What's up you guys it's Madonna welcome back to my channel for those of you who are new and there is a lot of you Welcome to my channel if you have not had a chance to kind of get acquainted with me in my channel I typically make healthcare related content that is educational informational and inspirational So take a look around at my channel if you like what you see go ahead and subscribe I also want to get to know you guys as well as you're getting to know me I want to get to know you so as you're watching this video Please leave a comment in the comment section below What city and state you're watching from well, you don't have to be that specific You don't have to tell me the city But you could absolutely tell me the state if you want to do that You know if you don't want to do this whole city thing Definitely let me know where you're watching from and if you're watching from another country Let me know that as well because I want to know my viewers and where you guys are watching from as you Guys get to know me So many of you have seen my video from last week where I failed my boards and yes I was very sad and like in a little bit of a depressed mode But I did not want you guys to think that I stayed in that mode I was in a mode of like why why did this happen? Why me? Why god? Why? And I realized that I should be focusing less on the why and more on the what what can I learn from this experience What can others learn from this experience, which is my experience and what next so what I Learned from this experience was that there are a multitude many many many multitude of really nice people in the world you guys have kind of like restored my faith in humanity because It's hard when you're like always on the internet or like you seeing on the news like it's always some new tragedy But you guys came with all of these words of encouragement You uplifted me you gave me hope letting me know like hey like this will pass. This is not it Like you you're gonna do great. And so I'm really really really grateful for that I'm very Private as I told you all in my last video But I had to share and so I was really grateful for all of the words of encouragement I thank you guys so much It really helped kind of like propel me out of that mode of depression that I was in I've also learned that you cannot go into test Afraid and I will talk more about that in another video But that was something big that was kind of weighing on me as I went into the exam And so I was just really really scared and so I'm gonna just touch more on that You know just kind of like performance anxiety or test taking anxiety That I experienced that day and I also learned that this is not it like yeah You are not a failure per se and I know I said that I felt like a failure And I mean at that moment I really did I did not pass my test I failed it and so like I felt like uh man like this is it, you know I had a lot of people investing in me not only monetarily But just like spiritually praying for me and you know like kind of having these hopes for me And I didn't really want to disappoint anyone because I'm like you guys invested all of this stuff in me and now Like I didn't kind of fulfill what I should have fulfilled But um, everyone was fine. I told my mom. She was great. She was like, oh, that's okay Like well, what's what's gonna happen? What's what can happen next, you know, and so um, it's been a great experience Although I have to I had to kind of deal with this like shame and hurt and you know sorrow initially Like this has actually been a really good experience Which is crazy something that um, I learned and that I feel others can learn from this is that hey, it's okay To have a depressed mood. It's okay to be sad when things Don't go the way that you envision them and when something is just like not cool, right? Like it's okay to be sad. Like that's a normal feeling to have however If you stay in that sadness and for everyone this time period is different But what I've learned and what I know is that once it starts affecting your daily life like negatively Then it's too much. So once you or others see that hey, this is affecting the way that you're living Then it's really time to kind of like push yourself up out of that But it's okay initially like you don't have to feel bad for crying and feeling sad. Okay. And lastly What next so what's next is that I have to take this test over again So I can take the test up to six times You can take it three times in a calendar year and you have to wait 90 days in between test taking modes So like I told you guys I have 90 days until I can take this test Um, I am not telling anyone when I'm taking the test because that kind of like gave me a little bit of anxiety Like everyone's like, hey, what are you taking the test? All right You're gonna do great and I know that people thought like that was like really encouraging And it kind of was but because I was so afraid it kind of did the opposite and made me just feel more anxious So I wanted to spell all of that. So I'm not telling anyone when I'm taking the test But I will be taking the test over so that is like first up. I will be studying very hard for this test I will keep you guys updated on my studying my study tips You know, I already like talk about study tips and habits And I just want you guys to know that this had nothing to do with knowledge base. Okay Like my school did two board reviews for us We had lots of quizzes throughout my last two months of PA school Lots of material to learn. I was studying the week up until Me taking my board exams. I was a really good student when it came to that information So it really wasn't that um, and that's again, I will talk about like that test anxiety that I had It was more so I was just scared So um, I will be talking about my study tips and what I'm doing differently and what I'm keeping And I'll also just kind of be going through, you know, just the feelings that I'm feeling now that I'm sitting up here And I have to take this test over again and just kind of going through that process But that's the first thing I'm going to be retaking this test and studying for it I'm also going to be putting out more content, you know I will continue to make videos for you all just giving all educational information and inspiration that I've learned along the way And just kind of keeping you abreast on me becoming a PA and what life as a PA currently in a certified PA soon to be will be Again, I just want to thank you guys so so much. Oh my gosh. Like you guys are amazing Okay, uh, all of those words of encouragement really really helped me I cannot say that enough And um, it just goes to show like how a little bit of kindness like how far it can go because you guys don't know me like that But you guys took the time to write a message out And encourage me while I was spilling down and so thank you guys so much for that Thank you so much for following me on this journey. I really appreciate it I feel like I'm about to cry again, and I'm not even a crier So I'm gonna like cut that. Thank you guys so much for watching. I will talk to you guys next time. Bye


Hi everyone, Joe for jasmiescasebreaks.com. We did it. We sold out 2019-2020 Panini Mosaic last box number 20 Given away the last spot in NT basketball tiered random teams big. Thanks all of these folks for getting into the action and There's all the teams right here As always we're gonna do the break itself first. So let's roll it. Let's randomize six into two eight times one two three four five six seven and Eighth and final time After eight we've got Jared down to Steven six into two eight times for the teams Two and eighth and final time after eight. We've got the Hornets Down to the wizards. All right. There's the first half of the list right here There's the second half of the list right there Alan Pelicans Alan Grizzlies Silver Zion Silver Jammer and out of here I'll cover some spots and then Let's print. Let's rip. Good luck. And then we'll re-randomize that list and see who wins that final spot in a tiered a random teams Zion base nice. That'll be for Alan and the pelicans there you go Alan not a silver one, but still nice and An Isaiah Roby Genesis nice That's very short printed that will be for Zach Paul and the Dallas Mavericks Kobe White is cool to LeBron give and go Insert that's pretty nice Lakers that will be for Josh Josh V. Oh, and the rare rookie scripts autograph in these blaster boxes Nicholas class usually goes with Nick. He goes Nicholas Klaxon in this one Alan with the nets Yeah, a little bit class here, I guess Hmm. Yeah drops the H and the Nicholas And no K when he shortens it Yes, we drop drops the K goes NIC All right want someone on this list is gonna win a $1,700 spot Good luck from Ray Phillips Down to Steve Let's roll it. Let's randomize it five and a three eight times name on top every eight one two three four five six seven and eighth and final time after eight Big thanks to everybody Who gave this a shot? I appreciate it and Congrats to Steve Steve P. Congrats to you.  Thanks for watching. I'm Joe. I'll see you next time for the next one. Bye. Bye


