Hi everyone. Welcome to the Addiction Recovery Channel or ARC. I'm Ed Baker and I am your host producer. Today, we're very fortunate indeed to have with us two distinguished guests. We have with us Dr. Todd Mandel, who is a board-certified psychiatrist with a specialty in addiction psychiatry. And we have Cam Laufe, who is a certified recovery coach right here in Vermont, presently working with the Turning Point Center of Chittenden County in a number of roles and we'll probably hear about all of them today. Thank you gentlemen so much for being on the show. This is a two-part series focused on the American Society of Addiction Medicine's expanded definition of addiction. In 2011, ASAM released its definition of addiction, which was mainly focused on brain circuitry. Since 2011, the American public for the most part has come around and began to understand that addiction is not a moral weakness, it's not a character flaw or a criminal personality, it's a medical disease. The 2019 definition is meant to expand on that, the idea of brain circuitry, and also to include some very important dynamics, the dynamics between the person and the environment. I'll read from the commentary, the ASAM commentary. They say that this definition, the new definition, recognizes that people do not develop the disease of addiction in a vacuum. The updated definition underscores the complex interplay of unique biological, psychological, and environmental factors. And by environmental factors, what they mean is what we call adverse childhood experiences or ACEs, hunger, poverty, difficulties with employment, difficulties with housing, that these types of environmental stressors can interact with brain circuitry in ways that both can cause the beginning of addiction, perpetuate addiction, and also either thwart or encourage recovery. I'd like to begin there with my guests. I'd like you both to think about your careers, think about your interactions with people with substance use disorder and addiction, and comment on the way that you have observed the environment interacting with brain circuitry, causing stress. I'll just start, can't start. I can speak a little bit about my own sort of path through recovery, and I can also speak about what I've witnessed in my work in the emergency department. My father passed away at a very young age. My mother had cancer at around the same time, so I was pretty stressed out. There's a lot of stuff happening all at once. And then throughout the years, I kind of had different outlets, which gave me sort of that reward. I'd get that kind of dopamine response from like playing sports, going to school, getting decent grades. I was never a good student, but I did okay. Up until the point where I started using substances where I had this sort of relief. So you can say that the environmental factors of my father passing away, my mother having cancer, all these sort of tragic things happening in my life sort of lead the pathway for me to become vulnerable to developing this disease. And what I see in the emergency department too is I see sort of like a compounding of factors, where you can have the genetics that lead up to it. You can have the environmental factors, and you can also have the traumatic events. And particularly the traumatic events is what I've seen sort of lead to this progression of this disease. So we'll see people coming in, possibly for their first time in the emergency department, where they're struggling with use. And then we might see them about a year down the road, and we see the progression. Where it might have started with maybe a mild substance use disorder to the point where now it's progressive. So their use is now problematic, and they're using past those consequences. You have those negative consequences which are arising in their life. One of them could be entering the emergency department. And then they're still here. They're still sort of resurfacing. Well, you know, let me take a second because that's a really interesting point. One of the other major points that ACM makes is they differentiate, which is what you're doing, between mild and moderate substance use disorder and addiction proper. They reserve the term addiction for severe substance use disorder, which means that the brain is compromised in ways that causes the person to continue in addictive behaviors in spite of consequences. And I think it's really interesting that you made that point because they make that same point. What about, Todd, what about your career? What have you observed? Very similar to what Cam describes, folks coming to treatment, bringing with them a variety of issues depending on whether it's their first time around, or having been in made attempts at treatment and recovery many times over the years. The part of recovery that seems to be a challenge for many people is how do I learn to cope with all of the emotional and environmental factors that are going on around me as I'm trying to get sober when I've used my less healthy outlets as a way of coping? And the issues are still there. As a person stops using or moderates their use or moves back along the scale, those issues are still present, or may still be present. They still may be hungry. They still may have not a safe place to live. They still may have someone in the family whose health is compromised or who's dying and coping with it without their outlet is very difficult. So a person can become abstinent, but that's when some of the more difficult work begins. Would you agree with that? Sure, certainly. I think that what we're touching on, and one of the main goals of the American Society of Addiction Medicine with the expanded definition, is to kind of tease out some of the nuances of addiction, that we can't expect if we look at people and just say, your addiction is a manifestation of brain circuitry. We'll help you to change around brain circuitry, but then you'll be in the same environment that fed into causing your addiction. Maybe there'll be problems with poverty. Maybe there'll be problems with housing. Maybe there'll be problems with employment. Maybe there'll be unresolved trauma. How can we expect people to just stop using drugs and not have an environment that welcomes them and continue to be abstinent from drugs? So the idea then is that this new definition would begin to inform the public so we would enact legislation and programs that would begin to deal with adverse childhood experiences, lack of employment, lack of housing, things of that nature, and mental health. I mean, what have you seen in your practices that speaks to that, like the absence of resources in the environment that sometimes cause a person to resume the self-administration of drugs? Let's say the early 90s, we didn't address co-occurring psychiatric disorders until the person had been sober for X number of weeks. The tricyclic antidepressants were much more toxic, and if someone relapsed into alcohol or other substance use on top of that, there could be more critical problems with the advent of the SSRIs and realizing that you can't do treatment sequentially. You have to do it in a coordinated manner. Even parallel treatment doesn't work. So you can't send a person's addiction to an addiction specialist and their mental health issues to a mental health specialist. You have to deal with the whole person. That's becoming more the norm. It used to be co-occurring, dual diagnosis, then it was co-occurring, and much more we're talking about a complex patient who may have a variety of issues that need to be dealt with simultaneously. That's been a big change over the last 30 years. In Vermont, I know because I'm a licensed alcohol and drug counselor, when we adopted licensure, part of the requirement for licensure was a master's degree in mental health. So in order to get a licensure for dealing with people with alcohol or drug issues, you had to also have a master's degree in mental health so that integration began to occur there. What about, have you made those observations also? Particularly when you're looking at individuals, it's sort of like this process of, here's your laid out path to what treatment might look like for you, but unfortunately they have to return to that same environment. And it's also asking a lot for them to, can you just up and leave everything to go to a residential care facility to get stabilized on medication to engage in programming? So do you have the finances in order to give up 28 days of work or 14 days of work, however long this day is? Do you have care in place for your children if you have children? Also like, are you going to be able to afford rent? Are you going to be able to pay for food for your family if you're the sole provider? So it's asking a lot for people to do that. And then whenever they leave the treatment center and they've completed their treatment and their programming and they're stabilized on medication and they've returned back to that environment, they're still amidst everything. They still have the barriers in place, they still have the financial stressors and everything there is just significant for them so that to continue the next step it's difficult because they have to dive back into work, they have to make up for the past month's losses to get back into the financial black. Yeah, there's a lot of obstacles, roadblocks, barriers, things that you've