Hello, everyone. Good afternoon. My name is Igor Valychkovich. I'm a SD for Amazon EKS, and we're going to be talking about what you can do with admission web hooks and admission controllers and also the dangers of those. And I'm joined by my colleague here. My name is Amin. I'm also an engineer at Amazon EKS. And, yeah, before we kick it off, I would like to ask you a question. So, by show of hands, have anyone here used admission web hooks before? A little bit. Have you ever broken a cluster or an application running in your cluster using admission web hooks or admission controllers? Nice. I already see three or four. Five. That's cool. You're in the right talk. So, today, we're going to be talking about exactly those problems and how to mitigate them. In today's menu, we have a quick introduction to mutating and validation web hooks. So, if you never used them before, it's completely fine. We're going to talk about them. And then we're going to switch to the dangers of using the admission controllers and web hooks. We will also, Igor is going to do a demo of web hooks and how to take down your cluster using mutating web hooks. We're going to also talk about a new feature that just landed in Kubernetes 1.27 and 1.28, called match conditions or the common expression language also known as cell. And we're also going to finish with a demo about how to use cell on leverage in your cluster for better security overall. So, let's state the problem. In early 2023, we stopped using KGCR IO. And we started recommending to use registry case to IO for multiple reasons that the community is very aware of. On the bottom, you can see them tweeting about this in 2020, like saying, like, hey, we should switch registries and try to spread the message across the community. Anyways, the reason why we're talking about this, like, hey, as an administrator, I want to enforce this policy in my cluster. I want my cluster users to start using the new registry. However, there will be always someone who's going to forget about it. So, let's say actor, or let's say Bob or Alice, someone who forgot about them streets. And they're still writing manifests, let's say pods or deployments. And they're still using the old registry. Let's call it A. They are using KGCR IO. And what's going to happen, they're going to apply that to the API server. The API server is going to persist the information at CD. However, I want the API server to persist the new DNS or registry address. One of the ways we can do that is by using mutating webhooks. Thinking about mutating webhooks is like an extension to the API server. I want the API server to do extra action on my manifest or the information of my application. And I want, for example, I want the API server to change from registry A to registry B. Another webhook that is not mentioned here is called the validated webhook. For example, you can enforce or reject any requests coming with a registry that you don't want to use. For example, if the actor who forgot about them tweets is using KGCR IO, you can reject any cube color apply or create in the cluster using validation webhooks. Let's zoom into the API server. So what's happening behind the scenes is that whenever the request is coming, there are like multiple steps or layers involved before accessing HCD. The first one is authentication and authorization. I want to know if you have the right to access the cluster and who you are and whether you have the permission to do a specific action or not in the cluster, which is also known as RBAC. The next step is called mutating admission webhooks. So once we know who you are and that you have the permission to do a specific action, we're going to take that request and send it to a mutating webhook. Say, like, hey, do I have, for example, an old registry that I want to move to a new registry? And the webhook is going to send a new response and say, like, hey, here's my new object, I changed a few fields in it, go ahead and validate it. The next two steps, they are mainly about validation and the last one of them is going to be the validation admission webhook. So we want the API server to validate whether my request is valid or not. If all those four steps are executed successfully, the object is going to be persistent in HCD. Here we have two examples. On the left, you're going to see the validation webhook configuration, and we're going to have, for example, on line four, you're going to see the name of the validation webhook configuration. You're going to see the rules on line seven. I want only to target the operations that are, like, creating pods and the API version v1. I also, like, I'm giving information about the webhook endpoints, for example, in line 13, I'm like, hey, go, call the webhook in the name, example service, and name space, example name space. On the right, we have a very similar example, but this one for mutating webhook configuration is not very complete, but you can see it's very similar, and it allows you to target specific operations and a specific workload in your cluster. So as we can see, there's a lot you can do with admission webhooks. That was just one example. However, there's a lot of dangers that come with them, and the reason for that is, when you use an admission webhook, all the operations that that webhook targets are now, your API server has a dependency on your admission controller, and that risk can be increased by failing closed, having too broad of scope, or too long of a timeout. So I'm going to talk about those three cases and what you should do and should not do.  It basically says if there's any issues communicating to your webhook, from the API server, how it should behave. If it fails open, it'll let the request through. If it fails closed, it'll deny the request. The default is fail, so what you should do is think through and consciously select a failure policy and understand the risks and implications of that failure policy. There are valid use cases for failing closed, right? Say for security reasons, I only want certain containers to run on my cluster. Maybe I would rather have operations break than run an unsecure container. But don't just go with the default value and not think about it. Too long of timeout. So the timeout seconds field defines the timeout when calling your webhook. If a timeout occurs, your failure policy will be invoked. The default timeout is 10 seconds and you can use anything between 1 and 30. So do try to use a short timeout as short as is reasonable, because your webhook is going to be adding latency to the API server.  