Really pleased to move on to the National Rolliston Award which is given to an individual group of organization that has made an outstanding contribution to harm reduction in the conference host country. The award is named after Sir Humphrey Rolliston, president of the Royal College of Physicians who in 1926 successfully advocated for the prescription of heroin or morphine as legitimate medical treatment for those who needed it. So I'm so, so pleased to tell you the winner of the National Rolliston Award for 2023 is Gabby Brunning. Gabby is seated nowhere near the front which shows incredible passion and dedication in all of her work. Her driving commitment to the harm reduction space in Australia is where her true passion lies and where she really shines. Gabby works the Victorian Aboriginal Community Controlled Health Organization, BATCHO between 2019 and 2021 and represented the organization at a number of high-level state government meetings, stakeholder meetings and policy redevelopment meetings for communities. Gabby's passion and expertise in harm reduction practices, advocacy and policy development has led her to becoming an expert in this space and working with the Victorian Aboriginal communities and workers. Gabby has worked in the medically supervised injecting room since its opening and always ensured the Aboriginal ways of knowing, being and doing at the forefront of all the work she carries out. Congratulations Gabby. Yeah so I am clearly very underprepared compared to everyone else. I have not prepared anything but I think it's pretty clear to say that we are all in this work because we have we have a focus we are here for the punters we're not here for the guts and the glory we are here because we want we want a better world where harm reduction is the forefront of everything and there is there is no breach of human rights we want all our punters to just live the best life that they can without having to fight for themselves every single day. Thank you. Yeah I just thank you for yeah for being nominated like this is just really fucking amazing and just to be I and you know it is really dark like I cannot see anyone's face but um yeah this um this comes at perfect timing and I think it's just it's a really nice reminder that there are haters there are haters out there and there are people that will try squash you but just don't let those fuckers win pretty much just keep pushing forward and um yeah keep doing the best that you can thank you


I don't think anyone is new in the room, but I guess I'll reintroduce Masayuki again. So this is the Cloud Containers and DevOps Track. Masayuki Higawa is a senior software engineer at SUSE, and an open stack developer, and he's going to be talking about free and open source Kubernetes management tools. So without further ado, Masayuki. OK, thanks. Oh. OK. So I will talk about, sorry, I'm Masayuki Higawa, and I will talk about free open source software Kubernetes management tools. So this slide is on here. And so my GitHub Twitter free node is Masayuki G. So if you have any questions or contacts, please ping me on that. Yes. And I think almost the people are the same, right? So I am an open stack upstream or downstream programmer. And my job is a quality assurance in the upstream or the downstream. I mean, I'm working at SUSE. I'm also a quality assurance member of the SUSE OpenStack Cloud. And I'm also a methods user group in Tokyo. So this is a bit update profile. And in this talk, I'd like to talk about Kubernetes. So why do I like to talk about Kubernetes? Here's the reason. So first one is it's a famous and interesting topic, technology. So today or previous days, many people are talking about Kubernetes or Docker or like that. So I also, I'd like to know the technology. So I tested some in my cloud. So it's a free open source software. And I also use it in my cloud. I mean, not Google Cloud or Amazon Cloud or Azure. So I'd like to talk about my private cloud. It's three one-use servers plus one workstations. It's powered by the Lack Rock. It's already talked about Matthew in this morning from 10 AM. Yeah, already talked about that. It's very similar. The difference is servers spec and the number of servers. So if you want to see more, if you would like to more, you can see the GitHub page of Matthews. And the difference is also Linux distribution and the OpenStack distribution. I used the OpenStack Queens version on OpenSuzerLip42.3 version. And I set up it from OpenStack distribution. I mean, just use a package, not a turbo or a Git source. So it's really simple. And I have no trouble with that, basically. But there are some issues on that. It's a network. I build it in a very flat network. VMs are connected to my home router. So it's a very simple network. I can show you my network environment. Well, let me. Yeah, like this. So VMs are connected to my home router directly. And my workstation also connected to the router. So it's very flat. So I don't need to split the network. I don't want to split the network because it's a bit complicated to me. So here's what is Kubernetes. Maybe you already know that. But it's a container orchestration tools. It has a lot of features like self-filling, automatic binary packaging, horizontal scaling, auto-scaling, load balance, something like that. And it's open source. But I've heard that it's a bit difficult to deploy it, especially in a production environment. So I like to use it easily. So I checked some first tools. So why we should use the first tools? It's free, not only money, but also you can see the source code. And so we can know everything. It should be fun, right? And I have the resource. I mean, I have my cloud. I can run on that. And so first, Kubernetes tools. There are some tools like this. MiniKube is kind of a, I think this is not only for, this is not for a production environment. It's only for developers' test environment. And the second one is OpenStack Magnum. It's one of the OpenStack projects. I'll talk about that later. And the third one is Metos, DC OS, and Launcher. So I'd like to talk a bit about Magnum. It's an OpenStack project. And it's API services for container orchestration engines. So this Magnum not only supports Kubernetes, but also supports Docker's form or Apache Metos. And I only read the document. And it will support DC OS too, but not yet, probably. And Metos DC OS is a, Metos and DC OS is a kind of different. But DC OS is based on Metos, right? So Metos is an abstract CPU memory storage and the computer resources. This is similar like OpenStack. But it's also enabling the Fortoriant and Elastic distributed system to easily build and run effectively. Yeah. And DC OS is called Data Center OS. It's an open source distributed operating system. Yeah, it has more features compared to the Metos. And I think DC OS is one of the point is it has fancy catalogs. So probably I can show you if I have time later. And you can see the information here. And then Rancher is an open source too. And it's a container management platform and the deploy and manage the Kubernetes with ease. So I tried to use it. And I found that it's very easy to use it as a first step, as a starting point. And this also has a fancy catalog. So it's really good, I think. So there is a plus cons. I tried to use the Magnum and the DC OS and the Rancher. So here is a plus cons. So first, I tried to use the Magnum. But I failed to build the environment. There are some reasons. One reason is Magnum requires a separated network. It doesn't fit my open-source environment. So it's one of the reasons. So if I can use the Magnum, it should be used with the standard APIs, I mean the OpenStack API. So if you are very familiar with the OpenStack API, it should be a good option. And the second is the methods, DC OS. I need to change the sentences. So methods needs several nodes at least. It's one of the issues, not the issue, bad point. But a good point is it already has a full tolerant. So it should be a good point, too. And Rancher, it can be started from one node. It's really good to use. So people doesn't have a lot of nodes, basically. So it's really good. And Kubernetes CLI included. But I think CLI4 to manage the Rancher is poor or not. But there are some APIs. So we can use that from that API if we want to use it from the CLI. So for future work, this future work is just for my project. I mean for my private cloud. So I need a real use case to use like these Kubernetes management tools. So one candidate is IoT things. It should require a lot of resources or like that. And as in test environments, it's also good use case for Kubernetes. And I think I should have more stable infrastructure. But it's not so unstable for my opens to 42.3 right now. So it's not so high priority. And the third one is introduce network isolation to use OpenStack Magnum or like standard OpenStack Cloud. And the last one is, yeah, I'd like to use Magnum. So here's the conclusion. We can play the Kubernetes with the posts tools easier. And having a private cloud is very fun. So I'd like to show you kind of a demo. If I still connected to my cloud. So here's my cloud dashboard. So it's not so different from the standard OpenStack Cloud. So you can see already I have 1, 2, 3, 4, 5, 6, 7, 8. VMs on my cloud. And there's some variety of the VMs. I run the OpenSuser, Debian, Ranchoist, and the CentOS like that. So if we have the private cloud, we can run a lot of VMs like this. And I'd like to show you the DCOS dashboard. It should be work. This is work on my cloud. But there are some network issues probably. Yeah, so it doesn't work. But yeah, if it works, we can see that a lot of application catalog on that page. And just quick the applications, it will be deployed to the DCOS methods cloud. So it's really easy to use that. So I think this doesn't work actually. So this is the end of the week. It's how many hours? OK. So that's all for me. Thanks. So any questions in this part or the previous CLI part? Whenever, whichever you want. OK. Thank you. Thank you very much.