mentioned. One of the things that's happening in Vermont now that's very encouraging is that there's movement in housing, there's movement in transportation, there's movement in employment, all to educate significant leaders about the nature of addiction and the nature of recovery. Recovery support of workplaces is something that's being discussed and defined and different conferences are going to be looking at that. Recovery support of communities. There are a few communities in Vermont where there are really integrated avenues supporting recovery. So as a state we're moving forward. It's always an uphill kind of a movement but we really are moving forward. One of the things I wanted to touch upon was this is national in nature but it speaks to this idea of moving forward. This is a resolution by United States Representative Ted Bud that was introduced on November 19th. It's a house resolution. One point I'll quote it, one point will be to start recognizing addiction as a treatable chronic medical disease involving complex interactions among brain circuits, genetics, the environment and an individual's life experience. So that's taken directly from the ACEM medication. The resolution will also support evidence-based treatment along biological, psychological and social lines. And the third one, which I think is really important and which I'd like to speak to, it will support efforts to prevent and destigmatize substance use disorder and addiction. So this is a national effort. This is a house resolution that embodies exactly what we're talking about today. It's not a cure for anything but again it's one small step uphill but in the right direction. Let's talk a little bit about that. When we look at the environment, one of the environmental dynamics that people with addiction face is stigma. Would you care to comment on that? So with medication, medication-assisted treatment, it has a name, right? Medication-assisted treatment, but why isn't it just medication? So there's one instance right there. So changing the language and the terminology, understanding that it's medication. And this is a disease where, just like most chronic diseases, it's not just one treatment fits all. You need to sort of take into account the environmental factors, the adverse childhood experiences so that everyone's own sort of presence of addiction in their life could be different from another's. So that what my treatment for the same sort of, you know, what would be a chronic disease might necessarily not be the same for somebody else's chronic disease. Exactly. So I might have some allergies to some medications where you get the gist here. And it was brought up earlier just in a conversation that we had sort of like a microcosm or some macrocosm of what stigma looks like. And so I can speak, from my experience of stigma in the recovery community, particularly to a 12-step fellowship, that there is significant stigma facing towards individuals who use medication that's derived from those who are this strictly abstinent base recovery path. It's sort of like a sense of, you know, elitism that comes from it. This sense of purity, you know, I don't really know because I can only speculate to the experience, but I've seen it. I think this is a really important area so why don't we just stay in this area for a while. So what you're talking about is a stigma placed on people with addiction who are receiving a medication for addiction treatment. And the stigma is coming, nonetheless, from people who are also in recovery, but are more in recovery based on an abstinence-based program. You care to speak to that, Todd? Well, it's been an evolution as most parts of recovery have been. The fact that methadone is probably the most highly studied medicine in all the pharmacopoeia of medicine doesn't mean a lot to a lot of people. And yet it saves lives. It helps buprenorphine when it was released to say, right, you don't have to go to a clinic necessarily. You can go to a doctor's office that has the proper training. The efforts to train, and it was only allowed by physicians to use it initially. Now it's been open to MPPAs, nurse practitioners, physicians, assistants to be able to prescribe it. How to recruit folks to be able to use it was a large effort. And Vermont did a really nice job in leading the country and training the number of providers that have the buprenorphine license. It was interesting that this is the first medication, buprenorphine, that requires an eight-hour training. Most medicines you read you read a little bit about it and you discuss with a colleague and they jump on ahead. So who is going to be providing it? Who's patient is it? That's your patient, Todd, people would say. You have that patient, you do that. Well, how about the fact that they have hypertension, they may have diabetes, they may have a mental health issue that needs to be on medication. How do we coordinate that? Your patient. So now it's becoming more of an hour patient. And that's representative representative Bud's issue is he says very clearly in that document, people with addictions might not present for treatment because they're afraid of the stigmatization that they may experience when they come in. So it's within and without of the recovering community and it's a slow process but representative Bud made a really nice start with that. Putting it on paper is unfortunately different than having people absorb it and to practice to not be stigmatizing. We all have our blind spots but how do we learn to work past them and how do we not exclude people from the treatment that they really need. Exactly and well said by you both the fact of the matter is that stigma costs lives and the general public needs to be gently educated about that. Stigma causes people with severe substance use's order to be reluctant to reach out for help when they don't reach out for help the disease progresses and in our society with some of the drugs that are available on our streets today that can very often lead to death. I have a quote from the Betty Ford consensus panel on recovery and one of their criteria for recovery is what they call sobriety and I'll just read you the footnote because it bears directly on what we're saying. The Betty Ford Foundation says the consensus panel agreed that individuals engaged in medication assisted treatment who meet the other criteria for sobriety would meet consensus definition of sobriety. So what they're saying then is a person who's receiving buprenorphine or methadone will be considered in recovery if they're adhering to the prescription and the way that their medication is supposed to be taken and this is again the beginning of the expansion of consciousness to include people. To me and I know a lot of people in recovery to me it's heartbreaking that someone with such a dangerous disease opioid addiction would first have to battle the stigma of you know I'm not even going to say the word but you are a so and so you know you choose this you made your bed sleeping it that's the initial stigma that they face then if they're lucky or fortunate enough the resources and they get into treatment and they're on buprenorphine or methadone they're met with the feeling of you're still using your medication is opioid based so you're still using how how are that's we are the environment this is part of the environment that we create what what can people do what can the general public do to change that environment around how can we how can we change that I'd actually like to hear from you Cam about the role of the recovery coaches and how basically you're helping folks walk through that shepherding them helping them assisting them through those issues and I'd like to hear more since it's fairly new I'd like to hear more from you about how you and the other folks at your work would actually manage that help folks manage it I should say of course so really it depends I mean I'm I'm glad you brought that up because I I don't necessarily agree with that to set parameters around somebody else's kind of experience you know and and what's true to them and what is subjective to them I feel like that does a disservice to that person and and sort of you know not and what we do as recovery coaches we help align sort of parameters and expectations for individuals and what is reasonable for them to accomplish so helping them sort of come up with motivation helping really create a sense of autonomy through just dialogue and having an open dialogue session with them at various points of intervention we sort of create this sense of belief that you know I might not be able to do this right now but I can do this so it's kind of inching the person towards this larger goal of what might be their understanding of sobriety because for me to say well you know what according to Betty Ford this is what sobriety is and you're not living up to it therefore you're not sober you know like it's kind of a weird sense Betty Ford the consensus panel on Betty Ford is that you are considered sober even if you're on buprenorphine or methadone whereas one of the general stigmas that we're seeing is that most of the recovery community are saying you're not in recovery if you're on methadone or buprenorphine which I get 100% and I agree but there's another level to it so outside of medication there's also use of other substances although not