I remember the only thing that ever broke me mentally doing something physical was running a marathon. Now, needless to say, I ran that marathon the last four miles with a broke foot and did not know. And that's why I was going crazy in my mind. But that's why I broke because I actually broke my foot. But I remember thinking I can't go home. Like I had people waiting for me at the finish line. I'm like, I'm going to start a new life. Like I can't, I cannot not show up, but I don't think I can show up, you know, and I persevered. And it was one of the greatest feelings I've ever felt. So with everything around me feeling like it's falling apart. I went to that moment of what broke me and I was like, I wanted to not only meet that challenge, but defeat that challenge and dominate that challenge. So I decided to run four marathons in five months. So I began to train in Spain and it was emotional. It was emotional for me because I was by myself and I had to deal with me. And I had to challenge myself in a way when I didn't want to get up when I didn't want to do these things. And I celebrated, you know, it was you would have thought I was running against a hundred people out there in my mind. Because it was a, it was a challenge. I was running against a hundred versions of myself and the one that I wanted to win. I had to, I had to get through that because it was so many different ideas and directions I could have taken myself. But this, this one in the head of the race is the one that got to win because this is what I need to be. And when I tell you it was, it was life changing in Spain. That's what Spain has my heart and coming back and it's been just incredible ever since. Like it's been incredible ever since like sneaker has been dropping like all of these different projects happening. You know, I'm currently shooting them show called heels. You know, everything on the personal side is better like it's just sometimes you got to go through things and it's a part of life. So we need tools to help deal with them and running is the tool that helped me and I'm just looking to influence other people to do the same. You know, running your first marathon is so much more than just being in shape.  I'm running with them. Like I'm running with them just because I want to be able to support you. But then I always leave them at mile 20, because I always say that last six mile was a personal journey. It's a personal journey where you're going to be, you're going to want to quit. You're going to want to say no you want to you're going to believe that you can and the feeling you feel when you finish that that when you cross that finish line. And everything in you not outside of you because you're used to dealing with people outside of you saying you can't do something is usually yourself.  You get to a place where no matter what when I decide what I want to do, I can do it. And that's a superpower. I love it, bro. Yeah, I'm with you. I'm right there with you. I developed that a while back and entrepreneurship with different companies and just, you know, I don't know. Nothing will ever change anymore. I feel like it's inherent to who I am now. And I kind of love that I have it and it's a super public you said and it's a thing of like when you're in this in the same sense when you're running a marathon. It's like what does complaining do for me? Right. It does nothing. I'm still I still got to run this thing. I still got to keep moving. I can't stop. What does complaining do so you you tend to find yourself focusing on the resolution rather than the problem. Right. And that's something that I feel is this, you know, is similar in both stories. It's like, I can focus my energy on the problem or I can focus on the solution and you just decided to focus on the solution. And it's like, OK, this is what it is. Cool. Let's just let's just let's just clean it up. Let's get it done. You know, I'm alive. That's beautiful. Right. That's beautiful. Hey, everyone. Thanks for checking out that clip. If you enjoyed it, be sure to hit the like button down below. And if you're interested in hearing the full episode, it's out right now on our YouTube channel. We've had a lot of great guests come on this show before and we've got a lot of great guests coming up in the future. So hit subscribe so that you don't miss a single episode. And one final note, we're always looking for new ideas and new companies feature on the show. So if you know of someone or know of a company, write us a comment down below letting us know who they are and what they do. We'd be happy to have them on the show. Until then, I'll just be here waiting for your comments. So, uh, see you later.