One of my most significant moments that I think I had was we pulled into a small island off the coast of Australia called Pego Pego. Didn't even know it existed. I've heard of a pagan before, but I'd never seen or seen a country as diverse as this one. I mean, to go in there for seven days, our captain of our boat, which at the time was USS Chosin, wanted to build a school for some young children and to see 300 people from our cruiser come together and build this school in a matter of a week was something that it made me think that we'd give back. Of course, days later was 9-11, and we went into crisis and attack mode. I've seen all scopes of life. I've seen all scopes of work. And for the most part, the camaraderie and the teamwork that's on a boat, I think is what I most remember from the experience in the Navy.


My name is Ron Bolster, I'm the Director of the Office of Kettichetics at Franciscan University and the host of the St. John Bosco Conference. As my brothers and sisters in Christ have been reflecting upon the initial stages of discipleship, upon the seed stage, it gave me an opportunity to reminisce about my own early discipleship. When I went off to college I was a little ambitious, I wanted to do well in my courses, I wanted to run fast enough to make the cross-country team. What I figured out is if I wanted to achieve those goals I would have more success if I hung out with the people that were smarter than I was and people that were faster than I was. And so I did, I ran in those circles literally and figuratively and learned a great deal from those who were better at those activities than I. At a certain point I encountered the Jesus people, people who got my attention because they were living in a way that I knew I should be and wasn't and they also had a freedom from anxiety that I didn't have, a certain peace that I found very attractive and intriguing and so I decided that maybe my theory would hold there as well and I began to add some of those folks into my circle. It was only a little bit of time at the beginning but afterwards I added more and more and more and as a fruit of running in the circles of those who were intentionally and aggressively pursuing holiness I was able to advance myself and that was a very very valuable experience for me. We're thankful that you're running in our circles and I encourage you to consider the suggestions that my colleagues have made with regard to deepening your own discipleship. To look for others who are pursuing holiness aggressively and to run in their circles and even when you feel very alone on the road to discipleship that you turn to the Lord who's ready to take you out of the darkness and find you the fellowship that deepens your relationship. At the Catechetics program at Franciscan University we speak about the testimony or the witness of Christian living as a major foundational means of making disciples and in that discussion we consider three groups of witnesses, the witness of the individual, the teacher, the catechist, the mentor or just the co-worker whatever it might be. We also speak about the testimony, the witness of the community. Ideally that would be the parish where all the Jesus people are hanging out but could be the people in our family could be the people in our workplace.  Secondarily don't try to be the only witness but rather introduce your disciples to the lives of other witnesses. Again the people at your parish who are making a difference, the people in your workplace, those that you know who have been intentionally intentionally taken up the road to holiness. Allow your disciples to be in their presence and to run in their circles and never underestimate the impact that the witnesses of the past can have on us to introduce your disciples or to introduce yourself. Thank you again for being with us. I look forward to the opportunity to send you to the next stage of discipleship as we wrap up these stages and look forward to the fruit. It is a great adventure, extraordinarily fun to be involved. Welcome to the journey.


What's good boys? I know I don't have the stash. I had to shave it, but I'm bringing it right back So just bear with me for six straight years. I made videos with no stash. All right, you'll be okay Let's focus on the good Tito is back commending felonies like always my little fugitive my little fugitive And for Halloween this year I decided to dress up as my favorite doctor Johnny sins I had a plethora of options actually Johnny sins one of most accomplished men of our generation He's a plumber an astronaut a teacher a firefighter He even has a medical degree Tito what I mean to do a little inspecting big one in Tito big one in big one out Yep, he's got that dog in him. I agree. There's no cure Tito. You're just born like that Hope you guys are having an amazing Halloween. I think I messed up I think last wheel of mud I was pretending like that episode dropped on Halloween I was totally had my schedule mixed up it drops. This is the Halloween episode There's a lot to look forward to in this Halloween episode. I think most importantly it's the NFC championship It's kind of hard to top that obviously the Super Bowl right But some may argue that the NFC championship is even more important because making it to the Super Bowl is how I get a New prestige player so before I talk about prestige players since I don't want to get ahead myself and talk about a win that I haven't gotten yet I'd say wide receivers are pretty locked up hat backs are pretty locked up Michael Vixen 90 now So that's amazing a coy is a beast gates is so good.  So sad. Jason Kelsey didn't get a card I totally thought he'd get a 90 overall in most fear, but it's okay. I still have faith in that prestige minors Lane Johnson's just a good online I would upgrade online today if I can and then on defense I feel so much better after getting Derwin James Derwin make a Troy Charles Woodson Really, I could get a detackle upgrade where I have an inside stuff detackle some more legitimate linebackers and bro Michael Parsons might be one of the best players in the league Why is Michael Parsons best card in the game in 87 overall like why do Quinn minors and Michael Parsons have the same overall card? It like what in fact the fact that they haven't dropped a Micah tells me they definitely have a Micah for either Thanksgiving or Christmas regardless.  I guess I could do detackle We can get any 86 overall player in the game We have to get inside stuff detack pressure Michael Pierce has a most feared card and it gets inside stuff and it's 87 overall Bingo 87 overall Michael Pierce run stopper detackle 87 block shed. He's a big boy inside stuff to AP keep it simple All right first wheel spin keep it simple 87 overall jackpot our next one. I take an 89 plus online min Let's see if that's possible. This is only technically maybe possibly good most feared random scroll We sort by time remaining we click on the most fear promo and I start scrolling so as you can see There's 84 Dre Greenlaw who wouldn't help me but then right here is 90 Debo Sprinkled in here is 92 Tyree kill 92 Harold Carmichael.  I'm scrolling right now three two one stop Oh 84 Curtis Samuel darn honestly, I really wasn't even close to any of the good ones There's 92 Trent Williams who would have been insane, but yeah, I would have to get lucky on that one Curtis Samuel Welcome to the bench my friend. Hey, that is not what we need We need a heater on the NFC championship. Come on, baby. Come on, baby. Give me something nice Hey Open five times. Oh, gee man. This is so dope So you guys haven't see you guys have never seen this actually you guys have never seen this So I can go back to any old Madden where I can still open packs and I can open five packs I could choose the best version of one player out of those five packs. Do I go 22 or 21? I'm actually gonna go to Madden 21. I think it'd be more fun to throw it back a little bit further What do you mean by that throw it back a little bit further what my only options are Madden 20 Madden 21 and Madden 22 Since the servers are down for all other Maddens. I got my 97 overall squad Wait, what's my team look like this would have been my oh this would have been my ending wheel a mutt team Yep I have Barry who is a prestige and 99 Adams 99 Julio Julio was a prestige Golden ticket Jalen Rager Gold 99 burrow who I also believe was a prestige No, Dalvin Cook was a prestige and he was good for a long time, but then Barry out played him This is some of the coolest card art ever. I remember this air and Donald dude This card art went so hard. All right enough nostalgia. I get open five packs here. Yeah So for example a 92 Devonte Adams just dropped in Madden 23 So if I pull the Devonte Adams in this pack, I could take the 92 Devonte Adams on Madden 23 The game changer pack is 581 plus overall elite players. This is the move then I don't get any ultimate legends Oh, I think this is the move. Let's see. All right. First ones are. Okay.  