the same substance that's causing the sincere problems in the person's life so if somebody uses IVU's heroin every single day and they're able to get to a place where they're not but they're smoking weed or they're using benzodiazepines or they're using crack cocaine it's not as problematic as it was in the past so from their understanding they are in a better place so that is it's working it's sort of a harm reduction approach applied to getting to a person to a place where they feel comfortable enough to kind of see like recovery this is my lifestyle that I'm living now it's a tall order to have sort of this expectation of you know committing to a sense of sobriety for the person when they're not in the place I see what you're saying and you know it gets really complicated but I'm with you Betty Ford is one resource and I think they've made progress by stating that people on opioid based medications can be in recovery if you look at William White in some of his writings he kind of addresses part of what you're saying it's kind of a harm reduction idea he will differentiate three stages of recovery one is partial which is what you're referring to people are still maybe harm reduction or the recurrence of use they're still struggling the next phase is full where people are abstinent from all dangerous psychoactive chemicals and they're leading rewarding lives improving their health improving their participation in the community and then the third really is beautiful it's enriched where recovery has shaped them in ways that enable them to give back to the community of people who are using substances and fighting for recovery helping them to move forward so I think that that is a very rich kind of way to define stages that we can't really see things in black and white and I think that's what you're talking about is the human and gradual movement forward and respecting the person no matter where they are in that process is that kind of what you're saying? yeah, 100% I don't like to give it labels because it would be subjective to each person but I wholly agree and I think and I understand like along the process I can't say this is kind of like a recovery coach sort of quip here I can't say I'm the expert on somebody else's they're the expert on their reality so when we work with people whether it's in an inpatient setting if they're admitted to the hospital or if it's in a recovery setting and if they're throughout the various stages whether in there sort of that partial all the way up to enriched as you stated earlier it's really a similar process where you have sort of this understanding that they're where they're at right now where they're at and provide them with the support so that they can continue well I mean that really answers my initial question about what can we do to reduce stigma and help people to move forward in recovery if we can spread that kind of attitude a little more to the general public by educating them then that's really what we need to do over time thank you Todd? well educating the public but also providing the support and education within the community of folks who are working on recovery so that they don't fall victim to this stigma and whether it's that I'm on methadone and I'm not being accepted by NA or I'm on I use alcohol and I am on antidepressants which didn't used to be allowed in or wasn't as as that rather than saying that wasn't as accepted by all meetings so how do we negotiate that and how do we help care providers negotiate that have a better understanding about what it's like to face to be afraid to ask for help what it's like when you're judged in an emergency room how do we help someone manage that and avoid use in semantics the tiniest things can make a difference and saying that someone has an addiction difficulty as opposed to being an addict opens up a door in a different way how do we use the better vocabulary the more accepting words more support how can I help you today as opposed to your drug seeking all of those they're significant but they're also very small changes that one has to make in order to have a welcoming environment so there's that and also what I think about frequently is the way the care provider or the recovery coach or the therapist or the neighbor feels inside about the person with addiction that somehow that gets communicated and that we all need to educate ourselves more about what addiction is and what people with addiction go through so we can really feel compassion and I know that both of you are still in practice you're still working with individuals I no longer in clinical practice but maybe we can talk a little bit about that the sensitivity that you experience toward people and the sensitivity that they bring into the office in my experience people with addiction by far are overly sensitive to stigma they will have feelers out and if they feel it emanating from someone that will push them away and it seems to be an obligation really for the service professionals really to deal with whatever they have to do education or therapy or consulting or supervision or whatever they have to do to get down in there and make sure that they have the right kind of attitude toward the people that they're working with do you want to comment on that I was actually hoping that you could walk us through a little scenario of someone that you're coaching who is experiencing stigma from whatever vantage point from their family from a provider and how you might help them deal with it how might you approach someone who said this has happened to me or I'm not feeling welcome at this meeting because I'm on methadone how might you help them manage it it's a relapse trigger yeah completely so what I can speak about has occurred pretty much sequentially over the course of a year and a half that I've been working in the emergency department is individuals re-engaging with treatment through the emergency department and it has been pretty rapid so it's about 3 4, 5, 6 times a month that it's occurring and every single time they're a bit less willing to engage as a result of encountering stigma through staff so it's kind of that look it's that tone it's sort of that sense they're very sensitive to that sense of well they don't want me here you know clearly I'm not going to get the best treatment and then it turns into just cognitive distortion and then it turns into a belief and it's a core belief and then they're unwilling a core belief about self and then they're unwilling to seek out treatment as a result and that's when we lose people that's when we lose lives what we do in a sense is we really provide that compassionate support for people so that where they are seeking it out in different venues having it reciprocated to the sense where they need that we'll then provide it and also what we'll do is we'll sort of we'll debrief in a sense they go to a meeting or they engage in treatment and then we'll debrief afterwards what did you hear did you take anything personal in a sense of like what came up that you felt was sort of targeted against you and then talk through it because it could just be misunderstandings it could be you take something and you misconstrue it in your own mind when I first got sober I felt everybody was staring at me I felt everybody was talking about how I wasn't speaking right and I'm from Baltimore and we have a really weird accent so and up here it's a very thick drawn out yeah I bought housing so there's this sort of you're in a spotlight and you feel like you're in a spotlight even when engaging in treatment when you first go to the emergency department you go you know there's that sense of well I'm not here for a medical reason there's kind of there's the overlap between adverse childhood experiences and addiction and children with adverse childhood experiences by and by having what's called early stress response early fear response they're like ready to bolt ready to bolt you can assume that really in my experience by practically everyone with addiction they're ready to bolt they're ready to be rejected they're ready to be misunderstood so they bring that to the setting and it takes a real inner peace on the part of the provider to engage that and de-escalate that body language it could be you know a professional that's just busy that really doesn't contain any stigma but they're busy and it appears that they don't care little things like that can cost lives and I know you're both acutely aware of that because you deal with that every day the idea of debriefing with a patient that was a little I like that do you have protocols for that you know ways that you are you documenting or you may be developing some kind of literature where you're going to be teaching people how to do that because that to me is really important we're in the process, I mean the protocol is continuously evolving as the program develops you know nothing is consistent right now especially when you work in a hospital you know it's we have the 10 day follow up which kind of turns into a month to two months however long a person wishes to work with us and when working in an outpatient setting as a recovery coach you're meeting with people at a coffee shop or the recovery center you're meeting them where they're at it's really the coach's own responsibility to kind of create that sense of support so it's you know it's up to