to be a tiger mom? This phrase was kind of coined, you know, not too long ago, based on a famous book that kind of re-emphasized the fact that a lot of Asian moms, particularly Chinese, maybe Korean and Japanese, are very, very strict in controlling about their kids. Well, in fact, there are some that aren't so controlling and some who don't or want to defy certain types of control because there's some other elements in importance in how to raise children. So I've got some two very interesting women, two different moms here, single moms in fact, who have a different attitude on raising kids. So let's welcome them. Let's talk about this a little bit, about how not all Chinese women are tiger moms. Welcome non-tiger moms. Are you both professed non-tiger moms? Let's put it out there first. Definitely not tiger moms at all. Not even a little bit. Not even a little bit. Do you see very calm and peaceful, so I don't think you're a tiger mommy. Let's welcome them. So Katherine Lin. Katherine Lin is a president of Nihao Media and you have a daughter who is how old? She's 14. Okay. Oh, you're now 25. Yes, I know you are. I hear you there. And Kun Kun. Yes. You're Chinese. Your full name is Bao Kun Duan. Yes. And you have a very interesting background with the foundation that has to do with preserving art. Yes. We founded the Academy of Himalayan Art and actually the foundation serves a few purpose. One is preserve the dying out Himalayan culture. And second is to develop the culture mature into children curriculum. Specifically into their schooling. Into more, I think, into their family education side, which I personally think is more important sometimes than the school curriculum. Absolutely. Well, let's talk a little bit about, okay, so putting school aside, we as parents, particularly women maybe, let's talk about your background. So we'll kind of gather how that influenced your perspective as a parent.  I was born to a Chinese father, a Northern Chinese father, and a Taiwanese mother.  My mom was not a tiger mom, and I think for the most part, you know how people say we raise our children according to how we were raised. Or we rebelled 130. Exactly. So in my case, I am raising my child exactly how my mom raised me.  Okay. So on one hand, she's a very strong woman, but on the other hand, she also believed in letting myself and my brother develop our own personality. So now, looking back, and this is very rare, I grew up in Asia until I was 17. In Taiwan? In Taipei. Yes. My mother actually had never, ever pushed me or my brother to get straight A's. But that's very rare, because people, parents who know Asian academics, it's like everything is steady, steady, steady. You don't have time for extracurricular activities. Right. Okay. So you're very fortunate. I'm very, very blessed. Yes. Therefore, my daughter, Kristianne, she was born and raised in the U.S., actually in Honolulu, Hawaii. Yes. She's a local girl. Yes. So when she was born, I knew exactly how I was going to raise her. Really? Yeah.  I never had to push her or tell her to go to her homework. She's a very self-disciplined type of young lady. So... So what do you think your concept is? If you allow them the freedom to explore, they will find their way to grasp it? You know, the way I look at it is boundaries are important. Yeah. However, I don't want to give her so much rules and regulations to suffocate. Okay. You know, to... I want her to be able to grow up and let her personality shine through. Yes. Totally agree. Yeah. And the whole reason why I stay in Hawaii for 16 years, I can say my primary reason is for my daughter. Ah. Is for her to grow up in a place where, in my opinion, I think this is one of the best places to raise children in the world. Okay. Wow. Okay. So it sounds like you're very clear on your parenting concept and knowing how to give her that. Yes. Kun Kun, you grew up in a very different environment. Yes. And you have a daughter who is quite young. Yes. Yes. So I actually was born in Kunming and in the military family. Oh, wow. I grew up on a military air force base and which, that was the defense line between China and Vietnam.  Yes. Yes. But most of the women there, like doing the administration and sporting, but... So my father was, he was not a pilot, but he was controlling the back station, I think. Okay. So, you know, how military concept during the 1970s. Oh, gosh, in China? Yeah. So all my pictures taken childhood was has the four leaders' big pictures behind me. I'm standing on the stairway. It was the old, you know, those driving stairs to the plane. Oh, wow. I used to fly when I was very young. From Kunming to Beijing, I would get on the plane to deliver goods to the Chinese leaders, I think. Wow. Yeah. So I started flying really young, but because of a certain concept of education in their mind and they're very disciplined people. So I would say my mom was a tiger mom. Okay. Because I was never perfect in her eyes. And she's big dreamer in her life, but she went through the times of China that she never really had the opportunity to learn and to bring out whatever her dreams in life. Basically, what Catherine is providing for her daughter, you were not allowed to have and she didn't have it. Yeah. I'll give you an example. I really love music. So when I saw piano first time in TV, I said, I want to play piano.  I would never be a good piano player. You know, let's just cue your dream life right there.  Then my dad would say, why don't you be a doctor? Of course.  