Hi, beautiful.   I'm ready to see some awful weird stuff happen to hair that makes me want to jump out of my skin and yell things at people. So let's watch the videos. Okay, hold on, hold on, before we make any cuts. Hold on, hold on. So I think she has a vacuum because her hair's got sucked into that thing, whatever it is, I'm assuming a vacuum. We may never know. And then she whipped out the clippers. So it's looking risky. Is this her real hair? It really does look like it's her real hair, so. Okay. They really skipped over that one real quick. Y'all, they snuck that one up on me. She, whoo, not good. Can we see that finished result again? Because I am shocked. She loved it. Oh my God, is that her real hair? No, it looks like a wig, I think.  Looks bad. She definitely had a few drinks before doing that. Like, I know it. She was wastage.  She accomplished the task, I guess.  And you know what, I'm proud of you, girl.  I shouldn't be proud of her. Probably shouldn't be doing that, that's not nice. I don't know what I should feel during this whole video. Imagine if it actually worked. Should we make a whole trend where people cut their hair with a vacuum? Don't get me started. She's got long, luscious hair. It looks like she had a wild night out, girl.   And she woke up with a mess on her hair. This is fine, you know, we'll just break out a brush, right? We'll brush it into place, it'll be fine. Shouldn't be too hard. I've seen hair more tangled than this. The comb broke. For hair this tangled, I wouldn't recommend a wide-tooth comb. I would definitely recommend like a tangled teaser sort of brush with bendy bristles. But you know what? Okay, where are we going now with this? What is the next step? The next logical step for me would be to get a new brush or wash my hair and condition it. But you know, it's five minute craft. So like, we don't know what's gonna happen next. Right. And that's exactly what I would have done. I would have called up my friend and said, yo, we really can't even get through it. My comb just broke. And I would have had her come over, specifically somebody with some claws as nails, and been like, you need to comb it with your fingers. Like that's the only way we can get this out. And they would have came over and they would have done it for me. And then I would have came out of it with perfectly blown out hair. That makes a lot more sense than what I was saying. Like I'm embarrassed because of like the approach that I took didn't make any sense compared to that. Honestly, five minute crafts, you kind of slayed that one. I should go back to hair school. Fuck. Her ends are dry, they're brittle.  Is that where we're going with this?  Just to give hydration back to that. Easy fix. Again, what the hell, Brad?   Creativity with these videos, I have to give it to them. Who thinks of that? Genius, you know? Like, well, no. But honestly, not great. There's a lot of easier things you can do. You can definitely use a hair mask. You can definitely put oil in your hair.  So it's not the craziest thing ever. I mean, it would definitely work. I feel like you put a face mask on your hair where you can just do things made for your hair. And also there's probably hyaluronic acid in face masks. You know, your hair will probably be nice and shiny and beautiful, so actually five minute crafts kind of slayed with this one but didn't play at all at the same time. At least this actually could work.  Anyways, I won't be trying that anytime soon. And probably neither will you. But at least we know now. Was that it? Was that the hack? Hold on, damn it. She's feeling like her hair's flat. Big problem, I get it.  I don't know. I don't have a lot of my house. She clearly has no hair tools. She was looking around. She's like, mm, hair tools? Don't got any. What I do definitely have is an empty salt shaker, I guess you would call it. I don't even know what that is. An empty jar. Literally, I've never seen one of those things in my life. But she doesn't have hair tools, but she definitely has this. So what's the logical thing you should do with it? Let's see. Yes, exactly. Makes total sense. We choose a heavy material from around our house. We didn't choose something light, like crumbled up paper or any kind of packing material. No, we chose to put glass, breakable glass in our head and then proceeded to wrap the hair around the glass to make one of the ugliest updoos I've ever seen. There was never a time where this would be cute. This is just bad. Don't do this because what if, no, there's not even a what if. Why would you ever do this? It doesn't make a lot of sense to me.  And it looks like it's in there. It is sturdy.   A lot of teasing and a lot of hairspray, I guess. That's how they did it. Honestly, 10 out of 10 for effort. Zero out of 10 for execution. It's being generous with it. Thank God I had much to say. Ooh, this much I've been keeping me a little lit. Okay, well, we're already in it. That's been like 0.01 seconds. And what the fuck? Okay, it's like a clothing hanger of sorts, I guess. And then she has those industrial clamps clamping her hair up to this thing. And she slept like that. Like, girl was fully in there. She's like, I'm committed to this look. And she's like, and she wakes up.  