the coach and what they wish to do at that time but they're all skilled enough to go through that process and debrief and you know I'm sorry I like the debrief, it's a reality test was this really what you were thinking your old stuff or was it just someone who was busy or when you need to go back there next time how do you advocate for yourself better I like that how do you advocate for yourself better and what about the medical profession itself I mean when doctors are trained I mean people with other diseases also can present a situation that causes like a negative response or a stigma based response our doctors how are they trained around responding to patients in a compassionate way is that part of what what goes on or is that just considered to be sort of you bring that to your role naturally well there's much more attention to the process of addiction than there had been when I was in training wasn't mentioned any more than nutrition was mentioned more than an hour in all of medical school and residency so things are evolving how how do you approach how does a practitioner in early training and all practitioners not just the docs how do you approach something that may make you uncomfortable and remembering to leave that at the door and to remember that everyone who's coming in to see you is not feeling good they're unhappy they're feeling terrible how do you no matter what the issue is it's bringing them how do you approach that in a compassionate way it's certainly an expectation we across the board as a society we could do better at it yeah well thank you for your candor about that and you know we're certainly you know motivated by powerful forces today to evaluate everything we do and get better everything we do you know the representative Bud's resolution I just want to point out was of course endorsed strongly by the American Society of Addiction Medicine because it closely reflects their definition of addiction but in addition to ASAM there were 14 other organizations that endorsed the bill and their organizations such as the American College of Medical Toxicology, the American College of Emergency Physicians the American Osteopathic Academy of Addiction Medicine and the American Psychological Association that's just a small group there were 14 so there's momentum there's force behind getting this message out to America you know and I want to thank you both I mean I think we're all part of that force and I want to thank you both for being here today we'll close the show now and as I am in the habit of doing I like my guests to close the show with whatever message they have for the viewing audience so Cam would you like to take the lead on that sure you know I like to go on to news sites on Facebook and and I like to go in the comments and I like to be a fly on the wall and kind of see the dialogue because I think you know aside from the Russian bots and you know all the other stuff that's happening the political discourse because that's where the true kind of understanding of what addiction is and that's the kind of language that is hurting people and so that's to the broader public the people who might not watch the show people who might not pay attention to the American psychiatric association they might not you know so I like to see what what they're saying and it kind of leads to the point of you know they made that choice they made that choice you know and for my experience and what I've seen and what I've lived through that there was a choice at the beginning but there was a lot of external factors playing into that choice being made so when I mentioned that my father passing away my mother having a life threatening illness me having to live with my grandparents and you know this whole whirlwind of stuff and then still this thought of cancer coming back in my mother's life and you know this sense of worry just throughout there was something that sort of kind of pushed my hand into making that choice of you know this kind of makes me feel better I'm going to keep doing this so it's like you know you make that choice to go swimming why do you go swimming because it feels better right you do it because you enjoy it but then when you're out swimming you think I got this I'm so strong I could swim against the current but now the current is taking out the sea you're in a rip tide what do I do here it's okay it's alright I can manage it you're still playing it's okay it's alright I can swim out to the side I can swim but then eventually you're 100 yards out to sea and nobody can get you an exhaustion yeah and you drown and it's it's brutal to see that so I mean beautiful description of the innocence of addiction and how it occurs over time outside the person's experience you make choices but you never choose addiction you choose relief of suffering pleasure improved self-esteem social connectedness comfort the things that drugs bring you temporarily while under the surface there's actually something happening in a cellular way in your brain and before you know it you need a drug just to feel normal and you're willing to do anything to get the drug and you have addiction yeah this is something that we need to keep talking about so people can really understand it that was a beautiful rendition of it it's kind of changed but do you get a little different do you get into it? because it can take all day sometimes I will get sucked into it yeah I'd like to have peace of mind thank you for that thank you for that very interesting swimming metaphor I liked it very much I use it small strokes, small steps small changes in language changes in legislation more support, more recognition that this is a problem we have a long way to go but we're making progress and we just have to stick with it thank you Tan thanks for having me back so thank you for joining us again for part two and we'll look forward to seeing you next time on the addiction recovery channel thank you


Hi and welcome to the session and we are going to discuss the following question. Find xy2 cos xy2 and tan xy2 in each of the columns. Now, here we are given the value that is tan x is equal to minus 4 by 3 where x lies in the second quadrant. Let us start with our solution where we are given the value of tan x as minus 4 by 3. We know that 1 plus tan square x is equal to we can square x right. So we can find the value by substituting minus 4 by 3 in here. We can get the value of we can square x and simply find we have 25 by 9 and the root is equal to x. Since we know that x lies in the second quadrant that means the value of x will be negative. So we have negative 5 by c of we can x. We can easily find cos x that is 1 divided by x that is 1 divided by minus 5 by c that is minus 3 by. Now we need to find sin xy2 tan x by 2 and cos x by 2. The formula is 1 minus cos x by 2. To substitute the value of cos x there we can find out the value of phi and that is equal to 1 plus 3 by 5 divided by 2. We can take that 8 by 5 divided by 2 into square root that is 8 divided by 10 that is equal to 4 by 5 square root that is 2 by root. So this is phi xy2. Whereas now let us proceed on finding cos x by 2 it is equal to 1 plus cos xy2. The formula substituting the values we have 1 minus 3 by 5 by 2 that gives us 2 by 5 by 2 that is 1 by 5 in square root equal to 1 by root 5 that is 4 xy2. And lastly we need to find tan xy2 that can be found out by sin xy2 divided by cos xy2. Sin xy2 as we have found out earlier is 2 by root 5 so it will be 2 by root 5 divided by 1 by root 5. root 5 will get cancelled out and we will find out that it is 2 and that is equal to tan xy2. But in order to rationalize the denominator and after doing so we have the value of sin xy2 as 2 by root 5 that after rationalizing it gives us 2 by root 5. And the value of sin xy2 for xy2 is 1 by root 5 after rationalizing the denominator we have the value root 5 by 5 and tan xy2 is equal to 2. So these are the required answers to the question that was asked from us. I hope you enjoyed the session. Take care. Bye for now.