Carry into a nice, rich, good family background, right? Yeah. But you know how life, my life is very dramatic and I'm the only child. I'm the typical result of the family planning. And my parents were so loyal to the party. But unfortunately, they both passed away very young age. So my mom died, 52, my father died, 45. Let me clarify for people who don't realize that the family planning in China until recently was a one-child system. And so you think about it. You've depleted all your, you had no cousins, no siblings, no one to go with. I grew up very lonely. And then, so I was a rebelling kid. I was very strong against my mom's policy. Do you think this is a personality thing?  I vow? No, I think so. Your personality. Oh. Yeah. I think parents influence the kids. We have fear in our life. And if we have negative energy, we try to pass down. We unconsciously pass this energy to our children. And we seem worried to lose them or lose control of something.  Oh, that's really interesting. Yeah. I think from my point of view is, it's 50-50. I do believe parenting played a big role in influencing children, but I do believe every one of us were born with our own personalities, too. But it needs time to develop. It does. And it needs the space, the freedom to develop. And for me, I can say that because I went through this period of time that I knew from a very young age. I was 11. I knew when I was 11 that I was going to come to the U.S. and study in the U.S. Yeah. Was it a rebellious period where you wanted to defy your parents? I think my rebellious period was when I so wanted to come to the U.S., to leave the Asian society. Why did you want to leave the Asian society? I never felt like a fit-in. Was it because of the controlling element that we're talking about here? I think an Asian society is, generally speaking, a much more conservative society. Right. I'm a very free-spirited type of person. Are you saying that there are no free spirits in Asia? There are, but it's a lot more limited. Yeah. Yeah. And even now when I go back to Asia, I think I can really feel that. I mean, Asia is kind of the way. It's a controlling society, right? And sometimes it's not necessarily the controlling, it's just the atmosphere. Well, and look at the education, right? It's people's opinion. Look at the education. You have so much that you have to do that you don't have the space to explore your interests. Traveling. You know, let's do traveling, for example, to me. The moment, since the moment that my daughter was born, it has been such a big element in our life. Because I'm a firm believer that we learn while we travel. Absolutely. Right? But not everyone has the ability to do that. And not only that, I think in Asia, if my daughter were going up in Asia, it would be a much different story. Oh, sure. Because school would never allow her to be out of school one or two weeks every month. Right. Right? So I think in American society, we have a little bit more flexibility. And that's why both of you are very non-conventional in the ways.  Was this with your daughter? Yeah. I mean, she was quite very young. Not quite the one time, stayed a year. So back to the story then, I started my, last 10 years ago, I started preserving the Dying Out Himalayan culture. And then I discovered that I asked myself a question. Why do humans even preserve culture?  And they taught me something because all our value, our human wisdom is hidden in the heritage, in the culture. And so there's only a purpose, one purpose to pass it on is for your younger generation. And then since then, I started to look at the whole education concept. What is education? Yes. Education is a Latino word. It means bring out, not pounding in. Which is what a lot of Asian cultures do. Yes. It's all that. And actually our ancient ancestors in Asia did not teach kids just pounding in. If you study about the Yijing and the Feng Shui and Laozi and Confucius, and they let you learn the rules of the universe and rules of nature first. And then we say Zhi Ji, Zhi Bi, Bai Zhuang Bu Dai. That means you have to know yourself first. We don't teach kids to learn about our own body, how your body, how your five senses are connecting with your parents, connecting with the society, connecting with the nature. And if our children grew up in the more nature environment, they will learn from the nature, they will learn from the animals running in the Himalaya mountains. When I go to the villages, the children are singing everything. Every. Their spirit. Yeah, their spirit is free. And the songs, the folk songs, they are talking about the holy mountains, the rainbow after the... It's quite simple. You can parallel to the Hawaiian culture, right? Yes. And that's why you said it's a perfect place to rear children because you feel that energy is spiritual. Exactly. Yeah. And Christian has become a surfer girl. Oh, good. She's in tune with the ocean and the earth. Yeah. And I think for the most part that really defines who she is today. What distinguishes as a mom bringing up, as a single mom bringing up a child, how does that differ from conventional two-parent household to a daughter, for example? I mean, would you do something different if it was a boy that you had? I would not. She was born in New York, my daughter, and then I did not want to raise her up in states at all. Okay. Let's hold on to that thought because now we're bringing in like the American culture and the influence and the difference with Asian culture and how we as parents are controlling the path that they're taking, but yet allowing them to thrive in it. So don't go away. We have lots of philosophical, very important parenting issues to talk about here. So we'll see you soon. Aloha. My name is Joe Kent and I'm the Vice President of Research at the Grassroot Institute of Hawaii. The Grassroot Institute is a public policy think tank