But mutating webhooks are executed one after another. So if you have five and they all have a timeout of five seconds, you can add 25 seconds of latency to your request. And that can be really detrimental to clusters, especially at large scale. I've seen clusters with thousands of pods where GC garbage collection isn't able to clean up the pods for hours. And that's because there were several webhooks with 10-second timeouts taking 10 seconds. So every time API server is trying to do GC and clean up pods because they're supposed to be scaled down, it's taking hours. It can't keep up because of that latency. So one thing you definitely should not do is if you start seeing some timeouts, try to just use a really long timeout. You should try to root cause why your admission controller is taking so long. And don't just try to extend the timeout to get around it. And then too broad of scope. All of these risks are only, only impact what you target with your rules. So here's an example of too broad of scope, right? We have all wildcards. This is going to target all mutating operations on the cluster. This, these rules are the blast radius of your webhook. So do set the scope as tight as possible and do it in the validation webhook layer. Suppose I want to only target config maps, for example. I should not use wildcards and then in my application logic of the admission controller, say, okay, if it's not a config map, just let it through, otherwise do the validation. Make sure all of this is in the webhook layer. So now we're going to do a demo and we'll do a live demo because that's a bit more fun of breaking a cluster using webhooks. So I just have a local kind of cluster running here, have some components in CUBE system, and I'm just going to create a deployment. And this deployment has a service, very, very simple, straight from, you know, the basic Kubernetes example of a deployment. And it has three replicas. And we can go and look at our endpoints to make sure the service is working properly. Everything's good. So now what I'm going to do is I'm going to create a webhook.  I'm going to target everything. I'm not going to set the failure policy, so it's going to be fail. And there is no example service at example namespace. So I'm simulating a failure as if the admission controller was down. So I'm going to apply this. And now if I go and I try to create deployment two, which is the same thing just with two appended, oops, I did not apply the blocking webhook first. That's for the next step. Okay, now when I go and try to apply deployment two, it all gets blocked. This is pretty easy to troubleshoot, though. This is pretty benign. I guess you can't create things, but what's happening here is you get the error message right away. This will probably be happening in like a CI CD pipeline or Argo CD or something like that. But if you go into the logs, you'll see this and you'll know exactly what's wrong. So now suppose that I want to make sure that only our platform teams containers are running in KubeSystem. So I'm going to create a webhook that targets KubeSystem. And I'm just going to do that by changing this webhook. Okay, so now that I created that webhook, now it's only targeting KubeSystem, and now my deployment should go through. And there we go. It did go through. So I should have some pods, but I don't have any pods. Okay, so something is wrong here. Let's go look at the deployment. There's deployment two and we have zero pods. Alright, let's describe it. Let's look at the events and see what's wrong. Okay, there's no events. Alright, this is kind of interesting to troubleshoot now. Okay, let's see if there's a replica set at least. Only for deployment one. And we have no pods. Interesting. Now I'm just going to try to create a pod directly. Maybe that'll work. Okay, the pod went through, but it's not scheduling anywhere. The pod is stuck in pending. Okay, so I can't even launch pods. Maybe I just need a new node. Let's describe the pod and see what it's unhappy about. And also no events. Okay, great. Not really sure what's going on there. So now I'm going to try deleting the deployment. Let's just start over. We cleared out the deployment. Okay, and all my pods are still there. This cluster just is not working at all. Maybe I try to manually delete a pod. Let's see if that works. Okay, at least that worked. Hopefully now that should be taken out of service so it's not still serving traffic. Now that it's no longer there. I should have deleted the deployment. Yeah, so I can't create pods. I can't create deployments. This cluster is just hosed. And let's look at why. So if we look at kubesystem, we're going to see that the scheduler and the controller manager both have a restart. So something interesting happened there. So let's go and peek into them and see what happened. I'm going to look at the previous logs to see why it crashed and restarted. Okay, so leader election lost and shutting down. So it looks like it lost its leader election. And now let's look at the current pod to see what's happening. Okay, failing to update the lock. So what happened is this webhook ended up blocking the leases and these components crashed because they couldn't renew their lease and they could never grab it. So now they're just sitting in standby mode trying to get a lease doing nothing. As you can see this cluster is completely hosed. You can't really do anything with it. And those are some of the risks you run with admission webhooks. There's a lot of other things that can happen too, like for example if you're blocking leases in kubenode lease, you'll start to see your nodes going not ready. There can be issues with API server startup if you're blocking flow schemas or role bindings, API services. So those are some of the dangers. Now part of the problem is if you look at this webhook the rules are targeted in everything, but there's no negative selection. So there's no way for me to say I want to target everything except for leases. Until some of these new features that we're going to talk about next. Thank you Igor. So now that we've seen examples on how to break your cluster or your application overall using mutating webhooks, we're going to jump ships and talk about a completely different topic. There is what we call cell or common express in language. It's a language, it's a new language created in the early 2020s by Google, however it's not a programming language. It is a scripting language. Is it quite fast? I was very impressed about how fast and very like close to the performance of just pure go. It is very very easy to write and to understand. It's a little bit like Python or JavaScript overall. It is also easy to extend and to embed. Let's say like you want to bring some functions to this language or to embed it in JavaScript or Java, it is pretty easy to do. If I'm not mistaken, there is only one implementation that is in Go, but there is no different implementation but corrects me after from rock. I've never seen any. If you want to play with this language, there is what we call the cell playground. It's a website created by Matias. I don't know if he's here or not, but shout out to that very cool tool. And yeah, without any more talk, we're going to show you how it looks like. Let's say I want to validate these YAML objects. I want to say let's say I have this event named CubeCon, location Chicago, and I have a list of attendees, whether they have a coffee or have a funny hat. It's a Boolean to our faults. What I can do using cell is writing an expression like this. For example, in line one, I can say like, hey, I want to validate that the event.name is CubeCon and that the event location is Chicago. And then I can target, for example, the first element of my attendees list and say like, hey, do they have a coffee and do they have a funny hat? It is pretty simple. It looks like Python or JavaScript, basically, but it's not a programming language. It is only an expression language. It means that you can only validate data with it. And this is where it becomes very fun because we can use this kind of stuff in webhooks. If you want to learn more about cell, because we're going to stop here and start talking about webhooks again, please watch Jobit Stock last year or the year before about webhook fatigue introducing cell into the expression language features. And yeah, I really recommend that. Yeah, so now we're going to talk about how we can use cell in some new features that are coming out in Kubernetes that we worked on with the community to help make admission webhooks more usable and safer. So there's validating admission policies that are new beta API as of 128. And these are cell based policies. So rather than API server needing to call out to a webhook, it can just use cell to do validations itself. And they're beta in 129. And we have mutating admission policies planned for the future. Match conditions are new beta feature as of 128.  