Or she like stood there for five hours while her hair dried? I don't know which one, but both seem uncomfortable. And she woke up and she's like, all right, now it's time to take it out. Let's see what it looks like.  Ooh, slay mama. She gave us the full look at the end. I know it was enough to sell the idea to me. She was like, I was fully there for it. Fully vibing with her. I love it. And I'm sure in theory this could work.  She's like answering the door for her food. She's like going to get her coffee.  She like takes a nap.  Seems inconvenient, but it does work. Okay, now see, no. No, no, no, no.  I'm mad because there was not even a concept behind that one. Who was wearing their hair like that and when has that ever been a thing? You know, if you're gonna do like a fun five minute hack that like makes sort of no sense, like at least make there be a concept because that one made me mad. Like now I wanna, I wanna fight somebody. Come on, let's go. Not you, not you. Somebody that doesn't like me, I don't know. It's like, what even was that at the end? A part of me thought that that was gonna be a cute look.  Because it's kind of coming together and I love bandanas. But then the ending with the tuck, with the hair going out the front with the tuck, no. That's why I draw the f***ing line. That's where I end it. That's where I say no more. No can do, baby. No more of that.  Let's keep watching.  Banana. See, that one made me a little less pissed off because there was a concept, you know? It's like this girl's trying to curl her hair. What's she gonna do? She doesn't have a curling iron. She doesn't have a blow dryer. She doesn't have anything. And she has no access to a store to buy any of it. So she decides, I have a banana, I have a carrot, and we're gonna make do. And that's what I'd like. A resourceful woman is the kind of woman that I want as a friend. So I appreciate you. But then it's like, what the f***? You know how heavy that would be on your head?  It would immediately just blip, like just drop to the ground. Nevermind, put a f***ing curl in your hair.  And then they do it. And then she's like, what? It's kind of f***ed up. You know, because some of us want to curl hair with a carrot. I've actually curled hair with a carrot before it. Yeah, I am that person who does that. Hey, the classic dead end bangs. That's all the rage. The straggly f***ing stripped down, dead, not styled sh*** bangs. That is the vibe this season, if you didn't know. Have you seen the runway show? Have you seen the vibes? No, then you shouldn't be speaking. No, don't ever do this. Also, can we get the top view? Can we put the head down and see the top? Because I definitely 100% know. There has probably been stuck all around there. Like, it is not even wearable. It is not even remotely wearable. Just get some clip-on bangs. They cost like $5. You can just get some clip-on bangs. It's great, highly recommended, but this ain't gonna cut it, babes. It actually just aged you about 10 years. And it looks like you need a f***ing trim on those bangs. Oh, what? I thought at first they wanted to make it look like she had some kind of thing growing out of her head. Like, the first woman to have a head pregnancy is the vibes I thought were going for. But no, she just wanted the most flat, lifeless-looking braid possible. I never thought that people wanted that, but I don't know everything about people, you know? If this is your vibe, then I guess that's what you should go for.  That's all I have to say about that one. What the f***? Limpy, limpsters. Like, why? Imagine the front view of her hair, looking like one of those girls who just came out of volleyball practice. Or like La Crosse. Actually, any girl out of any kind of sport when their ponytail is just down, just hanging by one thread on their little scrunchie and their hair is just all over the place. God, it irks me so much, please. If you play sports and you're watching, can you just adjust your ponytail so it just stays in your head?  It actually seems more uncomfortable to have it, so whatever, that's a whole other topic. I don't even know how I got there. Let's move on. Honestly, a sleigh, that's a good idea. She should have cut more of a U out of the wig instead of like just cutting one strip so it fit her head better. That's a great little hack. Who would have thought I would find anything good in this video, but it's a f***ing U-part wig. It's the thing that exists. It's not like it's a hack, it's like an actual thing that exists. But they're very easy to put on your head and have it blend with your real hair.  The hair she was using was synthetic, so it did not blend, but like this could work and this is technically a hack. Five minute hacks, I'll give you that one. Call my therapist, tell them I need an urgent session because that wrecked me. Five minute crafts, you really know how to hit the spot, that really bad spot that puts me into a rage. Anger. If you wanna check out my hair at Carolina, or my hair at Colorline, you can do so with the links right down below or go to xmodohair.com. That is all for today. Thank you for watching. Don't forget to live your extra life and I'll see you next time. Bye.