All right. This was an L. This was an L. We got clutch up here Oh a moat. This was the old most feared. This is a legend. Don Hannah. Does he have one in this Madden yet? He does not even have a card yet. Javon Hargrave doesn't have anything. Oh an ultimate legend He doesn't have one. How do I get to Kyle van Noy? So you're kidding me Robert Quinn does have a pretty nasty 87 overall and he's on the Eagles now, isn't he? High tower is not going to have anything. McCordy, nothing. His brother's got one. Oh My boy Atwater. Can we bring him back? I got too many good safeties. I can't be bringing him back We do get a zero chill shot. Paramount that does not help. I guess we got to go ultimate legends fantasy Let's mix it up because that was not it. Josh Allen back when he was a gold Wait, does he have a good card? He's got something right. Josh Allen has a 92 Oh my god, it's from the new drop.  That's our best option right now. No question 92 overall Garrett Bradbury also has a pretty good card. Garrett Bradbury's got an 87 center ultimate legends fantasy is clutching up right now Blake Martinez, Frank Clark. Oh, that's a team. Whatever team affinity. Blake Martinez All right, Josh Allen is the move right now. It's our second round Zitler. Does he have one? No, I didn't have anything good. Allen Robinson, Ricky Jackson Allen Robinson's got an 87, but ain't worth it and then our ultimate legends This would have to be someone like see. I don't think he has one. I got Aiden Hutchinson not Steve Hutchinson and Oh Actually a nasty poll because there is a 91 ladenian Tomlinson, but how am I gonna compete with my boy March on Lynch? All right, let's do one final ultimate legends fantasy back But right now we have an option of a 92 overall. Josh Allen.  He's got a good card. Just don't need it. AJ Dylan I love that Leonard Floyd. I love that too Gary on Conley. None of those are anything crazy But then I can really use Joe Thomas. Isn't Joe Thomas have one this year already Ridley. I'm not gonna make the joke I made the joke so many times. I'm not gonna make the joke. All right And shit, I might have a draft king's ad on this video for all you know So I can't make the joke. Yeah, it's gonna be hard to beat Josh Allen our ultimate legend here Now the estimate that he does definitely not have he definitely doesn't have one this year Oh Larry Allen, that'd be so sick if there's a Larry Allen, but there isn't wow Well, dude, Josh Allen was a big clutch up and it was his gold left end Which is funny because in all the meds. He's an outside linebacker now So we're dumb about it. I felt 21 the way that wheel spin worked was I could take the best version of one of the players We pulled so Josh Allen's got to be the move here 65 260 87 speed 90 excel 90 block shot Damn, Micah can stay right outside. Josh Allen can go to left outside He gets a 3 ap edge threat and he also gets no outsiders quicker run shreds against outside zone plays I'm actually gonna use both.  I really couldn't be more ready 87 overall squad Let's go win the nfc championship.  We're loading into the game at this very moment, too This is nerve-wracking. What is it? What is it? What is it? Oh My qb needs 30 fantasy points. I'll calculate that at the end our top three Josh Allen derwent james dk mechaf. He's got the new jaylen ramsey delaney walker rod Woodson, this is gonna be a ball game, baby j jetta start us out hot, baby Start us out hot All right, that wasn't too hot. So 30 fantasy points in my quarterback I honestly don't remember the exact scoring rules in ppr for quarterbacks So I will just have to calculate this at the end But I know rushing yards and rushing touchdowns count just like a running back. So I'll try and put an emphasis on that Let's see if we can hit marshan early bro What was that throw? What was that? That wasn't even his user.    Get over yourself in the first quarter You can at least have the courtesy to like use chew clock Now the run play we're there for this one. Oh my animation.  Oh, that was all of that was so unbelievably unlucky We literally have no choice, but do now play this game with a seven point handicap. So let's go.  Let's go. I can't really tell what this coverage is great roll out Michael vicks made something out of nothing there. I was literally scared to throw the ball Gates beautiful route gates nice hard cut That's just barely there not even really at all Jesus third and 12. I really didn't see much there. It's kind of tough to stop five wide if you're not gonna play on a lineback Let's see if this is actually a man or if this is a cover three That's actually a man, but that means gates is gonna be wide open. What a ball Let's go. Let's go. No huddle. I'm on a score. What's he got? He's on hutch Like half big boy big boy with no time in the first quarter great response touchdown I'll take the p.a.t for now I want to see what this guy can do when he's forced to play a full drive of offense Not starting at the 10 but a full drive of offense and nice for the fantasy points on michael vic there The interception should take points away from him though, right? All right. Hey, we're there. We're there. No, no, no All right, it looks like we're looks like we're fighting some demons on today's video I'm gonna guess pass here and see if we can get some heat Ah, that's bad very bad Love it over the middle nothing jimmy g goes down to chandler jones nice play Now we're really guessing pass because he actually has to pass here.  He didn't have to pass but i'm okay with that. I'm not guessing pass anymore Nice ball. Why are you so slow mica? Why is the lady walker? Look at he's at 95 speed 14 to 7 Just gotta go down there and score once again Vic is fast. This new michael vic is fast, bro. Way to get out of that So the whip route will make its return That's a beauty right there Look at beast mode 7 to 14 this might be a high score in one voice Nothing was open.  I could shoot clock here, but I want the ball back March on march on. No gonna 10. Hey, let's think about this. I think metcalfor gates is a very good option here Not man metcalf Oh, what a kick if he had switched on a little sooner. He could alert that 14 to 14 Here's the problem. He's got three timeouts in a minute and I don't get the ball half So if he scores here and gets the ball half and then scores again, it would be really bad for me I need to stop the run. I'm gonna go 4 3 under that gives me shag barrett mica polamalu All right, perfect though. I'm not guessing pass anymore.  Damn this guy's having no trouble scoring on me and he's gonna get the ball half I think if I could throw this route to beast mode twice successfully, we actually to pick this up Just even one Oh, I should have I can get as many yards as I need If he had gone down sooner, I actually could have got that field goal and interception to start in a game Like this really gonna hurt if I can't get a stop. I gotta turn him over. All right. I feel like this is a run Beautiful stop. That's why we got inside stop Michael Pierce. Nice work. Can I feel like he'll actually throw this one? Nice route Like ice George Kittle just running around guys. This is so weird Hey, fourth and five. That's a deep field goal Oh, I'm getting so tilted. Oh, how did you just walk over three of my guys? Look at this. What is that and he's chewing clock dude? I don't really stand a chance at this point He's gonna get to milk the entire third quarter that one mistake at the start's just gonna bite me in the ass Dude, can I help you? He gets the inside stuff and he runs right past him and he has a little he could have ran for 100 yards right there He's not really open That's a hell of a ball Michael Vicks got run and gone activated We're honestly playing a great game other than our mistake right at the start and he gets ball a half It's just a bummer. Oh, that's not a good ball. You know what it continues to be a good ball I'm I'm really about to lose a playoff game to a d-line user.  I'm looking at tonio gates here I don't think he can I don't think he can guard that What about best games and lose although let's not give it up quite yet three timeouts three minutes 42 seconds left I don't know why I can't stop him, but I can't stop him. I'm a nickel right now So this isn't a very good run stopping defense. So I don't stop the run. That's okay But there we go. Okay, you're in there. You're in there that time. That's a good start. He's gonna be chewing clock He's been chewing clock since the first quarter just kisses a pass. I want to be ready for it to be a pass Look at him. Look at Michael Pierce.  Oh my god. He was standing right there My best bet actually is to let him score right here.  He can just chew the clock and then kick a field goal I have to score within about 45 seconds.  I can tell you that I wonder if Michael vicks got his challenge though because that's gonna be big whether I got this with Michael vick or not It's gonna be pretty important. I'm gonna check the stats here in a sec I wouldn't mind a rushing touchdown with him though other touchdown for vick Really the challenge wheel is the most important thing to me now Let's check the stats. So vicks 60 for 21 four touchdowns 274 yards two interceptions though That's gonna pull the stats down and rushing. He's got three yards.  See if I can get the ball back for Michael vick here I don't know how to onside kick. Did I just get it? I just got the onside kick. All right I really would like rushing yards So fucked. Why does his team feel like it's 99 speed? Is there some ounce of validity to what I'm saying? He's got a QB spy on me now.  Wait, GD to my opponent. This guy was awesome. Even as a d-line user, his offense was unstoppable I think he scored every time he touched the ball. So it really wouldn't have mattered.  