You can now with cell define what your webhooks should and should not be targeting. And these are beta feature and they're going to be on validating admission policies and they're going to be on admission policies and admission webhooks. And they're beta, but they're on by default. So you can start using those right now as of 128. Here's an example of a validating admission policy. It has a lot of similar fields. It looks a lot like a validating admission webhook. That's by design. One of the things that you're going to see is different, though, is the validations instead of telling it a service to call out to, right? And there I have a simple cell expression that says for deployments, I want all my replicas to be less than or equal to five. And then you use a policy binding to apply that to, in this example, a certain namespace and tell it to do a deny on failure. This allows your API server to not take an external dependency and it's an in-process alternative, right? So the benefits here are less latency, like we said, cell is really fast and it doesn't have to make an external network call. There's no external dependency. There's a lot less overhead in setting this up as well. If you were to make a validating admission webhook, you would need to write some code, containerize that code, deploy a pod. The code would have to do TLS, HTTP request handling, a bunch of serialization and deserialization just to do the simple replicas less than or equal to five, right? And the other thing is you get immediate feedback. If you do use a validated admission policy and you do something that breaks your cluster, it will break it immediately and consistently, whereas if you have a validated admission webhook, it may be running good for a year and you might be fine and then all of a sudden there's a bug in your controller and everything's down. Match conditions are the other example we talked about. So this is where you can use fine-grained conditions with cell to define the scope. These are only for negative selection and you can have a list of them and it's an AND operation. So if one is false, then your webhook will not be called and invoked. So now we're going to go back to our broken cluster and fix it with the new cell features. So if we go back to our pods that are not running, yeah, so there's the deployment that should be gone, the pod that's not scheduled and the deployment that is not available, right? So we're going to go back to our webhook and we're going to take the same webhook and just apply this match condition and this match condition is going to say if it's coordinationk8s.io and the resources leases, we're going to ignore it with this not. So now if we apply this, our cluster should be back to a good state and our pod is now scheduled. The scheduler comes back a little bit quicker and we should see a cleanup of our deployment and our new deployment coming in and you can see that everything's working, the endpoints on this deployment have their IPs now, the old ones are gone, we're in a good state. Okay, so that's great, we were able to protect against, we were able to make one webhook safe, right? Now I'm going to transition, do a quick demo, validating admission policies and then I'm going to wrap it all together. So here's a very simple validating admission policy, very similar to our example but we're going to say it has to have greater than five replicas. And we're going to start by just showing the way deny works. So if we go and we apply this and we go and we try to apply the deployment, it'll say hey this isn't allowed and it'll give you the expression that is failing, right? There's a lot of other interesting uses here, so for example you can do a warn and audit. So say I don't want to actually block all the operations but I want to tell the user, hey you shouldn't be doing this and I want my cluster admins to have an audit of everywhere this is being done. That's also supported, so you can now update this and now when I try to create the deployment, it'll go through but I'll get a warning and there will be an audit log that we can go back and look at and see that hey this is failing validation and it's still being created maybe then you go reach out to your application team or something and talk to them about why they're doing something against the policy. Now that's all fine but my cluster still isn't safe, right? I protected against one webhook. Now how can I protect against all webhooks? Well we can do that with validating admission policies. So here I have a more useful validating admission policy maybe and it's going to target admission registration and it's going to look at validating webhook configurations and mutating webhook configurations. And another feature is you can have the special message, right? So with this message this is I'll walk you through this expression but this is a lot. If you got a warning with that giant expression it may not be clear to users on your cluster. So you can have a special message and you can maybe link that to some documentation that explains why and what. And then we're going to have this cell expression and this one's a bit more complicated so I'll walk us through it. First we're going to say object.webhooks.all. So that's an iteration operation in cell and as you can see the webhook configuration you can define multiple webhooks. So we want to make sure for all of those webhooks that all of them are safe. So what this is going to do is it's going to say for all webhooks and then this is the iterator like if you say like for item and items or for X and items I'm calling it webhook because that makes sense but for all webhooks every single item in that list it has to have match conditions and then for those match conditions we want to loop through those as well and make sure that there's at least one. So for all webhooks we want one match condition that has this expression to block leases. And then we're going to run a deny there. So if I go and apply that and we go to this webhook now if I take off the match conditions I get a denial and I get a useful message. And then if I add these match conditions back on it goes through. So now suppose I want I want my teams using this cluster I'm a cluster admin I want them to be able to use webhooks but I want to make sure they're safe and they can't take down my components. Now we have a mechanism for doing that. Admission policies are able to target admission webhooks right. Admission webhooks cannot target other admission webhooks because then you can get into a state where you're locked out of your cluster. So that's