Hello, hello, everyone, and welcome to Cloud Native Live, where we dive into the code behind Cloud Native. I'm Taylor Doulizal, head of Ecosystem at the CNCF, where I assist teams as they navigate their Cloud Native journey. Every week, we bring a new set of presenters to showcase how to work with Cloud Native technologies. They will build things, they will break things, and they will answer your questions. In today's session, I'm stoked to introduce Charledoir and Jim from Nermada, who will be presenting on showcasing new features and capabilities in Kerberna. Openness is a great policy, but not always, so it should be fun to dive into this one. This is an official livestream of the CNCF and, as such, is subject to the CNCF Code of Conduct. Please don't add anything to the chat or questions that would be in violation of that Code of Conduct. Basically, please be respectful to all of your fellow participants and presenters. Just be excellent to one another. With that, I would love to hand it off to the Nermada team to kick off today's presentation. Thank you, Taylor, and thanks everybody for joining. This is Jim Baguardia, co-founder, CEO at Nermada. Yes, so to start with, I want to do a quick background and introductions for on Kerberna itself, and then we'll dive right into some of the new features. So let me go to the documentation screen for Kerberna, and we'll look around in there in terms of getting started and how you can use Kerberna if you're not already deploying it in your clusters. So first off, Kerberna is a policy engine designed for Kubernetes. And why that matters is with Kerberna policies are Kubernetes resources, they don't really require a new language to learn.  So a lot of growing use cases, feedback we're getting from community, from users, et cetera, expanding that set itself. So looking at how Kerberna works and what exactly happens once Kerberna is installed in the cluster. So Kerberna itself, it runs as an admission controller. It's also available as a command line tool. You can run in your CI CD pipelines to verify policies outside of clusters, as well as it does background scans. Now, once Kerberna gets installed, and let me switch to the latest version of this docs. I'm on version 18, so I went to main and we'll go back and we'll kind of look at the documentation for the architecture diagram because it's changed with 1.9. So here, as you see, there's a few more components we're introducing. And the process of evolution for Kerberna has been it will still be a single install, a single help chart, but there's the controllers which were embedded into a single binary are now being split and decomposed into separate processes, separate, which will become eventually separate deployments, which you can manage and scale independently. So in 1.9, there are two separate deployments, but then moving forward, we have plans to further decompose and bring these controllers outside of Kerberna itself. But once you install Kerberna through a help chart or through the command line YAMLs, it registers with the Kubernetes API server and X as a dynamic admission controller, which means it has the ability to get any API request and to be able to act on that API request based on your configured policy sets. So Kerberna can, for example, validate the API request, block resources if they're not compliant, or can audit and provide reports on that, or also it can mutate and generate resources based on triggers that you can figure. So these could be events that are used to trigger policies. They can also be other resource create, resource mutate type of admission requests, which can be used to trigger policies. And then Kerberna also has some background controllers like the reporting controller, which is responsible for generating policy reports, as well as the background controller for update and mutate policies itself. So just quickly going on the reporting section and one exciting thing to point out over here is the policy report that was created in Kerberna is now being proposed as a standard. There are several other adapters that the policy working group has built on this policy report. And we're also in process of proposing this as a standard Kubernetes API, so other tools can also leverage this policy report and produce results based on this. So that's a quick overview of what Kerberna does, how it operates in the cluster, and let's take a look at some example policies before we dive in into the 1.9 features itself, right? So I'm gonna show a very simple example of a policy. And this is just to disallow the latest tag. Since the latest tag is mutable, it's not considered a best practice to have that country allowed because the actual underlying image may change. So this policy, as you can see, it's a few lines of YAML, which is the bulk of the policy body. There's just other metadata that we typically put with all of our sample policies, but to identify the type of policy, a description, et cetera. But here, we're doing a validation failure action of enforce, you can hear it's doing a background scan. By the way, one thing that you might have just noticed is because Kerberna is Kubernetes native, help, et cetera, it's just built in, it works with Visual Studio. If you are running the Kubernetes extension for Visual Studio Code, right? So pretty cool to kind of see help from OpenAPI v3 schema, just pop up and it will tell you if there's a syntax error, et cetera. But here, we are kind of running this in background mode as well as admission control. It's enforce, which means the cluster or a container which is not compliant would be blocked. And then it's checking for the, you're the tag. And as you can see, it's a very simple check which is using wildcards to make sure that either latest or an empty tag is not allowed on this image. So that's the structure of Kerberna policy and we'll see a lot of these in action. But the basic structure is very similar. And then there's of course policies to mutate, to do things like image verification and to cover some of the other new features that we'll talk about. So going back to my browser, what I wanna focus on is the Kerberna release nine and we will demonstrate some of the key features from here. We, Kerberna typically puts out minor releases every two to three months. We are already, as you can see, I made progress on 1.10. There's some interesting features scheduled for that. But for the topic today, we are gonna cover a lot of the new features. So there's a release candidate for 1.9. We're on RC4, which just got published earlier today and we'll cover, so if you wanna try out these features, you can install that, make sure you use the minus minus DEVEL for development flag on the help install command if you're installing through help and you can try out these features. So Charlotte is gonna talk about the cleanup controller, which is one of the major features. We'll talk about distributed tracing, which is extremely with open telemetry, some pretty cool stuff you can do in terms of understanding how policies are working in your cluster. And then I will cover policy exceptions. So these are the three major features we're gonna demo. There's a lot of other minor changes as hundreds of bug fixes and enhancements which have gone into the release. But this is what we were planning to cover today in terms of features. So with that, let me hand off to Charlotte who's gonna talk about the cleanup controller as well as distributed tracing and he will introduce and demonstrate these features. Thanks Jim. Hi everyone. I'm going to start by the distributing their tracing feature because it doesn't apply only to the Kivano admission controller and it applies to the cleanup controller too. So it makes sense to start with the tracing feature and we will discuss the cleanup controller after that and we will see what the cleanup controller actually does by looking at the traces because tracing is also embedded in the distributed tracing controller in the cleanup controller, sorry. So let me share my screen documentation for the main branch again because it's not yet it's coming. As Jim said, we released our C3 yesterday and we are today. So it will be available in one hour or so, just probably after the live stream. And one of the features that we added in Kivano 1.9 is the capability of tracing. So tracing is inspired by this distributed tracing. Actually, currently in Kivano, it's not very distributed because Kivano is a monolithic application right now but things are changing in 1.10 and it will probably change even more in the next versions. We are introducing new controllers and potentially we are also supporting HTTP calls directly from Kivano engine to other services running in the cluster. So progressively traces will become more and more distributed by nature, even if today it's not that distributed. Anyway, tracing is still quite useful. You can see below a trace for an admission for an admission request for review. And we will see that every step that the admission request goes through, entering the admission controller, then entering the engine and processing every policy and every rule per policy will be detailed and measured in the traces. So behind the scene, we are using open telemetry to create the traces. So this is the client. The client is an open telemetry client. And we also instrumented all HTTP clients. So HTTP clients and therefore Kubernetes clients will create spans in the traces. What that means is that it's available in most of the tracing backends. So we have added some tutorials in the documentation to set it up with Grafana tempo, which is a tracing backend developed by Grafana. And another tutorial to work with Yeager, which is another backend. So today I will demonstrate the Grafana tempo backend because it's the easier to set up. For that, I created a simple cluster with just the values make commands. We have in the Keverno repository, then I created a cluster. I deployed what we have called the dev lab, which is just an instance of Grafana, Prometheus, Loki values tools we use to observe the Keverno deployments. And I finally deployed Keverno and the couple of policies in the cluster. And I also created two namespaces, one for tracing and one for cleanup. So right now we will be using this one, the tracing namespace. So finally, I just have one Grafana running, Grafana running with a tempo data source. This tempo data source will provide traces and when clicking on a trace, we will be able to observe the details. But let's try to create a couple of resources first. So for the tracing demo, I created two resources. One I called good pod and one I called bad pod. The good pod is just an NGINX pod with nothing special in