So vicks got 274 yards four touchdowns two interceptions He rushed for seven yards. He didn't get it at about 24 if I had thrown one more touchdown I might have gotten it. It's not the Cinderella story. We were hoping for boys. There's our loss in the playoffs That hurts number one normally I would only prestige a player if I made it to the Super Bowl But this team is way too good to carry into a new season So at the start of next episode will be the brand new season This team will be wiped of everybody except for my current prestige players Which is Justin Jefferson, Jason Kelsey, Micah Parsons, and Tripola Malu Additionally, I can prestige one player from this lineup We may not walk away with the Super Bowl ring, but we can carry somebody over. DK is an amazing option So is Marshawn Lynch. I really did not like Michael vick. I don't really want to use a lefty quarterback ever again So I'm all right with that Antonio Gates.  Josh Allen would be a pretty incredible prestige too Oh, I don't get to keep him anyway I couldn't even prestige Josh Allen if I wanted to because I lost that game So I lose him I don't think anybody else on defense really excites me that much other than derwyn james three weeks from now I want to be back in this seat, but I'm gonna have to make some serious defensive adjustments in my game If somebody could drop 42 on me without even trying that hard.  We did not make the Super Bowl, but I'm proud of how far we went I'm proud of DK. He was a monster. Marshawn Lynch was so incredible. I'm gonna miss him And uh, I'll see you boys in the next one. Peace


Hi everyone, thanks for tuning in. My name is Tyler Gilson. Today we'll be discussing building apps in Kubernetes, the unforgiving sea of containerization and the lifesaver tools. A little bit about me. I've been working with Kubernetes projects since 2019. I love building distributed systems and developing POCs with all the latest and greatest Kubernetes projects and sharing what I learned with the community. I'm a Principal Software Engineer at Spectro Cloud. Feel free to connect with me on LinkedIn or Twitter. I'd love to hear your thoughts. Okay. The agenda for today. Briefly we will touch on Interversus Outer Loop Development and how that relates to the software development lifecycle. We'll then look at a suite of tools that I hope will be able to help you experience greater efficiency in your personal workflow. And then we'll look at a demo application, Dad Jokes Generator, which showcases some of the tools that I will be discussing. Moving on. Most of us are already familiar with software development lifecycle and perhaps you've heard of the Interversus Outer Loop Development. But just to set the stage for some of the tools I'll be presenting today, I'd like to touch on this a little bit. Initially, there's been a movement over the past decade or so to shift left, so to speak, in our development workflow, meaning that we take a lot of the practices that are typically invoked in the so-called outer loop as we get near to production. We integrate and execute on those tasks earlier in the development lifecycle. This is desirable because it effectively allows us to capture security issues and perform a variety of tests early on to catch bugs and ensure high quality. But the downside is that it imposes ever increasing cognitive load on us as developers. However, this can be mitigated with the understanding and usage of certain tools in the ecosystem that make this easier. Because the goal of achieving parity between the inner and outer loop is valuable. It's just how we do that without making our lives overly complex. So I'll touch on that further today. Okay, let's look at some tools. So typically we start off coding when we're producing software and where do we do that? We do that on our laptops and our local development environment. However, our laptops sometimes get coffee spilled on them and other things can happen. So if I was to ask you right now, how mad would you be on a scale of 1 to 10 if your laptop broke? Hopefully the answer would be not close to 10. If it was close to 10, then you should be considering some of the new tools that have been developed recently such as Gitpod. And there are a suite of others, but essentially they allow for a containerized development environment. This solves the classic, it works on my machine problem. Whereby, you know, there's some advanced configuration necessary in order to install dependencies and set up test environments so that you can do development against a particular repo. Nowadays it's simple to containerize all of that complex setup such that new developers can be onboarded instantly and seamlessly. Basically, like a container, your development environment is portable, shippable, and shareable. So definitely something to look into. And another crucial aspect of the development environment as everyone knows is secrets and environment variables. And the last thing we want to do is check those sensitive pieces of information into version control. So I'll be touching on a bit of a tool during the demo known as Gitleaks. Gitleaks is just one of many plugins that can be utilized by the pre-commit tool. Pre-commit will invoke the Gitleaks plugin to prevent us from committing sensitive information. This is a very useful tool that we should all be aware of. And lastly, when writing our code, we should of course keep in mind the concept of a 12-factor app. And this reference here to 12factor.net is something every developer should refer back to from time to time even if we're already familiar. So I encourage you to take a look at that. All right, we've written some of our code. Now we need to build and deploy our code. And how do we do that? Well, in the early days of the container world, we might have done that with Docker Compose. However, nowadays we're mostly in Kubernetes has sort of eaten the world, so to speak, in the software industry. I'll be focusing primarily on Kubernetes. We do need to most often leverage tools such as Docker to build our container images and therefore we deal with the Docker file. And then we wrap all of that in automation, typically using tried and true tool like Make. It's been around for almost 50 years now. It's battle tested and I encourage the use of Make, but there are some fancy new tools that are worth checking out, notably Taskfile and Earthfile. Earthfile is very interesting because what it does is it allows you to execute all of the typical tasks you might consider as Make targets inside of a Docker container. And that allows for ultimate consistency across environments. It'll run exactly the same in your CI pipeline as it will on your local machine and it's architecture independent. So definitely a cool new solution to check out. And then, you know, let's say we've figured out how we are going to automate the build of our containers. We've written our Docker files and now we need to deploy to Kubernetes. Well, we need manifests for that. And we're typically not deploying just raw manifests or raw YAML. You know, the two solutions that most prevalent in the industry are, of course, helm and customized. But I do want to mention that each has their own place. People can often misuse these tools. And in general, I would suggest that anything that is user facing and involves configuration that is not internal to your software, that should be done using helm and the templating engine that helm provides. And then specifically, you know, internal environment specific customizations should be applied using customized and that can be done as a post rendering step where you've already rendered your helm. And then you customize it further with customized. Then Q is another incumbent technology that's worth checking out. It provides strongly consistent static typing for your manifests and can execute tests against your manifests. Of course, reducing boilerplate much the same way that that home does, but worth checking out Q as well. All right, so now it comes time to deploy our code. We've built our containers. We have automation in place and we need to get that running and do some debugging and development, preferably in a local environment and some popular solutions there are mini cube kind and K3D. However, you know, developing locally is the goal, but it's not always possible because some of the time we can benefit from having access to a more complex development environment that consists of tools and services developed by other teams. And perhaps that that whole ecosystem is complex enough that it's difficult, if not impossible to stand up locally. In that case, where these other tools that I have listed here below really shine is that they provide a bidirectional file sync that enables us to do in container development. So what I called a full dev experience. So scaffold, dev space and tilt enable you to have that complex remote development environment, perhaps running in a Kubernetes cluster posted by a managed Kubernetes service. And you have your local ID and you're performing development against one or more microservices in that cluster using something like dev space, which we'll see in the demo. And what it does is the bidirectional file sync mirrors changes in your local ID directly into your development container. And you can configure things such as the