that's blocked. But admission policies can target admission webhooks. However they cannot target other admission policies but due to the reasons we talked about this is still a much better state because admission policies are much safer it's not an external dependency you get immediate feedback. If it works today it's going to work tomorrow. So yeah that that shows how we were able to safeguard this cluster. Thank you Igor. That's pretty cool to see live the the demo gods are happy today so can't really complain. So now that Igor showed you how to use match conditions. If you remark like observed at some point he's using request something like hey what are the objects you can use because on the runtime of the API server you have few fields that you can access not always request. This is from the Kubernetes documentation and I want a better place than Kubernetes documentation to read about a few things and here you have for example object all objects if you make an update operation you always have access to the new and the old one. You can have access to the requests the authorizer and the authorizer request resource for example if you access who is the user that is making this request is the cube system is a cube that you can have you can find those information information for example in in the authorizer. Anyways there is also discussions about adding namespace. I know you can find namespace in objects if you do object that metadata that namespace you can find what is the name of the namespace but there is also some work happening in upstream right now trying to bring the namespace objects as a full thing for example I want to see the annotations of the namespace and those few things that you might be able to access in one point 30 but I'm not sure it's going to make it to upstream or not there's a lot of conversation about whether we should do it or not but yeah maybe next year we're going to talk about this. So for example you can see here the third element the third element here was a request if you want to know what is what is really inside the request this is called straight from Kubernetes upstream Admission V1 types that go you can see all the fields you can access in the request. Igor was using I think user and the name of the object not the kind sorry it was like the kind to for example target the leases but those are all the objects you can access from the admission request. Yeah so in conclusion admission webhooks are super powerful we've had them for a long time but they also come with a set of dangers but now we have new cell features that make it easier to apply policies under your cluster in a safer way and please if you haven't go out try these features you'll need to enable the beta APIs for validating admission policy but you can use the match conditions today on 128 plus clusters on admission webhooks and please go try them out and provide feedback are there new features you want access to different fields any issues you run into provide feedback so we can make it a better experience and get these new features to GA. Thank you. Thank you all if you have any questions there are microphones there and there if any has some go in once. So if I do break my cluster because I have webhooks that don't let me do anything how do I unbreak it? Yeah so you just delete the webhooks so I touched on that a little bit but there is you're not able to target other webhooks with a webhook in order to avoid fully locking yourself out so you can either delete the webhook or I guess depending on what the webhook is blocking fix the admission controller but if I was in a situation with a broken cluster I would just nuke the webhook. Any potential performance problems? Yeah so we've built in some monitoring so you can tell how long these expressions are taking to evaluate there is a potential because as you saw we could do loops so you could like loop and loop and loop and loop and cause issues that way there is a cutoff in how much processing time an entire webhook is allowed to use and each match condition and how much compile time it's allowed to do so it actually compiles when it's created and then there's compilation and evaluation with cell so there's limits on all of those and if you hit the limit then the failure policy will be invoked similar to like if you can't talk to an admission controller. I can add to that we've done some benchmarks regarding Keverno cell Rego and pure go code and we were like fascinated of how cell is very close to go performance it's very very fast it's so far from Keverno and Rego so if you're worried about the performance of cell itself on like dealing with very very huge objects it's not gonna be really a problem it's really as close as to pure go code or compiled go binaries. You said we shouldn't use wildcards but I kind of have to you because I have six hundred namespaces and I don't know how to include 599 of them and there's no negative I can't say star minus cube system right so this is the tool that would allow us to do that yes exactly okay yeah so you can use the match conditions and say if namespace is not cube system then you're good bypass the webhook thank you you can basically access any field in your object so namespace, annotations conditions as well if you want to re-target only bots with specific conditions and like specific messages in those conditions it is possible to do any more questions? go in once go in twice and thank you so much for joining today I really appreciate it it's very cool


Now that we've finished creating our database, we need to add our information or the initial information. So the first thing we're going to do is we're going to create another function which I'll call function insert initial data. So I'll copy this and then come back to our functions, the initial functions that run and then I'm going to run this particular function so that we have some initial data inputted at the end of the day will have to modify that by adding new content in there. So what I'm going to do is I'm going to get the database prefix so we'll need to get our global again and we'll need to get our our name again to get the global which is the WPDB and then we use the insert method of our WordPress that's on that particular class. So in the insert, we need to have the table name after having the table name, we then have an array where we're going to put all our data. So in terms of the time, we first of all, you have to wrap this in single quotes. So for the time field, we need to add the current time. So what I'm going to do is get the current time and then I'm going to get that from the database itself. We're going to use my SQL so we'll get them my SQL and then for the balance, I'm going to initially make it a string which is zero, go back deactivate this and then I'll activate and when I reload this, we'll see that we actually have our time in here. It's been added. Once it's in a different format, I need to follow changing this and just stick with what my SQL gives us. We have an account balance of zero in our database. I realize I have quite a lot of things in here that have been reused over and over. So what I'm going to do is I can actually decide to add a class here. I can decide to change this into object oriented programming and then we can fix some of these and make them variables so that we don't have to use them over and over again. So thank you for watching the video. If you enjoyed it, please give it a thumbs up. Next we shall be looking at how we're going to save our data by adjusting it against the current value of balance that we have and then storing it in as a new field.