and we try to build a better economy in Hawaii and you can see us on the TV show Ehana Kako on the ThinkTek Hawaii Broadcasting Network every Monday at 2 o'clock. We'll see you there and let's build a better Hawaii together. Aloha. Thank you for watching ThinkTek. I'm Grace Chang, the new host for Global Connections. You can find me here live every Thursday at 1 p.m., where we'll be talking to people around the islands or visiting the islands who are connected in various aspects of global affairs. So please tune in and Aloha and thanks for watching. Hello. Welcome back. We're Quok Talk. Okay, if you didn't understand that I'm talking to two beautifully philosophical and open-minded mothers, Chinese mothers here, talking about parenting as a single mom, as a Chinese mom, as a non-conventional mom who chooses a path to rear their children in a very specific, free way. So let's talk about that back again with Catherine and Kun Kun. I know that break we mentioned how your decisions to move to the states is actually a very purposeful decision for your daughters and what difference that would make if they had grown up in Asia. So any following up on that one and why? I think for me, I mean you and I both went through that Asian type of education, you longer than me. But is it different though, Taiwan and Chinese education, what would you say distinguishes the difference? I think it's pretty much the same. It's all very Tian Ya. You just memorize everything. I remember as a child growing up, especially in high school, I was in school from 7.30 in the morning until 5 in the afternoon. And we all have to go to after school, school from 7 o'clock to 10 o'clock at night. Exactly. So to me, when I made the decision to come to the U.S. for my higher education, and I also made up my mind that one day when I have children, my children are going to receive education in the U.S. Because I do believe that in the U.S. that's where creativity, that's where innovation comes from. But a lot of mainland, when I say mainland, I mean China mainland, a lot of them are trying because they have these resources to send their kids to the states to study. I mean, they're coming, they're flooding in, but they don't have any intention to stay. They want to come for the education and bring it back. So do you think that's different from what you're talking about in rearing your daughter here? Because you're moving here. You're in the process of moving here with your daughter, right? Yes.   I think, to me, I told her when she was three months old, I was talking to her. I said, nothing is more important if I could assist you to plant the bodysit in your heart when you, as young as possible, to grow up in a pure environment, to understand the true value as a human and your relationship as a human to the universe, to the society, to other beings. And so I thought I would take her to travel to all the places, has all the culture, all the holistic environment, has all these loving kind of people who would, you know, just unstraight with smile at her and talk to her. So the environment is very important in influencing a child. I think so. And as a parent, as a mom, I think in the Asian time, the female in the society plays a very important role. In Bhutan nowadays, when they build houses, they would only use women to hunk the mud wall because it's very sacred.  So when they hunked the wall, they chant, they sing happily. Everything in the Himalaya mountains happened in the rhythm, in the vibration that where I think is the pulse of the earth. The pulse of the earth. Listen to that. There's a lot to digest. That's a very, very big statement, and it's a beautiful, beautiful concept. I want to go back to the concept, the fact that you're both single moms, if you don't mind sharing how you got to that position, or maybe not, or how that, or the pressures you have from family or from Chinese society of that. Is there a stigma? Do you find difficulties that you wish were otherwise? Share that. You know, to me, I believe what's meant to be, whatever it's meant to be is meant to be. The path that I belong, since my daughter was two and a half years old, single motherhood, I have no regrets about that. You never came close to remarrying or wanting to? I was engaged once, but again, that wasn't meant to be. Right. Yeah, but, you know, to me, the reason why I took my daughter traveling extensively with me, two reasons. One is for practical reason, because as a career woman, my media work and my mergers and acquisition work takes me to many different parts of the world. I have an office in New York. I travel to Beijing and Shanghai quite often. I now start an office in Panama, in Latin America. So if I were to spend enough time with my daughter, I have to bring her with me. Absolutely. So that's out of necessity. But the second reason is what we were just talking about. You know, I'm a firm believer of learning while traveling.  But going back to being a single woman, raising a child in American society, I have to say there are challenges. Of course there are.   So what are the perks?  I don't have to check in with anybody. Do you have to check in with your daughter? She's the only person that I have to check in with. Do you respect her concepts of when she doesn't approve of your partners or anything like that? You know, I take that into consideration quite a lot because I do believe in harmony. Right. You both are so Buddhist. There's something deep that you, it comes back to something, it's not to do with being Chinese, but there's something deeper I feel. Spirituality. It's a spirituality.  