restart helper to automatically recompile your code when certain files change. You can use delve for remote debugging and step through breakpoints, just like you normally would. So it's the full experience of your typical development in your local ID, but it's executing remotely. The main problem that solves is the classic waiting for the image to build problem, which isn't a problem. It's just tedious. I think these days we're all familiar with the boring waiting as we build our image push it and then bounce the pod and wait for that to get pulled down, which just increases the amount of time it takes to develop software. All right, moving on to security. So we've gotten our whole pipeline in place and we're far from done, however, because throughout that whole process we need to keep security on our mind. And I'll go through a few tools now that can help in that regard. So for secret management, SOPs and case ops or lightweight solutions that one can consider, they enable a get ops based workflow that allows you to check sensitive information directly into version control. So with SOPs, you can encrypt sensitive manifests and that can be done by using a key management provider like, you know, aka Amazon key management service or Azure key management service. It also supports PGP, but that's not quite as secure. That's more for development. That's what we'll show in the demo, however. And then case ops is just a customized plugin that allows you to invoke SOPs for encryption and decryption directly as part of your customization. And then on sort of the other side of the spectrum, we've got vault, which is an enterprise grade solution that can often become necessary. It allows for more flexibility and dynamic substitution of values over and above, you know, having to actually check encrypted manifests into version control. The benefit of vault as well is that it's, of course, cloud agnostic. And lastly, Trousseau is worth mentioning. It uses the Kubernetes KMS provider framework. And what's unique about it is that it allows for a quote unquote, a J experience whereby you store those same secrets in multiple key management providers. And if one fails, it will fall back and retrieve values from whichever provider is available. Okay, so we've got our secret management solution sorted. And now we'll talk about our Docker file. And of course other things, but that's where Chekhov comes in. Chekhov has support for hundreds of policies that have been developed to do static configuration analysis of static configuration, such as Docker files. These policies are developed by experts and can easily screen for the adherence to industry best practices. And dive can also be used in CI pipelines. People often think of dive just as a tool for doing deep inspection of all different layers in a Docker image, as that is its intended purpose. But it also has the ability to perform analysis against certain metrics like space efficiency. You can fail a CI pipeline, for example, if dive considers a Docker image to be too bloated and for space inefficient. And on to signed artifacts. Cosigned at Notary are two competing solutions in the space, although cosigned is sort of the leading solution at this point. And what it allows you to do is generate a cryptographic signature and attach that to an artifact. Signatures can be uploaded to a variety of locations. Today in the demo we'll look at the record transparency log. And then what we can do is we can couple these signed artifacts with solutions, policy as code solutions, such as Coverno or OPA, and enforce policies such as the fact that we would, for instance, only allow running containers that use images that have been signed. We'll see that in the demo. And more security tools, we have the concept of an S-bomb software bill of materials. There's been a lot of hype about this lately, but it's really not just hype. What you can do with an S-bomb is generate a descriptive summarization of all of the dependencies entailed by your code repository. You can generate an S-bomb using tools like sift, getbomb or turn, and they can target a file system or a Docker image or even binary. And when you get this dependency summary, you can store it in a variety of formats. The full sort of machine friendly format would be the S-bomb itself, which can then be piped into a tool like gripe, trivia or Clare to do vulnerability scanning. And what that means is essentially looking at the exact components that are mentioned in the bill of materials and their version. And then comparing those against open source vulnerability databases like the NIST National Vulnerability Database or the GitHub Advisory Database. And of course, there's a mapping there between those dependency versions and known vulnerabilities that you'll want to remediate. And I briefly touched on policy as code already, but popular solutions there, as mentioned, are Kyberno, OPA, Dottree, and they do a lot of different things, but today we'll be focusing on their ability to restrict containers to run exclusively signed images. That's something that we would always recommend in a production environment. All right, that's a whirlwind tour of some of the tools now onto the application itself. My colleague Nick Vermont designed this somewhat silly but demonstrative application known as the dad jokes generator. The idea here is as a user, you're thinking to yourself, well, I want a dad joke, or many dad jokes, because who doesn't want many dad jokes. And you'll send a request to the jokes server. The server will use NAT, which is a go lang based message queue that implements the pub sub model to send a message to the quote unquote joke worker. Joke worker when it receives these requests will forward them on to open ai's API up until a certain point, because what it does is once it receives the response it will cash that joke in both redis and stored in MongoDB. And after a certain number of results have accumulated, it will just return previous results. That's simply to bring in some open source components into this overall architecture, which so that we can then demo how this somewhat complex five tier app can be deployed using depth space. Okay. On to the details. We have the link the code for this project is all open source feel free to check it out and consider playing with this yourself, maybe going through some of the steps that I'll be demoing shortly. Okay. Spend a little bit of time reviewing the code base, and then we'll jump into some demos. In the top, I'll begin with the make file and won't go into detail in the targets, but essentially I just want to mention the make file because we've developed some simple targets here to build our code and build our images and tear down, you know, set up and tear down simple, classic make file stuff. So what we've done is I have built some images. So if I do Docker image last, you can see, I've already built the joke worker and the joke server and these tags that were generated by death space which we'll see momentarily. Okay. Now, as I mentioned earlier, we're using pre commit to basically lint the content of our get commits. And so in conjunction with pre commit we're using get leaks. These will flag dangerous commits.  And as you can see configuring that is quite simple we just pop this into a pre commit config and run command to install the pre commit hooks, and we're ready to go. The command to do that is mentioned in our read me. Actually, the command is not in our read me but I can update that system command. All right, moving on to stops. As mentioned I'll be using sops with PGP to encrypt a sensitive manifest such that it can be checked into version control. Sops config is pretty straightforward and there are instructions in the read me for how to install and configure soft. So at a high level the repo structure consists of these two services the joke server and the joke worker. Each service has a Docker file and a main dot go. And these agents use a shared library that's inside of internal. We've got some constants and we've got joke dot go will be we won't be looking at the code in too much depth but basically, you can see here. We might be looking at the code to get a dad joke. So we might be changing the type of joke later to a Chuck Norris joke as you guys saw there. So this is just a prompt sent to the open AI. Yeah. And now I will show you the most interesting part, which is the dev space.yaml file. That's what ties all of this together. We will be using dev space to not only deploy our app but also debug our app inside of a local kind cluster. Here at the top we have some environment variables defined. Our open AI API key is being pulled in from the environment and our outer environment. We just have some names for images and tags. And as I said earlier, the tag is just is generated from our current get status as such. Now we have pipelines. We'll just focus on the dev pipeline but these are essentially just a series of operations that get executed when we invoke the dev space CLI and then we type dev space dev. And essentially what will happen is a number of different things will be installed in our kind cluster and then our development environment that we'll touch on momentarily will be initialized. We'll see more about that here shortly. Here we have image definitions. So we're actually using dev space to build these