Humanity faces a lot of problems, smaller problems such as a dead battery on your telephone, but also bigger problems, so-called wicked problems. And Tobuque University offers the GMSI program, Global Management of Social Issues, and Global Management of Social Issues deals with wicked problems. And today we're going to talk about migration. Why do people leave everything behind to go somewhere else and make a better life? And we're going to talk about migration with Dr. Jörg Raap. He's from Germany and he's the associate professor of the Department of Organizational Studies, but he is also the educational director of the GMSI program and his main focuses are governance and the effectiveness of networks. Second, we have a second-year student, Panna Kerti. She's born in Hungary, but currently studying here at Tilburg. She is a chairwoman of the International Student Advisory Platform and she's focused on migration and in the future wants to work with minor unaccompanied refugees. And last but not least, we have a guy from Poland, Adam Jetschik, a second-year student of the GMSI program as well. He's the president of MUN Tilburg, the Model United Nations here in Tilburg, and he's migrated a lot. You've lived in Kuwait, in Egypt, so you're a migrant yourself. Adam, what was the first thing that you struck as an immigrant here at Tilburg? I think the openness of the society and I think that was something something that I value really greatly and I think the community feeling and the way people interact with one another is something the Netherlands and Tilburg can be very proud of. So we can be proud of ourselves. We're an open society. Nice. Panna, you came from Hungary but why do you want to work with the unaccompanied minor refugees? Why that specific group? My parents' profession is related to working with children as well and I'm also specifically interested in working with those who are the most vulnerable in society and those children who are in such a vulnerable situation that they are without parents and at the same time they don't really have resources and it's really difficult for them to reach out to the right authorities. Make the world a better place for these children. And of course, Dr. Jurgaap, a wicked problem if you can give a 22nd lecture of wicked problems. What is a wicked problem? Well, a wicked problem is a very complex organizational or policy problem like, for example, migration, poverty, climate change and they are characterized by, let's say, three dimensions. One that a lot of problem dimensions are interrelated and that creates complexity. Then there's usually uncertainty about the knowledge base. Why do we have this problem and about certain outcomes if we do something? And then very often there is what we call value divergence. So different parties that are connected to the problem, they have different values and therefore perceive the problem quite differently. And can they be solved the wicked problem? Is there a solution for wicked problems? Well, there is, it's not like a problem is wicked or not. There are different levels. But if you say, for example, poverty or migration, that cannot be solved as if we take certain policy measures and then the problems are just gone. But usually we say we can do better or worse in coping with them. So limit the negative consequences. The problem will be there, but we can cope with them better in the future. And we're going to talk about migration and of course, you all are immigrants because you came from a different country to the Netherlands. Pano, why is migration a wicked problem? Well, I would say it has a lot of different aspects why it is so wicked. If you think about, you know, not only the economic aspects of integration, but also we can think about, you know, the cultural ones. And these are very different things. And it requires a lot of effort from the immigrant to be able to integrate within the society. But it also requires a lot of efforts from the society to integrate that newcomer to the society. So I think this is a really interesting issue because I do believe that it's very two-sided. And at the same time, you know, it's something that's very unique because it's very culturally enriching as well. So I think it also has its positive and negative size and it's really interesting to go in depth in that and do research in this field. Yeah, you can see with the policy discourse in different countries right now, what integration is, is already quite contested. Some people basically say, well, you have to do the language, you have to accept the culture. Well, other people say, well, you know, as long as you follow the law, then you're fine. Yeah, I think with migration, the biggest problem is the definition problem. There's quite a lot of disagreement as to what the problem with migration actually is or who a migrant or refugee is. And that is why I think policymakers are struggling with coming with any sort of solution because some believe that you're only a refugee in the first country that you arrive in. Others believe that if you move on, you become an economic migrant and so on and so forth. So that in itself is a problem already. And how do you guys discuss the definition of migration in class or in your lectures? Well, I think it's very, very important to say that within global management of social issues, it's really important that we have a really good theoretical background, meaning that, you know, defining these concepts is what we start within the first place. So seeing what a migrant is, who a migrant is, and what a refugee is, and seeing the difficulties is not only connected to one field of social sciences, but it's also connected to international law. It's also connected to economics. Looking into these different aspects is very important. And seeing that, for example, you know, refugees, they come from a place where, you know, they are literally threatened, you know, they are in very risk of their lives. And being a migrant, being an economic migrant, is more about looking for better opportunities and living with those opportunities and trying to, you know, reach them by migrating to a different country or a different area, if you are talking about, you know, within country migration. You see that in Europe, for instance, we mostly focus in the media on the negative sides of migration, because you said there are a lot of positive sides as well. How is that not helping the problem, the focusing on the negative side of migration? I think it could be an issue, like it could be a social issue in the sense that sometimes people are afraid to get to know new cultures. So, obviously, it requires a really open society to be able to welcome migrants and, you know, find those aspects of migration, you know, enriching that they are, you know, and seeing that a diverse community and a diverse workforce, for example, at a workplace can really contribute to tackling issues and solving issues in different ways. And seeing those different perceptions can be really enriching, in my opinion. And I think if a society is being able to see that, then they are