Right, a very good evening to you guys. I hope you're having a fantastic Thursday. So far, welcome to YTFI for entertainment news. We happen every single Thursday. So if it's your first time, now we're about to catch you up on what has been happening in the world of entertainment. I'm talking about trending topics and you don't want to miss this one because it's fire. We have awesome stories for you and of course I don't do the show alone. I have my co-hosts, I call them my panelists rather.  Let's meet them. Starting right here. Bam, bam, bam, bam, bam, bam. I don't know for some certain reason, I'm so happy today. I don't know if it's because I'm looking fly and smelling good. But yeah, MCK in the building, as always. Boom, boom, shaka, shaka, boom. Right, moving on. Lady in green, what's up? Hi, hi, people. Long time no see, I've not been on screen for a while, but I'm back with a bang. My name is H.R.H. Janet Michaels on every social media platform. Right. I know you make our sets. Call me the only general of Fulimboko. I'm the only lady who can do anything. I'm a God spell artist. I can do anything I want. Thank you. All right, we got that. Juniel. Yes, Juniel, Biatora Giovanni, the Italian queen, Karibu Tenna for a energy-packed show today. Hey, it's lit, it's motto. Yes. Right, today is that day. So, guys, if you're watching, make sure you use the hashtag YTFF for updates to be able to contribute on various topics we'll be discussing today at the YTFF channel, that is on Twitter and on Facebook, YTFFTV. I'm at Fulimboko, you can call me Fulimboko, yes, and I'm at Fulimboko across all social media platforms. Last, all right. So right now, let's just jump into the first story we have right here. And we have social media is in our frenzy right now after a girl from Nakuru was allegedly infected with a deadly sexually transmitted virus. The long story first block on our confessions channel on Telegram ran by a blogger, Ekstion Della. According to the 20-year-old girl, she unwillingly had a threesome with a gospel artist, DK and Hope Kid. According to the girl, Hope Kid invited her after she made friends with him on social media, hoping he'd help her career in video modeling. However, DK and Hope Kid have both denied all the allocations. All right, guys. I know, I don't know what you're talking about, but I'll start with the gospel artist we have in the house. NCK right here, he's our very own superstar, and he is a gospel artist. What's going on?  What's going on? God bless you. Why are you guys laughing? You're mocking God. Steve, you're laughing the blessings. You don't laugh at such a thing. You receive it, yeah. So I don't want to criticize or say anything concerning the artist. They can talk for themselves. What I can say is I know them personally, they're friends of mine, we've done projects together. And personally, if they mean our job, they're good people. But things happen, because I don't know if that story is true or not. Well, they can't deny it. We must see it, but it's on social media. And this chick, they can't call it a screenshot, so we don't know. Yeah, so I'll talk both sides, if whether true or not true. If it's true, people fall, things happen. It's just unfortunate that it had to happen to them. But the thing here is, okay, if it's true, so that means he knowingly infected her with an STD that is incurable, because happens to have no cure. I would also like to point out something. This is a lady that willingly went to these guys, then later on, after I don't know a week or some days, went again to this other dude. So meaning is, if you put him on a phone, as soon as he's on the phone, he's going to call the police. So I'll explain. I'll explain. The first time of course, they used protection. Marappili, in the decade, so in short, and I said, man, like decade or... Yeah, that's what I'm saying. That's what I'm saying. You know, the online judgment is, the online judgment is because this guy is a popular person and all that. What we wanna for Baxana, is that he's a good guy. But he's not a good guy, he's a celebrity, he's not a good guy.  