it. So it should be accepted to run in the cluster. And the bad pod is the same pod but with host network set to true. And I installed a policy that will prevent if I just list the policies installed. I installed a number of policies. And for example, the host namespaces should forbid the creation of pods that run in the host network. So if we just create, what is my script? If we just create the good pod, the good pod is actually created correctly in the cluster. If I go and I get pod, tracing is there and it's creating. And if I try to do the same thing with the bad pod, the bad pod is rejected. So the policy disallow host namespace refused the creation of the pod because sharing the host namespace is disallowed, et cetera. And it's what the policy is supposed to do to reject pods that use the host network. And we have still only the good pod running. Now, the interesting thing is to find what happened in the Kiverno engine, in the Kiverno controller. And for that, we can use a couple of tags that exist on the different spans of our traces. So if I look for tags, admission.request.name equals good pod, I see one trace. This is the trace that was generated at admission time when the pod was created. So we see that we have first an HTTP request and we have a middleware that produces metrics. We have another middleware that filters incoming requests. And finally, the last middleware is responsible for validating the admission request itself. We have a number of tags available to search for traces. And for example, the admission.request.name was good pod. We have the namespace, we have the operation. So it was a creation. We have a couple of informations related to the kind of the resource being admitted. So in this case, it was a pod belonging to the API group version V1, et cetera, et cetera. We have informations about the user that issued the call. So in this case, it's me. I'm the Kubernetes admin and I'm part of those groups. And below that, so this trace is about the... Oh, sorry. Is about the validation. We have different spans and all those spans cover different policies installed in the cluster. So when I listed the cluster policies installed in the cluster, we see that we have approximately 11 policies and we are going to find those policies here in the list. And below each policy, we will have the different rules. So for example, the disallow hostports policy has three rules. One which is called hostportsnone. Another one called autogen hostportsnone and a third one, autogen crone job hostportsnone. In our case, we can see that the first rule took 174 milliseconds. The second one took 1.78 milliseconds and the third one took almost zero milliseconds. And we have the details for every policy in the list, every policy and every rule. So of course, most of the policies here are about pods. So most of them were applied to the pods themselves. And that's it. We can do the same thing with the bad pod. The bad pod, admission.requestname equals bad pod. And this time, we found only one policy, one admission request for the creation of the bad pod. And if we go and look at the attributes this time, we can see that for example, admission.response.org allowed was false. And this is consistent with what we add here when we try to create the pod and the creation was rejected with the different information here. We have all the same information, okay? The result message is truncated because graph and a tempo has a limitation on the size of the tag values. So we can't just store the full message. So we are truncating it at 256 characters but we will find all the relevant informations here. So it's the same thing as we could have admission.response.allow We could have admission.response.allowed was false. And if we look or if we search for not allowed admission request, we can easily filter and find the rejected admission request at this point. Okay, for the next demo, we can do the same. For now it was just some, what can I say? Some validation policies. We can do the same with an image verification policy. So I just installed a policy that is going to verify the signature of the image. The image used in this case is an image coming from GHCR, Kiverno named test verify image. This is an image we created ourselves to test that the feature is working correctly. So we have for this image we have different flavors of the image. We have one which is tagged signed by someone else. And if the image is tagged by someone else, we expect the creation of the code to fail. In this case, if I try to keep Cthulhu run the image, the verification failed because it says the it didn't find a matching signature. On the other end, we have another image signed with the signed tag and this one is expected to run. So applying this one will produce a pod being accepted. And if we go back to tempo, we should be able to see both requests and to check admission.request.name.side. Okay. And we have a code that we can use for this image. Okay. And we have both calls. The first one is the mutation, the admission request and the mutation. This time we have the first entry point is the HTTP request and we have the middleware creating metrics, another middleware for filtering. And finally, we are in the mutation part of the Qiverno engine. The mutation part looks up the verify image policy. And in our case, this verify image calls the verify image signature in cosine. Cosine in turn will call to GHCR. So we can see that it will be calling GHCR.io slash V2. It's probably to get the token. Then it will go to check the manifest. So here we have the, where is it? We have the signed by someone else tag we were using. Finally, we will go, this one is probably to get another token. I don't really know what happens in the cosine code, but it allows to dig and look at the different HTTP calls that are performed by the code. And finally, more calls will be done to fetch some manifests and to actually verify the different signatures. So in this case, it was the first test that was using a sign by someone else and the response that allowed was false again because the admission request was rejected. And finally, if we look at the other request, so this one is about the second test where the image was signed by someone else. By the correct certificate. So this one was accepted. We just see that the response is this case is true. So the mutating web book allowed the admission request. And then after that, we have the validation web book for the same pod. And this one was also allowed. So with the name, for example, with the name tag in the request, we are able to filter and to search for every web book that were applied to this particular admission request. So in the case of, in the second example, we have both one mutation web book called and the validation web book called too. Okay. And basically it will allow users to get better information about what happens in Kivano at admission time. I know a couple of users are trying to understand better why the policy can introduce a latency or understand better what happens behind the scene. And this is a good tool to know better what was actually done by Kivano. We can clearly follow the links between one admission request and the goal to GHCR because we were using image verification and cosine as to call GHCR and so on. It's not visible here because we don't have a policy that calls the API server but if a policy has a context variable that is created from a call to the API server, we will see in the graph the call to the API server. So we will be able to say, okay, this policy called the API server to list ingresses and things like this. Yes, lots of good details there. Maybe Chaladva from a time check perspective, let's spend about 10 minutes on the cleanup policies and then we'll do the exception demo. Okay, let's do that. And I think if there is any, I did see a couple of comments in the chat just in terms of making the screen a little bit bigger if at all possible, but did want to call that out as well for some of the folks that were viewing today. So the screen, you mean the graph and dashboard? Oh, correct, correct. Okay, I can try that. Awesome, thank you, thank you. Okay, so let's talk about the new policy type that is introduced in one line. We now have the possibility to clean up resources in a cluster. So this is not strictly speaking some validation or mutation of policies, but it's more related to automation. We have automated tasks that dilate things or things like this. This can now be expressed in the form of policies. Those policies exist at the cluster level or at the namespace level. So you have cluster cleanup policy and just cleanup policy, which is the namespace version of the cleanup policy. What will define a cleanup policy? It's very similar to what we have in standard policy. We have a match and exclude close that can specify which resources are targeting by such a policy. And we also support conditions. So conditions will be evaluated on a per resource basis to say that, for example, we don't want that. So this cleanup policy, for example, targets deployments. And we don't want to dilate cleanup. We don't want to dilate deployments when replicas is below two. This is very, very similar to policies that we are used to write. And finally, those policies will also have a schedule because they will run continuously in the cluster based on the schedule