going to be able to cope with the integration issues as well. So, we should say we should start with changing the society, which is there, changing the Dutch views on migration. I think this is more of an internal change. So, you cannot really change society, but I do believe that by introducing society to people who are, you know, economic migrants or refugees as well, which is also an issue, you know, by getting to know them and organizing mentor programs or volunteer programs, where the members of the society can work with the newcomers, then they can really see those great aspects of, you know, getting to know new people from different cultures. Which is difficult, Adam. I don't think you can necessarily, or you don't necessarily have to change society in itself. I think what is important to take a look at is the narrative that is being created by politicians, policymakers, but also individuals within society and community themselves. Because if this negative narrative is there, if we label migrants or refugees as evil, as bad, as foreign, then stereotypes are created. If negative stereotypes are created, then refugees and migrants alike will indeed be seen in a negative light by the majority of people. And I think what is important to realize for society, for communities, for the host community, is that these people are just as normal and very similar to us. The only difference is that they're a bit less fortunate. They happen to live in a country, for example, where there's a civil war going on, or in poor regions and areas of the world, and we being in a more fortunate position, we should do everything in our power to help them. But you say I'm unfortunate? Because, I mean, I don't do not know your background, but it seems you're not poor, you didn't come from a war zone, so there are also the not unfortunate people, but just normal migrants. But still, that is a problem. I think it's about the narrative, as Adam said. So, for example, within the program, we learned about intergroup stress theory, which is basically a theory, where, you know, by creating narrative, you know, social leaders, politicians, you know, someone in your community who is more influential, if they create a narrative, then the society can experience, you know, symbolic threat. So, that's not necessarily a real threat. It can be symbolic, you know, like, for example, the narrative that they had in Eastern Europe during the refugee crisis, oh, you know, refugees are going to take your jobs.  But those are mostly political statements. Yeah, they are going to take your job. The right-wing politicians often say that. But how can you guys, with your studies and with your background, change that in order to make, well, maybe a solution for this problem? I think it's about doing exact data and very specific facts. I think, by research, we can really get a good overview of what's exactly happening and not just, you know, and politicians, they can maybe see those numbers and then they may be there, it can affect their policies, obviously. So, by actually having facts, you know, like looking into those facts and creating research and then doing research in that, that can be really influential, I think, in your research yourself. Do you provide your data to the politicians involved? Well, in my field of expertise, yes, we do. But I wanted to say, you know, we do not deny in the course, for example, on migration that there are problems. That is very important. And I think, especially right now, the European countries can do much better than they do right now in what I said earlier, coping with these issues and avoid negative repercussions for people that migrate, but also for the host societies. I see you guys nodding. Yes, you totally agree with what's going on right now. They can do better. Yeah, very much. What's the first thing that they should change? What should they do? I think coming back to what we were talking about, I think the first thing, well, there are two things, actually. First is the definition and then getting rid of these negative stereotypes. Because I think that is the first, if the community, if the society, if normal individuals in the host country see that the majority of these refugees are normal people who are just looking for a better life, looking to flee away from war and persecution, if people see that, then they will be more open to help. Politicians can't do it on their own. They do need the support of community and local communities, local society. And in order for that support to be there, that narrative has to change. And I think that's a key starting point. A key starting point. Do you agree, Panhard? Do you say no, no, we shouldn't talk about the narrative? We should go a completely different way. I do agree with Adam to some extent. I do believe that it is very much dependent on local communities. Because if we look at, for example, the integration system of the Netherlands with refugees, we can see how refugees are integrated in society in such a way that they are distributed across the country. Now, for example, in Hungary, there are three refugee centres where all those refugees who came during the European refugee crisis in 2015, they were situated in three of those refugee camps. Here in the Netherlands, one city integration starts. And there are big cities, right? Exactly. Not even big cities. It's more like small cities with a big refugee camp, you know. And maybe the population can be, you know, afraid and also, you know, it's also about the narrative. But if local communities also look into, okay, you know, we have this many refugees, we need to look into with societies which local communities they could be fit in, I think that could be a really good facilitator for integration. And here, because in the program, of course, you focus on wicked problems, but because it's such a broad and diverse problem, where do you guys start?  Well, as in all sort of scientific inquiry, we start with a good analysis of the reasons and the problems. And in the course, for example, we talk about different reasons to migrate. There are pull factors, but there are also push factors, and you can see that at the moment. And they are very diverse, and sometimes they are interrelated, and that makes it complex. But first, students have to learn different theories about why people migrate, and migration has been of all times and will be of all times. So it's quite important to understand the different perspective and the different reasons before we move on to, okay, what can we then do about it? And what can we do about it? From a scientific perspective, how can we cope with the migration problem in Europe, for instance? Well, I think there's the migration problem doesn't exist. I think that's where we have to start and say, okay, what are the different, why are the different groups and different people want to come to Europe? You have, of course, a civil war in Syria, but that's different from sub-Saharan Africa, where people sometimes also flee because of military conflicts, but also because they seek a better life. And therefore, if it's improving the economic conditions and societal conditions in these countries, Europe has to do more to support these, to support and develop these countries. Also, for example, with better trade deals, for example, that so far have been very often in favor of the Europeans. Well, yeah, we want to keep the wealth in Europe. As people say, just how do you work with the solution? Is there a solution for such a broad problem? Well, I think that's one of the characteristics of a wicked problem, that there isn't sort of one quick solution to it. And even if there would be a solution or attempt at it, it's a one-shot operation, meaning that there's just one attempt at it and you can't go back and improve it. And I think when it comes to migration, we have to, as has been said before, we have to learn to cope with it rather than by all means, at all means, try to solve it within one day, because that's just not going to happen. So we should look for solutions in the sense that, or ways rather, in which we can cope with this large influx of migrants. And then, in the long term, look for sustainable answers to the problem. And I think primarily, and this adds to the complexity, of course, is to look at the root cause of migration. So that's something that has been really discussed lately. Pana, your opinion on this? I think integration has different levels, right?  