images. And what we have is the name of the image which comes from that variable and then references to the Docker file on the Docker context. And what we can do is when we type dev space dev, if the images aren't already present, dev space will build them for us and then actually load those built images into our kind cluster automatically. Okay. And now as I mentioned earlier, we have all of these various components we want to deploy. And they're a mixture of, you know, go services that we've developed here in this repo and then third party open source services such as MongoDB and Redis. And what dev space can do is it can deploy in a variety of ways. It can deploy a helm chart. It can deploy raw manifests and it can use customize as well. So as you can see, Mongo, Redis and NAPs are all just coming in through helm charts, which is pretty straightforward. And then our joke server and joke worker both rely on another interesting project from Loft Labs, which is known as component chart. So this is a meta helm chart, which essentially you provide the minimal specification for a deployment like Kubernetes deployment and then component chart blows that up into the full manifest that you need to deploy a deployment or a stateful set or I believe a raw pod as well as a service to expose that workload. So essentially it's just a very concise way to generate Kubernetes manifests. And we have the joke server and the joke worker. Both of them are connecting through two NAPs with this connection string and then the joke worker is of course also connecting to Redis and Mongo. And the joke worker also needs to be able to interact with open APIs, open AI's API, and it does so using this secret and we'll see shortly how we're generating the secret from our encrypted manifest using SOPs. Lastly, we're also deploying some custom resources into our cluster and those we can see here under custom resources. And that's basically just our Redis and MongoDB instances. So we deploy the operators through the helm charts, but then those operators need to reconcile that custom resource that we create down here to actually deploy those two services. And lastly, we have the dev section, well, dev and hooks. So when we run dev space dev, everything I've mentioned above will happen, a variety of things will be deployed into our environment. And then here what we're saying is automatically configure a port forward against this joke server container. That will allow us to curl it using the local host URL. That's pretty straightforward. Then what we have here for the joke worker is somewhat more complex. We're using the dev space restart helper here to automatically recompile our code when certain files change. So if the content of any of these files here changes, then the restart helper will automatically recompile our code and we will have our changes ready to go just like that. Okay. And we have hooks and commands. These hooks are basically just for cleanup, at least these ones. So when we run dev space purge at the end of the demo, you'll see that we can tear everything down, which we initially spawn up using dev space dev. And then these hooks are just custom actions that we take in order to fully clean up, for instance, the custom resources like Redis. And we'll delete our secret that we create from the open AI API key and a PVC. And then up here, we have another hook, which is invoking softs. So before we apply all of those other deployments, we need to ensure we have a secret in the cluster that the joke worker can rely on. And what we're doing here is we're just invoking softs to decrypt this manifest. This is the encrypted manifest that has our secret in it and then apply it. But how do we generate that encrypted manifest? That's what we do here with a dev space command. This command is really just like analogous to a make target could have been done with make, but I wanted to demo the power of dev space here. So it's just a bash command, we're going to create a secret from our environment. And we'll pipe that out to a file, and then we'll run softs to encrypt that file and save it here as this file name, which you can see matches the one here that we subsequently decrypt and apply. And then of course, we cat it, we echoed out that unsafe unencrypted secret to this file. So we'll just clean up the file at the end. All right, so that's a deep dive into the dev space config and what it'll do for us. Now let's actually jump into some demos.  And this is my local kind cluster. It's pretty much a vanilla environment. I've installed Kyverno, as you can see here. Otherwise, we have a pretty clean kind cluster. Now in this shell here, what I will do is I will run dev space. And that was the wrong session. Sorry about that. I will run dev space. And before I run dev space dev, what I need to do is actually generate that encrypted file, which I have deleted. As you can see here, this file is not being found because I missed a step. So what I will do is I will execute dev space run and the name of that, that command. And what you can see here is that this encrypted manifest was generated. This contains our encrypted open AI API key. And we did that using SOPS with PGP encryption. So we've set up our environment. Now we will do dev space dev. And you can see here that hook I was mentioning executed smoothly now that the manifest is there to decrypt. And we've applied a couple of home charts against our kind cluster. And you can see here, things are starting to come up. Of course, we have some errors, which is expected because that's the BB of Kubernetes. It will automatically reconcile until this is resolved. Basically, the joke server tried to start before Mongo, Nats and Rennis were all healthy. But as you can see, they're all up and running now. So we have our whole architecture up. And that was just one simple command, dev space dev. And it deployed everything that we saw in that diagram, including our custom services. And it also did some of the other things I mentioned, which are setting up a port forward automatically. So as you can see here, the joke server pod is being forwarded to local port 8080. And this bidirectional file sync has synchronized the files in our local IDE directly into the joke worker container. And that's pretty cool because what we can do next is we can make edits to our local code and see those changes happen instantly in this container. Not only that, but because those changes were detected by dev space, the restart helper will auto recompile our code and the changes will be live. Basically, as soon as we press save. So before we make any changes, though, let's just generate a few jokes so that we can see that this is working because who doesn't want dad jokes. Okay, yep. The buy someone is a favorite. Pretty cheesy. Okay, moving on. So we've got some dad jokes in our database. But what if we instead of dad jokes wanted to generate Chuck Norris jokes. So what I would do is just go to my source code as I'm doing my, my development and change that to Chuck Norris. But I'm not going to save it because what I want to do first is show you what's going on in that container. And so if I shell in to the joke worker and just show the file system, we can cat internal joke joke.go or tell you can see here, we have tell me a bad joke. And then if I show you the running processes, we have the joke worker process running as PID 277. And you can see this restart helper is actually running as PID one. And if I exit out of here and show you the logs, we had previously saved the file. So you see this restart container message. But what I will do is I'll make the another change and you'll see this this come up again. So when I save this file because now we want Chuck Norris jokes. Right there. Killed restart container was invoked. So that's the dev space restart helper. Now I will shell back in. First we'll look at the processes. So the restart helper is still PID one, of course, but joke worker is no longer 277. As you can see, it's been auto recompiled and it's not running as PID 452. And additionally, we can cat internal joke joke.go grab for tell. And just like that, our source code now says Chuck Norris. Pretty cool. So to just come full circle on that, what I will do is generate five more jokes for you, which will perhaps be funnier. That's the new one. I haven't seen that one before. Good stuff. All right, so that is a whirlwind tour of dev space and the power of its bidirectional file sync. And it's flexible configuration for deploying to communities environment. So next what we will do is we will focus on security. So as I showed you earlier, we have those images that will just hold them up again. For your reference, as you can see, we have an unsigned image and then we have these other images that that were built using dev space. What we're going to do is we're going to generate an S bomb for one of these images and to do that, I will use sift. So first I will output in JSON format. And we'll just take a look at what that looks like. It's a machine friendly format, but it contains the most verbose information and that's what we will need in order to generate our vulnerabilities with gripe. Sift and gripe are complementary tools from Antoray. They're super easy to use. They have GitHub actions that you can implement with just a couple of clicks to automatically generate and