Yeah. As you know, I lost my parents when they were very young. And so I was alone. Who brought you up then? And I just, you know, that was, my mom died, I already started work and good jobs and I was supporting her.  When that moment happened, I felt the, I was so far away, like I was moving away from the earth physically. Wow. Yeah. That's kind of sense. And then of course I was very devoted to my practice as well. So I thought, okay, maybe this is how life arranged me just to get on the journey of enlightenment. And then I realized it's not that easy just to go alone. And then I asked myself, is this only one thing I have not done on the earth as to be a mom? So I just decided to be a mom, meaning how did you do that? Yeah, she just, I just went to the sperm bank. How do you say that? In the States or in China? Yeah. Did it happen in China? In New York, right? Yeah. In New York. Yeah. Not at that stage. Yeah. I had a marriage, but that was a beautiful, short marriage and, and, and, and, and I actually before I made my decision to become mom, I went to Tibet and just want to become a nun. And my teacher didn't take me. Why? And he said, think about why Buddha became a Buddhist. He was thinking of all the sufferers of all beings.  You should go out back to the world, figure out everything. Wow. And so I said to myself, Lynn, alright, there's one more thing I think, one more course. And truly when my daughter came in my life, I realized, and that is, that, that is how it works. She came to teach me the ultimate course of a class before I took. That is amazing. That is like just, I'm getting like, chill, I'm not like, it's just, okay. So it's interesting that, so we learn from our children. Let's talk a little bit about that. How would we learn and how they force us to learn? I think through so many different ways. I would just, funny, we were just talking about that yesterday because to me, you know, my daughter, seeing she was a little baby, I have to say she was amazingly great. She was so lucky. It was problematic. She was like most moms there. My mom always told me, she looked at my daughter and we're always traveling seeing she was a little baby.   She packs her back and you guys are on the airplane six hours later. You know, but, but I think my challenge actually came in a different form. My daughter, unfortunately, starting two years ago, started developing some pretty serious medical issues. So she started with scoliosis that was getting worse literally every month. So we started to travel to Los Angeles to see doctors at Cedars-Sinai and L.A. Children's Hospital pretty much every four to three years. So you had to readjust your kind of priorities? Absolutely. I actually took almost a year off from traveling just to be with her because to me, that's important, you know. And other than scoliosis, she recently got diagnosed with some autoimmune system disorder. So that has been a really big challenge because now I'm put in a position that not only have to be a single mom, playing the role of being both mom and dad, I have to also be there as a counselor as well. Because this is not an easy role for her. However, I have to say, she has been amazingly positive. If you just look at her, you wouldn't be able to tell she's been through so many medical issues. So how do you think you've learned from this process? You feel like, why have I given this on my plate? You know, I'm already working hard and doing what I can, but I get more on my plate. You can't do the blame game. Some people do. Do you think we're destined to have what we have and it changes us for the positive and if you can figure out how to do that? Absolutely. I am a much better person today compared to two years ago before she was diagnosed. I am much more patient, I'm calmer and I do feel I'm stronger than two years ago. What about you, Gungun? What are some big challenges for you coming forward? Because how old is she now? Five and a half. Right. So you've got a lot of phases to go through. Yeah. As she said, we were just chatting. I said, my daughter is the opposite energy.  I believe so. I love her. She is a little spark. Yes. But I learned I become younger through her eyes, we're looking at the world. When we travel, she would say things that is so beautiful and so fairytale and actually make me think, I used to be like this. Why can't I look at the world in her eyes, through her eyes again? You know, there's a beautiful film in China, in fact, about the view through the eyes of a five-year-old boy based on a true story. Yeah. So that's how... That's the first thing I've learned to look at the world in a different angle through her eyes. Right. Second, they are... I think the kids nowadays came to earth are stronger souls and far more smarter than us. That's a good example. And, you know, as a Buddhist, I train myself every day to observe my senses, my emotions, my conscious. I should always be aware of what's going on. So sometimes, as a mom, especially, when I try to help her to build a healthy living habit, for example, fold your own clothes when she's five and a half, and she sometimes doesn't want to do it. And it was one time I was really getting a little bit at the edge of my nerve, and I reached my voice. She said, are you step... my stepmother? Oh, wow. So that's interesting. Fairytale, sorry we have no more time, but what I'm getting from both of you is the spirituality, the deepness, and to learn from your children, to see life through the eyes of your children, it is so important. And you both are so different, but so similar. And the spirituality and the energy is just amazing. Thank you so much for sharing so much, and I hope you learned a little bit too. And again, just enjoy your children and enjoy everything. Thank you for tuning in.