There are different levels of migration and integration in general. And I do think that the most important part of that is cultural integration. And we need to look into short-term and long-term procedures within this. And, you know, we need to look into those solutions, because looking at one of those is not going to lead to the required results. One important thing I think we have to mention is, because we're hearing quite a lot of solutions being talked about here, we also have to remember that we cannot do 20 things at once. Because we start trying to solve integration, trying to solve poverty, trying to solve sort of the potential terrorist threat that is being talked about. And then we won't resolve anything. So I think what is important, when it comes to talking about potential solutions or coping strategies, is pick one focus point as a starting point. And then move on from there and not do 20 things at once. And how does that work in a lecture? Because you are second-year students, you have the course, you have had the course Wicked Problems 101, for instance. Where do you guys start? You get the topic, okay, this is migration, then what? What's the next step? As Dr. Raab mentioned it before, first look into the root causes. And then we also look at the theoretical framework that could be applied to the social phenomena. After this you always look into how this could be solved based on different literature. So this is very much theoretical. But at the same time we also get a lot of group assignments and individual assignments that we can take home and then write them at home and work on them in groups. So this way we can kind of implement our own ideas within these papers. So that's a really practical way of applying our knowledge that we learned in the lecture. So I think this theoretical and practical basis really gives a good balance to the program. For example, in the course Wicked Problems 202, which is on migration, we ended with a policy brief, which is not an academic paper, but basically a summary for an imaginary EU commissioner that has to enter a meeting and needs to be briefed on a certain topic. Very concise, short, and students had to write that within 10 days and then present it. And maybe you can talk a little bit what topic you would like. What was your policy for the UN commissioner? Well, first of all, let me just give you a bit of background as to what the topic that we chose to focus on was. And we, Pan and I and another colleague of ours, we decided to focus on the issue of integration. And we chose Germany as a focus country. And the reason for that is because what we can see with this high influx of Syrian refugees is that they have a focus country that they want to go to and that country is Germany. Currently, there are over five million refugees spread around countries worldwide. Germany is the fourth, in absolute terms, fourth country in terms of amounts of Syrian refugees. So we focused on integration and we identified three key issues, segregated housing, education and obviously the cultural differences. And Pana, perhaps you can talk a bit about the recommendations. Yeah, so as the conclusion of the policy brief after looking at the issue, reflecting on that we came up with recommendations. And these recommendations are based on literature from UNHCR also from other refugee agencies who work with these refugees. And they think that these are policies that should be implemented in order to enable integration. So we looked at these three factors. For example, we looked at if refugees would have lower limits of being able to get social housing, that would really help them with starting a new life and really have that good basis of having a house. Also we looked into education where sometimes it is a tendency that sometimes the host national children bully, for example, those who come to their school even though those kids already speak the language, for example. That can be a big issue and giving cultural awareness trainings in that can really help the kids to see how culturally enriching it is that they are from different cultures. Also, like looking into education in general, we really need to be distinctive between the education of children and the education of adults. So basically we looked into all of these issues and we tried to recommend using our own recommendations and using some literature. And yeah, honestly, I think it turned out quite good. It was a very interesting quote. We can ask because we've got the teacher at the table. Yeah, I will not tell anything about the truth. You won't tell anything about the truth. Moment of truth. Moment of truth. Well, is there a good chance to pass in the course? Well, that's already settled then. Is there one question that your students would ask your teacher in a lecture, just as an example. Is there a question that you would like to ask Dr. Jurgraap, considering migration, of course? I would personally ask because I'm really interested in the social aspect and the cultural aspect of integration. What do you think is the best facilitator of of cultural integration in general? Looking at all countries. What do you mean with facilitator? I mean, like do you think it's learning the language? Do you think it's like being able to enter the labor market? What do you think is the best way to kind of be more part of society? Well, I think if you look at the discussions and the experiences that especially also European countries have made in the last years, I think language is key. And I think this is something that also the Netherlands have now changed the policy on, also Germany. In the beginning, the countries didn't really look too much into maybe even forcing people to learn the language. And that is a big barrier because without speaking the language, you also, it's very hard to enter the labor market. And then people very often have to, if they can enter the labor market, work way below their qualification levels. And the countries also lose human capital, quite frankly. So I think it's, you know, from both sides, it's, I think they have interest in learning the languages. And I think there's also something European countries can still improve because if you look at the Netherlands, for example, there's still discussion