defined here. For this demo, I just created a simple policy which is very similar to what we have here. So for now, I will keep the labels and the operator. So if we create this policy and on top of that, I created two deployments. One of the deployment has can remove set to no. The other one has can remove set to true. So this one should not be considered by the policy we have here because this policy specifies that we are only considering deployments that have the can remove true label. This one should be considered by the cleanup policy. So let's apply this. So now we have good deployment and we have also one cleanup policy running. Of course, for now, it's not going to do anything very useful because it's running but the policy we have defined here will not delete any of the deployments because they have a number of replicas that is above the two here. So if we switch and use the model, the greater than operator rather than the less than operator, this policy should now start delete deployments. It runs every minute, so we have to let one minute pass. And after that, it should delete at least the yes deployment because the yes deployment has the can remove label set to true and it also has number of replicas above two. So this worked, the condition here was honored. As the spec.replicas was above two, the deployment was deleted. In the same spirit, if we just remove the selector, it should now, it recreated the yes deployment but this one should go away when the policy runs a second time and it should happen in one minute. Yeah, so some of the use cases for this is to configure even time-based leases or some garbage collection for resources in the cluster, things like that, right? So some interesting possibilities. Definitely, so both deployments were deleted because we removed most of the constraints in the policy. Of course, we probably don't want to do that in a real cluster but at least for demonstration purposes, it's just how things work. And yeah, it was a very simple example based on the number of replicas but it could also use the age of the resource and let's say I don't want to delete resources that are younger than one day or a few hours but if the resource is older than one month, okay, I want to delete it or things like this, it's completely possible to have such conditions. You have all the necessary functions in Jamspass to do that so you can get the creation timestamp, compare that to the now timestamp and say, for example, if the resource is older than three days, okay, I accept to delete it. And I can combine it with different other condition and the schedule is of course a nice solution to implement time-based condition. Cool, thank you. Okay, I hope it's clear. I think there's a couple of questions, Taylor, if you want to, should we answer them now or? Yeah, I've got one from a little bit ago. I saw this come in the chat. Hello, what is the status of potentially making this a standard tool within Kubernetes? How long would it take and how would it be better than some existing policy engines like Rego and those kinds of solutions? Good set of questions. So certainly whatever can be standardized through the policy working group and other Kubernetes SIGs as well as working groups, we are proposing for standardization like for the policy report itself. Kibirno of course, it is an add-on in the Kubernetes clusters. So it's not likely that Kibirno, that the entirety of the policy engine would be standardized and the idea is to allow flexibility for admission controllers there. You know, in terms of how is it better? I think it seems like Adam answered the question himself. So of course, Rego has some complexity and there's a learning curve for it, Kibirno, because it's focused on Kubernetes, offers a much simpler experience and also a wider set of use cases like Charlotte wash out the cleanup policies. We have also policies to generate resources. There's very powerful capabilities of mutating as well as other sort of things that we're looking at in terms of extensions. So yeah, I mean, we're always looking at expanding the use cases, integrating as natively as possible and staying focused on providing the best experience possible for policy management on Kubernetes. Awesome, awesome, thank you, Jim. I saw another set of two questions that came in the chat and then I've got a couple as well after that. If you have any questions and you're watching right now, please throw those in the chat and we can get some of those answered. The question that I saw come up was the first of the two questions was are you planning to support app signature? For example, Port 5432 should accept only Postgres signatures, those kinds of use cases. So you're not sure if I fully follow the question there, but if that can be, so if there are ways, like whether through network policies, Kubernetes or higher level network policies like Celium, et cetera, if that can be configured, then yes, Kivarno can verify those configurations, whether they're custom resources or native resources. Kivarno does not intercept network traffic or do anything at the kind of a layer four or a layer seven request level. So it deals with admission controls and configurations. But yeah, if you can configure this with a network policy, then Kivarno can validate and enforce that certain things like these configurations are allowed. Gotcha, awesome, thank you. The next question I had that I didn't follow, but might make more sense to you when will this release be adopted by ACM 270 or 280, et cetera? I believe the ACM reference here may be Red Hat Advanced Cluster Management, RACM or Red Hat ACM. So yes, the ACM supports Kivarno. I am not sure on the schedule of picking up 1.9, but it's fairly quick as soon as it's available. By the way, Kivarno is also available, both the enterprise distribution of Kivarno from Nermata, as well as the open source distribution are now available in the Red Hat and OpenShift marketplace and the operator hub as well. Awesome, awesome. Moving on to some of the questions I have for you. Regarding tracing, what are some of the supported backends right now? Regarding tracing, as I said earlier, we are using open telemetry behind the scene. So any backends supporting open telemetry protocol is supporting, so that's Grafana Tempo, Yeager, Datadog and probably others. In case the back end doesn't support open telemetry protocol directly, there's always the possibility to deploy open telemetry collector, which the open telemetry collector will receive the traces in the open telemetry protocol and is capable of transforming them and transferring them in another format. So it can do the conversion on the fly. Awesome, awesome. And then I had two other quick questions and then can shift back to Jim here. Both these regard tracing as well. What are some of the supported sampling strategies for tracing? Yeah, currently we are either tracing or not. So we are sampling 100% of the traces. This can have an impact, especially on cost because sending all traces to the back end can be costly. So in this case again, using open telemetry collector can be a good option because you can have tail-based sampling strategy and you can say, okay, I'm going to sample traces only if they have errors or things like this. And this kind of strategy cannot be done with a head-based strategy. So in any case, we don't have any tutorial for that yet, but we plan on adding a more advanced tutorial around tracing to create a more advanced scenario where open telemetry is used to have a better sampling strategy. Awesome, awesome, thank you, thank you. That's really illuminating and really awesome to hear that you can capture 100% but also to kind of include that consideration as well. Everything is trade-offs, always a fun problem to solve. In terms of tracing, does that add latency? And if so, can you give us kind of a general sense as to what that looks like? Not really. Of course, it takes a small amount of time to create the trace itself, but anyway, transmitting the traces is happening in the background. So it's very lightweight in the end. Awesome, awesome. I remember reading a humorous post about TLS and like somebody who's like, we don't use TLS, it takes too much time just as a comedic funny thing and because it added more time but the end result is so much better. But again, trade-offs. Enabling or not enabling tracing is not going to save latency. It will be the same. It's just that in one case, it won't be transmitted. But for tracing, you need to instrument the code. So it's not magic. So there's some instrumentation going on and this instrumentation is very lightweight by design. So it's just a couple of function codes and it doesn't cost almost nothing. Gotcha, gotcha. Thank you so much, Charlotte Ward. Really appreciate it. Was that, Jim? I'd love to turn it over to you for the final demo today. Awesome. Yeah, so the last feature we want to showcase is the policy exceptions feature, which is new in 1.9. And this, by the way, was done by Eileen Yu, who was one of our LFX Linux Foundation mentees for the last term. So very excited to be able to demonstrate this and thank you, Eileen, for all the great work here. So this feature, what it does is it decouples the life cycle of managing exceptions or how you can exclude certain resources from policies from the policy definition itself. So here