As much as what happened, karma is true, happened, he's not a good guy. But he's not a good guy, he's a straight villain. He does such a thing with two people. He's not such a clear person. And willingly, I repeat. Barone, flower, the next. Okay, me personally, I feel like the chick had a mistake. Kwanzaa, Kutokanakuru all the way. Okay, when she realized these guys were two, she had an option, Kutokanakuru. No, okay, here's what happened for those who don't know the story. So here's what happened. She came from Nakuru to meet Hope Kid. So when she meets Hope Kid, Hope Kid is the one who's in the car and the one who's in the car. And the one who's sitting in the room and the one who's in the car. The one who's in the car. The one who's sitting in the car. So Hope Kid is the one who's in the bedroom. He's the one who's in the car after while they were in the action. So after Hope Kid was done, that's when DK came in without her. Because she said, like, without her acknowledgement because she said she was crying at the time. Yeah? Yeah. But you see. Thank you. I did read it. I did read it. What them, first of all, they provoke this guy. They call Bras. Sitting room. You know, he's a human being. He's not married. He's not married. He's not in the bedroom. She's not married. I explained to him about that. Exactly, he's not married. He's not in the kitchen.  He's not in the kitchen. I'm not comfortable doing that. What do you want? You have to do that? I'm not going to this room. What?  He's not married. You don't have the simple dignity of a woman. Here's the thing, you forgot the part when she said she was offered wine.  That's another story. You know, she doesn't drink and they offered her alcohol.  I want you to be intoxicated. Thank you. For her, at least because I'll say I'll give you a wine. So, you don't know. Okay, start. Junal. I'm not going to give you a drink. I'm not going to give you a drink. Celebrities, I'm not going to give you a drink. Okay. What did you talk as a? What did you talk as? Mind you, these are gospel artists, by the way. So these are gospel artists, Junal. But the thing is, allegedly, it's not been confirmed whether they did it or not. So, it's allegedly. Okay, Zunel. It's very sad, very unfortunate that celebrities can be involved in such a thing. You are limited. Only to find DK in your Naspin Gari. Then, while he was in DK, an arrangement initially, before he was taken to Kuru, was when he was hoping to go home. While he was in DK, it's not like he's a fan. You haven't even given consent for the same.  She said to him, she cleaned up herself. And she was hoping to go home. They are getting it on. So, DK, what's DK?  Hope you'd come or wherever you are, I'd answer. That man was very arrogant. I'm sorry to say, while he was listening to your conversation, he didn't sound like he's a fan. He was like, whatever. Yeah, I don't care. Hope you'd try guilt and cool. And he was like, I don't care. It's very sad. But girls out there, please, don't let desperation make it without following the correct path. Anyway, so here, the point is, guys, young girls especially, 19 to 21, 19 to 21. Don't get excited with celebrities, by the way. This is a good advice to girls, stay in school, and if you're in college, they're not going to take you anywhere. Just chill, do your thing. Just finish school. No. What you're going to make it, you'll make it. If you're going to make it, you'll make it. I'm going to make it. I'm saying, I'm going to make it. First of all, I'm sure, she was raised in a Christian family. But I just hope it's a gospel artist. So obviously, I'm going to make impact. So I hope that's what she said. But she's young. I'm just thinking. But she's young. She's very young, she's 20. But the bad thing about this, one thing we need to address is that she's suicidal. So I'm going to try to help her. By the way, she's been catching herself, and we don't advocate for that. And you saw what DK said in the reply. You do whatever you want. Yeah. Apparently, she's very young. I don't like it. I'm just a woman. Yeah, because if she kills herself because of something you did to her, it's not fair. So at least she has a good family they've been taking care of her. Allegedly, still. Right, so let's move on to another story. Where a Gambian born no-lude actress, Princess, okay, Shingal, that's her name. So a Gambian born now, the actress Princess Shingal her crazy hourglass figure but recently after being trolled for being fake she went on to post how she removed she removed rather five ribs to achieve her hourglass figure which she calls it the work of art right so that is princess princess okay her name is a bit hard shingol that's princess shingol so ribs gone god forbid no celebrities actually do that in the states people do that all the time doctor small interest times She is a condition her eyes are not okay okay so the point is like uh what's going on with guys let me like why do you