about how to offer these language courses when, how much pressure is behind it, who is actually giving them what's the qualification of the teaching personnel. But I think it's worth the investment there because it will reduce a lot of costs later. Thank you. And the human capital which is in the refugees or in the migrants is, we can benefit from it as well. So language is key. Adam, have you got a question? Yes, actually. Recently, the European Union and Turkey obviously struck a deal to where Turkey would host a large amount of refugees and I just wanted to ask from an academic or scientific perspective, do you think that's a sustainable solution and do you think more such deals are necessary or should we look elsewhere? That's a very difficult question also because it's also... You're the expert on wicked problems. Yeah, that's true. There you go. But there you can, I think it's a very good example of why migration is a wicked problem because it's a, especially also with Turkey and with Libya at the moment. It's an enormous dilemma for all sorts of reasons. The situation in these countries and how refugees are treated there. But I think in terms of getting control of the situation again, I think it was unavoidable because I mean, even if you would like from a moral standpoint to welcome everybody here in Europe, if societies are overburdened with sort of welcoming and then really hosting these people, it's counterproductive. So I do think the nation states have to or they did have to gain control again over their borders. And I think the Turkey deal with other measures achieved that.  No. I think now the question is, okay, we have stabilized the situation. So how can we alleviate the problems in sort of the periphery of Europe? And how can we set up a system that we can sort of organize a controlled influx of people from different groups into Europe? So at that point, would it be fair to, at that particular moment when it was signed that deal, what is it fair to call the necessary evil? Yeah. I mean, that's sort of the wicked problems. There are no sort of best solutions. There are also only just coping solutions. Yeah, they're coping so they're second best solutions. And Pana, is this the way it works in a lecture? Yeah, we can always ask questions. So I think that's very nice that we can really interact with the teachers and they are also really open to us to come in there free hours. We can always make appointments if we have any questions. So I do think that that's a really interactive way of learning. And of course, you get the opportunity to ask one question to the students. So, well, let's see if they're great is as good as the policy that they just invented. Well, the question I would ask is, I mean, if the predictions are correct, population growth in Africa will be enormous in the next 30 years. So your generation will be confronted with that very likely. So what should we do about it? That's a very difficult question. That's a very good question. I do think that there is going to be several waves of migration in the future, you know, like this one now and then, you know, like the one after the Second World War. But I do think it is really difficult to say what's the best solution for that. But maybe if we reflect on what we learned in the course, I would personally say because I'm very much like, you know, focused on social integration is that by maybe, you know, helping those people there to, to those communities there to, you know, be, you know, to engage in entrepreneurship and then start their own businesses and maybe that way integrating not necessarily only European societies but only all over the world, I think that maybe could be a good facilitator of, you know, equalized population density. I think because, as you say, we already know that we will experience this potential huge population growth in the future and we already have the statistics and we can predict it. We can do something right now. So first thing is not to wait 10, 15 years but act right now and I think we should do everything in our power to limit the push factors for migration. So do everything in our power to ensure that those people will want to stay in their home countries in Africa or wherever it may be and that they will want to develop their countries from their country if I can put it that way. Now, whether that is in economic aid whether that is whether that involves going there and, you know, constructing schools, hospitals, or what have you, that's open for discussion but I think what is important to realize is that we shouldn't wait. If we know that something's going to happen we should act now. I do agree with Adam on that, that, you know, planning ahead is really important and, you know, not only, you know, I think economic growth can be a good answer to population growth in the sense that, you know, enabling those communities to be self-sustainable is very important. Did they pass? Yeah, I would say. Yeah, yeah. Of course the future is unpredictable and we can never see where we end up but we can ask you where do you guys want to end up? What are you going to do when you graduate it? Very good question. I would personally love to work in in humanitarian response team. I personally find it really interesting. That's one of my, because I find it a very dynamic environment and something, I love working with people so I do find that very important but on the other hand I would very much like to work in a more policy-making role of helping children. So the United Nations somewhere. Maybe an international organization, yeah, we will see how it goes but I'm interested in these two fields and I'm still kind of doubting which way I would like to go. Well, you still got a couple of years to go. Adam, what are you going to do? It's probably is the most difficult question of this entire discussion if I can be completely honest. Okay, then we'll focus on that discussion later. No, what if you say the first thing that's on your mind. I think something to do with international relations but with globalization and sort of the development of sustainable education. Development of sustainable education. Something to do with that, yeah. What's your next research going to be? What's the next thing you're going to do? Well, right now I'm in a project with the Dutch organization that is basically combating infectious diseases. The Rijksinstitut van Vox was founded in Milieu so which is sort of the Dutch equivalent of the CDC. Language is key, ladies and gentlemen. Yes. And we are looking basically into how do different organizations in the Netherlands in the public health sector and beyond react to new viruses if they come here. And we developed two scenarios. Fictitious but realistic scenarios and asked, did a questionnaire about where do these organizations get their information from? What would they need? What would be their role? And we analyzed that sort of as an assessment what we can improve in terms of response to these kind of new threats. New outbreaks, yeah. So just like the movie, outbreak. Well, good luck, all of you. Thank you very much. Migration. Just one example, one wicked problem that is being dealt with within the GMSI program. So thank you very much for your insights. Thank you for watching. And well, thank you so much. Thank you. Thank you. Thank you. Thanks for the pleasure. Thank you.