I'm showcasing, typical Kivana policy has match and exclude blocks and you can exclude based on many factors, including names, namespaces, labels. But now what you can do at 1.9 is you can pull that exception into its own new custom resource named policy exception. So this can be, it's a namespace resource. You can put anywhere in your cluster. And as you can see over here, within the policy exception, you can say which policy name, which rules should be excluded. And then you can do a match on any resource itself, right? And again, this match has a lot of flexibility for the demo I've just done test, right? So that's how simple it is now to configure exceptions. And of course, you can manage exceptions through RBAC, you can manage exceptions to Kivana policies because Kivana policies operate on any custom resource, as well as Kivana itself has a few nobs to make sure that you don't misconfigure these policy exceptions, right? So the first thing I'll show is if I just go to the Kivana deployment, let's just edit the deployment. And I wanna show within this, there's a few new flags you have to kind of think about. So first of all, it's an opt-in feature because it's a new feature, you have to enable policy exception, it's not enabled by default. And then secondly, you can optionally configure a namespace for policy exception. By default, this is Kivana, but you can put any namespace that you wish and then secure that namespace through again, RBAC and other mechanisms for manage your policy exceptions. So that's how I have this deployment configured. And if I look at my, right now in my cluster, I have a few pod security policies. So if I just do get C-Pol, I see I have a bunch of pod security policies configured. So if I try to run a names, just say, let's say, Nginx, I'm gonna try and run it in this namespace test. It's gonna, should deny that because of my pod security policies. So let's say for some reason, I want to create this exception on my cluster. So what I'm gonna do is I'm gonna just say kubectl apply, and I'm gonna create this exception. I'm gonna try and create it on the Kivano namespace, which actually should be a no op, right? Because, well, it's allowed, but it's giving me a warning saying that, hey, this doesn't match the defined namespace for policy exceptions. So that's a good safety check. You wanna make sure you configure it in the right namespace. So let's delete that. And we will create this exception again, now in the policy exceptions, a namespace, right? Because that's what we configured Kivano to look for where to kind of pick up these exceptions. So let's see if we do that. So now there's no warning, which is good. And if we go ahead and run that same pod again, on that namespace, what I'm expecting now is that for that pod to be allowed with no errors, right? Because in my policy exception, I had requested that all of these rules, which were previously failing, are not checked for this particular namespace. Now I could make this more granular by labels, by pod name, by other kind of mechanisms, but in this case, I just choose to exclude this particular namespace. So that's the basics of how policy exceptions work. And as I mentioned, you can secure this further using Kivano itself. So one other kind of thing I wanna quickly demo is if I, let's say if I now require that, Charlotte washowed how to do image signing and verification, but let's say if I wanna require that policy exceptions have to be signed for approvals, right? So I'm gonna apply this policy called required signed exceptions, which I'll show you what that looks like. That policy is checking and making sure that every exception I have configured actually is signed by a particular key. And of course, you can associate these keys to identities and things like that for an approval workflow, right? So at this point, if I try to now run that same, let's say, part again, or, you know, because so let's say I'm gonna delete my policy exception and then I'll try and recreate the same exception. Let's see if that's allowed. So let's delete this exception in the exceptions namespace. And then what we'll do is we'll apply that same exception back with this new policy. And what I'm expecting is it's not gonna allow the unsigned exception to be configured, right? So you're, it's telling me that, hey, this exception requires a signature, so you can't do that. But I do have a signed exception, of course, for the demo. So if I now go ahead and, you know, instead of the unsigned exception, let's do exceptions signed YAML and this one should be allowed, right? So if I go ahead and configure this, now it allowed that to be created and my exception is created. One of the cool thing is if I go and, you know, kind of try to edit this policy exception, because it's signed, it will not allow, you know, any tampering of that policy exception itself, right? So let me, let me clear my screen and I'll go back to the top. And if you do kubectl edit and here I'm editing the policy exception in that namespace, which should be my signed exception, right?  So what happens right away as soon as I try to save it is Kevurno checks and says, hey, that, you know, because you made this change, the signature of the signed manifest does not match the signature I'm expecting and it's going to reject that change and not allow that policy exception to be configured, right? So a lot of interesting possibilities now by decoupling policy exception management from the life cycle of the policies, you can store exceptions in a different Git repo, you can build your approvals workflow with GitOps, you can sign your YAMLs and make sure that Kevurno is only allowing trusted policy exceptions to be configured. And, you know, of course, you can also use RBAC as well as other additional Kevurno policies for how you want to do governance and compliance on these policy exceptions. So this is a first release of this feature. We're very interested in further feedback, further, you know, refinements. So please do try it out, let us know what you think and, you know, how we can, you know, continue to improve and enhance this feature itself. So, but it should, you know, immediately also start solving a number of use cases that were previously raised as challenges with managing this kind of exception management for policies. All right, so the last thing I want to kind of talk about is, you know, also a little bit about what's coming next in Kevurno. And I'll also give a few, you know, kind of hints on how you can join the community and provide feedback. So Kevurno 110 is our next release. We have a few other additional major features. In fact, the bulk of this release is going to be internal, you know, kind of decomposition and re-architecting Kevurno for more scalability across, especially around the background controllers, right? Because we see those with cleanup, with mutate and generate on existing resources. There's a lot of, you know, background activity which we want to decouple from the webbooks and you'll be able to scale those independently. Other key features, so inter-service, like service API calls. So Kevurno can now delegate some, you know, processing to another service in your cluster and can also look up data for policy decisions from other services. So this brings a lot of flexibility. And I'm pretty excited about that feature. And then Notary V2 support. So as a lot of you may know, in software supply chain security, Notary V2 is another emerging standard. Kevurno 110 will support Notary V2, as well as, you know, being able to run notation-based plugins through this, you know, external service API calls features. So that's what we have planned so far. And there'll be, of course, a lot of other fixes, enhancements as the release progresses. And we're targeting about a two to three month, you know, timeframe for this release itself. So lastly, last thing I just want to quickly mention is, you know, if you go to the Kevurno docs, go to the community. We're very active on our Slack channel. We do have weekly contributor meetings and we are gonna be kicking off some, either, you know, a set of office hours or some end user meetings. So please do, you know, pop in, give us feedback on these or if there's any other things you need, you know, from Kevurno, feel free to reach out. There's also, you know, in terms of folks looking at contributing, we are kind of, we have a lot of documentation we have created. You can go to the Kevurno repo and even look at the, you know, development markdown file there to get started. And we will be, you know, kind of also continuing to enhance that experience to get new contributors, new, new folks into the project. So with that, let me hand back to Taylor and see if there's any final questions before we wrap up. I took a look through the chat and didn't see anything that was super urgent. It looked like, and then I think we're just about at time but really wanna thank both of you for coming on today, chatting with us about Kevurno and really excited for everything in 1.9 and what's coming in 1.10. So thank you again. Thanks for having us. Take care. Awesome, awesome. Thanks everyone for joining us for the latest episode of Cloud Native Live. We really enjoyed the interaction and questions from the audience. Thanks for joining us and we hope to see you again soon. Thanks everybody. Have a good one.