have is in this extreme like uh why are we altering ourselves but i don't think she did okay maybe she did the right thing according to her but it i'm letting side effects because i i'm imagining how you're getting pregnant like this which of the bads because i'm sure it could have led to a very easy expion to some extent yeah according to her i'll say my like she regrets how she looks right now no because it's bad like she loves her body and everything but attention and she actually said being hot and pretty is hard like like it's very hard to be pretty but they still do these things you know but me it actually pays the bills if you look like that and the attention is too much me when god gave you all those ribs it will never go back and then the territory yet it has a place we never know everything which is so the moment you remove one but it's still altering your body so ladies I love you you know this is trending this is what is trending right now if you want to say thick if you want to see what we're going to give you to skinny santa size he's generation equal 2019 I think he's in my yo yo yo you say he's as easy as he said he won't come as easy what you want to end up could you could you care but i'm gonna go back to that in the portals yes You know, I have a flat neck and a potholes I have a big punch and a gut and a toe Alright guys, alright, so we want to know that story where? Right now, this is a bit serious actually so, Empire Fox TV drama series actor Ejussi Smollett was allegedly attacked and beaten up by two unknown men who called him out for being gay and black Chicago police detectives continue to investigate crime that took place in the downtown area Tuesday morning around 2 a.m. Subbed Alright, so we all know Ejussi, we call him Jamal from Empire So, he's gay, right?   It's not a good thing I really, okay Blacks are being discriminated over there But for being gay Blacks actually are the number of most white people who are gay So, I think there's a deeper thing to your fights It's not just like the guy is just gay and everything I think there's just a deeper something to whatever happened No, speak it out MCK Help other youths outside there They're dying See?  Oh, my goodness! Oh, my goodness! One meeting after another. I'll give him one meeting. I have one meeting before he dies. Oh, my goodness! Anyway, this guy is blessed. He has enough problems already but he didn't deserve to get your beating early. Especially for the fact that he's black. It's not fair. Well, where he's into a debate So, it's quite unfortunate. Another question I can ask. This people have money. He should be driving around. The thing is, it was 2 AM. So, yeah. There's a lot of paparazzi everywhere. So, you know, the best time. 2 AM. So, let's move on to our next story, where Kenyon rapper STL Stella Moanghi So, let's move on to our next story where Kenyan rapper STL Stella Mwangi has just lined with a gig in though in The cooking show brings together various Norwegian public figures and public figures Rap Queen STL aka Stella Mwangi is joined on the show by public persona like Wanda Mashandi among others There we have it guys, STL, STL is also putting us on the map She put us on the map She is black and she is making it happen in another country She is a big star over there So, let's see if she can make a TV show or a cooking TV show in another country If she can make a TV show, she is like among them in Kenya So, are we excited? But who are they going to push? Who are they going to push? Some of them are Menda Indians and they are going to push Who are they going to push? And she deserves it Personally, I like her, she is a good artist But it's a nice thing on her side, I think she is trying something new Because making it outside there musically is not exactly Exactly, but the fact that she is on TV, it's like normal rotation You know, she is more familiarised to people over there So, putting out her product and her music and whatever she is doing, it's going to be easy You know, like personally, even if I work with her every time It's easy for people to familiarise with me I don't want her to trust it It's easier So, it's good on her side Congratulations to her All right So, it's an edit Yes, yes I also admire Hazil She is black, she is making us proud I am so happy about it, by the way Oh, awesome How are you?  Yes, I do You pick up your kids?  Yeah, from next week, it's actually happening. Okay, I'm proud of her. She's really come a long way and like MCK said, she pushes. She's a hard worker. She doesn't quit. As a farmer, she's a woman. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Yes. Can I just give her an email? Yes. Yes. And one day, she went to you're branding yourself. That is the opinion of Hafulu Imboko, another opinion of Y-254. We love to distance ourselves from that opinion. All right, so let's move on now to another story. Now the plight of Lydia Achain who is locked up at Langata Women's Prison was brought to light in an interview recently conducted by a popular local TV station prompting the intervention of the DPP. According to Lydia, she has been in jail for 10 years for a mistake she never committed and without substantial evidence. Achain broke down narrating her story adding that she had forgiven her accuser but she's in so much pain given that all her youth was wasted away in prison. All right, we've all seen this story, right? I've seen it since Monday in news, but it's actually sad and this speaks a lot about our judiciary. Right? And when we're talking about the judiciary, I think that last week, there's serious reforms. One has said, well, I'm not doing the finance, I'm not doing the resources and everything, but if there's not enough evidence, then we'll have to go back to the evidence.  It takes time. So she always used to say, oh, because she said their accuser actually came after one year actually that's not true and she would love to withdraw the case. But they refused, they said like it doesn't work like that. Exactly. Back to the same point, judiciary needs a lot of reforms. It needs to be structured in judiciary, you know? So, in short, I think it's a big cause. A lot of people, like a very big percentage, like 20%, I say, when it comes to the issue, it's not legitimate. So when I come to you for more than five years, bad evidence, like by the time you're five years old, you're like, okay, come on, let the guys just go. Right. Yes. I saw the clip, it's very sad, and the judiciary system is rotten to the core. I have no apologies to make. Very sad. Then also for the DPP to come out and say that this lady is lying.  Reason being, this girl, I'm a Baksha, two months at OK. You don't have anything to lose at this point. So I also think that judiciary should look into the same really. Yes. It's very sad. Again. Yeah. Yeah. Yes. Yes. I know, right? I'm not sure. I find it much better actually touched most people, including me. Yes. Yeah. It's very sad. Again. I'm sorry. Yes. Yes. Yes. Yes. Yes. Yes. I know. Yes. Yes. Yes. in life. Yes, true. Yeah, that's true because she had her own business. All right, so let's move on to our last story because of time we're actually running out of time. This is interesting. It has to do with Mishi Dora. We all know Mishi Dora, right? Now, controversial Kenyan reality star Mishi Dora debuted her acting career in an upcoming Nolywood movie named Naked Covenant. The Nairobi Diary star shared the photos on her Instagram account posting with her producers and other actors as her followers wished her well. So, we know Mishi Dora from Nairobi. Diaries, scandals, scandals, scandals. But finally, the fame has landed her a role in a Nigerian movie. Are we excited for her? Yeah, that's right. I'm the one who's going to say my name. Okay, Jeanette Passova the mic. I'm going to call the number. It's in the sheet. What is the name of the movie? It's called Fala. It's the name of the movie. It's the name of the movie. I'm not talking about this. I'm talking about celebrities. Kenyan is a famous actor. He's an Algerian. somebody. You're not happy. I'm not happy. Why? Well, finally Melipa. Yes, to each his own lady like I'm a smile on her, but to other girls, may you work hard, achieve for the best, respect the process, be patient. You never know. Wow. Okay, me personally, I'm a pass through the right channels, then I wish her well, no biggie. Yeah, yeah, but so like through what are the right channels, my friends, right steps, what are the right channels? Not about Spone, you don't say about Spone. Legit. What you guys don't know, right channel is what I'm saying. But she was posting with Michael Zerone, when he was in Kenya, I don't know. I never watched that. But I used to hear about her. People don't even know what you do. It means there's something you're doing right.  