run checks against for all of your GitHub repos. So I recommend checking out sift and gripe. All right, so we can see this command joke server s bomb.json file was updated. And as mentioned, it's machine readable, not really human readable, so we're not going to dig too much into all of this metadata. But instead, we will rerun that command using the table format. This time we'll see a much prettier representation of all the dependencies that sift was able to detect from our Docker image. And here we go. So pretty simple dependency name, version type. So we've got some Debian packages and Go modules, et cetera. And then what we want to do is understand the vulnerabilities that are implied by those various dependencies. So we can use gripe and we'll actually just point right at that s bomb that we generated. You can also point right at an image and it will invoke sift and generate the s bomb as a convenience, but this is a little bit faster. So as I mentioned before, gripe is comparing those dependencies and their versions against open databases like NIST database to associate those dependencies and versions against known vulnerabilities. We'll see a summary here shortly. And it's pretty bad. So that's actually by design. And I'll jump over to the Docker file to explain why. But as you can see, we have these dependencies, their version and vulnerability code, which you can look up online and the severity. So this is pretty rough. Hopefully your images, at least not the ones you're using in production would look at anything like that. And the reason why is what we didn't do is use multi-stage builds, which you should be doing in production. So you can see here this Docker file just uses a go lang base image copies in go dot mod and code. Excuse me, compiles that code. And we're done. But what we should be doing is having a final build stage here in our Docker file where we start from scratch using a very lightweight secure image like Google's distreless image. And then we copy our compiled binary into that image, thus reducing our dependency footprint dramatically. If we had have done that, the sift and gripe demo wouldn't have been as interesting, but it would have been much more secure. So that's that's sift and gripe. And what we want to do next is sign our worker image and then demonstrate how we can enforce that that image is used, or that the containers in our cluster are using signed images. To do that, I will use cosine and I will just enter the name of the image that I want to use. So we have to accept this disclaimer here for six door, which I will do. And then we're going to use Google OIDC. And we have successfully authenticated what that means is that signature was generated and it was uploaded to the record transparency log. And now other tools can check that transparency log to validate that our artifacts are indeed signed. So I will show you what that looks like on the command line with cosine. We can do cosine verify plug in our image and then we just have to provide some flags for authentication. So OIDC here, we're going to use my email address will pipe the output to jq just so it's a little bit prettier. And there we go. I won't unpack this because it's not that interesting, but as you can see it succeeded and we have verified that this image is indeed signed. So we know the cosine piece worked. Now how do we enforce that we use signed images in our cluster. As I mentioned earlier, I installed caverno using helm and we have this admission controller here, which will reconcile various custom resources, one of which is the cluster policy resource. So here in our repo we have a the ammo file manifest, which defines a cluster policy. Essentially what it says is for any pod or deployment resources, check the images used by all of the containers in the pods. And if they are coming from the Tyler Gilson repo, then we will use this attester, which is the Google OIDC attester to check the record transparency log and verify that the image in question has a signature. So what we need to do is apply that cluster policy to our cluster. Okay, there it was applied. And now we can in KNS take a look quickly at the cluster policies. And we see here it's being enforced. And we have our same YAML. Cool. So assuming everything is correct, what will happen now is if we attempt to create a pod that uses an unsigned image, it will be blocked. And I will do that by performing K is just an alias for Qubectl. So Qubectl run and we're going to run this unsigned image. And perfect, as we expected, the Kevrono admission controller blocked our request because it was unable to look up a signature for that image. Now, just to prove to you that it really does work for a signed image, I will do the same thing. And in this case, I'll pass in the image with the tag that we just signed. Perfect. The pod was created. It's actually going to crash because it doesn't have the right environment config specified, but that's not the point. It is, it did get applied to the API server, which is, which is what we want. So I'll just delete that. And all right, so we've been doing some development and let's just look at our get status. So we have some, some files that have changed. And now let's simulate what happens if we have an unsafe commit. So I'm actually going to cat. And I'm going to echo my API key to a file. And I'm not going to show you that file because that would be unsafe. But what I will do is I will add food up txt.  And it's blocked. So that's what I was mentioning earlier about git leaks and pre-commit. So I have my pre-commit hooks installed, which execute git leaks every time I run a commit. And as you can see, they detected sensitive data in that, in the diff for that commit and they blocked, blocked my commit. So I will just do a git restore and remove that file. And that was good. We didn't, we didn't commit the, the sensitive data. So we have finished our demos. Now I will just tear down the environment. So we have this process here where we have dev space running. And I will just exit out and run dev space purge. And before I do that, I just have to delete the cluster policy. Now we can see here that dad jokes namespace has our, all of our services. And when we run dev space purge, it's going to bring everything down. Just like that. Everything that we deployed in our local kind cluster is cleaned up and we're back to this pristine state. So that is dev space. It's super powerful. I barely scratched the surface of what it can do. I encourage you to check it out and see about integrating some of these tools I've demoed in your workflow. We'll jump back to the slides for a brief moment for a final recap. Okay, some key takeaways. Developing cloud native apps is easier than ever. But in order to do it, you need to understand the ecosystem and the ever expanding array of tools at your disposal. And using those tools ties into developer experience, which is fundamental for Kubernetes adoption. However, there are a lot of them and it can be overwhelming. Things can feel complex. So I encourage you to start small and focus on what makes your life easier today. And not only easier, but more secure because security is extremely important as always. And we need to be considering security at every stage of the development lifecycle, which ties into the whole shift left mentality and bringing the inner loop closer in line with the outer loop, without making our lives unbearable as developers. And we should focus on making not only our developer environment, but really everything about our software, portable, shippable and sharing shareable because sharing is caring. Just like those kittens think. Okay. One one last thing before I let you go. Is there a simpler way? Yes, we have sector cloud palette, palette developer engine. And this is just a screenshot from for the same five tier app taken from what we call PDE. And as you can see, we have all the same layers, but they're configured using this nice user interface and they leverage a powerful abstraction that we refer to as an application profile. So this profile defines everything that we were showing in the demo through dev space, all the same environment config, the ordering of the tiers, the images, et cetera. But that application profile can be deployed into a number of different environments. So each environment might be a different Kubernetes cluster or virtual cluster inside of a physical IS cluster. And then not only that, but if you make an edit to the application profile, which is the central source of truth that update the edit that you introduced can be applied to all of the different physical sort of instantiations of your app. So it allows you to model your applications and treat that config as a single source of truth. We have a free trial. I encourage you to check it out. You can click the link here and see for yourself. Lastly, we covered a bunch of tools today. Git, make, sops, dev space, pre-commit, and K9S. K9S was sort of demoed implicitly, but I did mention it. Be careful if you use it too much. You'll forget how to use kubectl, but I find that it is a fantastic tool to speed up and enhance your ability to interact with Kubernetes. And that's it. Lastly, again, my name is Tyler. Thanks for watching. Feel free to reach out on LinkedIn or Twitter. I'd love to hear from you. Thank you so much for your time.