Because actually, they have their film industry is actually really big. Yeah, so she's actually representing us over there. So we should be happy. We are happy. All right. We are almost done. Okay. Well, it's been real. Guys, I wish you a nice weekend because the weekend, the week is coming to an end. And as for Lydia Cheng, I wish you all the best. May God intervene for you. And the government, please, judiciary, honestly. Us as poor Kenyans, judiciary, people look and fight for you. But remember, she's still alleging. It's not been proved that whatever she's saying is true. Maybe also it's not true. In the end that it's true. Otherwise, follow me on social media platforms. Let's do this next week. Awesome. How for you? 30 seconds. Call me the only general of Fuluimboko. Hey. Social media platform of Fuluimboko. Instagram of Fuluimboko. My friend. My friend. Considering. Anyway, it's been great being with you guys. I'm so happy to meet you this year. And about the Lydia Cheng's case. I just wish her well. That story is very sad. Yeah. Thank you. I am HRH Janet Michaels on every social media platform. Awesome. For those joining us today. As a gospel artist, what do you love to tell Kenyans? Yes, that's what I want to say. See you in the next. How do you do that?  Yeah, we're winding up. I just want to tell you what I've been trending since yesterday about one. I think it's a way of God telling us maybe in the gospel industry. Like we need prayers. There's something that has to be done. And it has happened so much. God is angry. Let's reform. And the last thing. Young girls, young people. Whether dudes or chilies or anything. Please stick in school. Know your vision. Work towards it. It takes a lot of time. And I'm still heading somewhere. So just to work hard. Know what you want to do and focus there. It takes a lot of time. And I'm still heading somewhere. So just to work hard. Know what you want to do and focus there. This story is exciting. Because somebody's done do that. Be straight. Thank you. Thank you guys at home for watching this show. We appreciate you. We hope that you have had a good day. Viewers. So thank you. Thank you, fui. Thank you. Thank you. I'm so excited. I'm so excited. Thank you. Thank you. I'm so excited. Thank you. I'm so excited. Thank you. and we'll be glad to share them. All right, we'll see you then, bye.


They will they're gonna do the swap here. So, well, no Hey everyone welcome, I'm Morgan family burger and ptl of Keystone You guys probably saw the keynotes while you're here. I hope You're planning on seeing some other session. You might be in the wrong room. I can't help you there Today, I'm here You know I'm here Jesse long We're gonna do a quick rundown on the technical piece of technical hurdles and everything we ran into for putting together what you saw on stage this morning I'm gonna ramble a little bit here about what what the crazy idea was and how we got here and Then I'm gonna hand it off to Jesse and Guang to talk about that And then we will cover the rough edges and hopefully leave plenty of time for lots and lots of Q&A Because that's probably why a lot of you are here figure out how you can actually make something like this work for yourself So Keystone to Keystone Federation. It's the core of what we have It's where as we described you have a token from your local Keystone you ask for a SAML assertion let's use standards and You then move on you then get your use that SAML assertion to authenticate to the remote service provider And then it works the same as Everywhere else you use OpenStack. Everything looks Pretty much the same So we really had this crazy idea but as you can see You know trying to diagram out how all that stuff works. Well the long the short of it is You end up with a token that's not from the cloud that you started from The crazy idea came to came to mind that we'd love to see a real-world case where Keystone to Keystone Federation solved actual problems that Come that companies have how do I do rapid add of resources? How do I? rapid how do I handle The case where I need a provider in a geographic location that I don't have a data center it's Just it's difficult to it's difficult to do with current with the current open world of state of the art of OpenStack and say Juneau Because you have to find either a provider and then you have to write a whole bunch of glue code to get you into The remote cloud you need to figure out. Oh, I need passwords for each cloud. I need to either use Ansible or Puppet or a whole lot of other things After we sat down and said well, we have this cool thing called that we're calling Keystone Keystone Federation identity Federation We looked around said what industries really do run into this problem television and film clearly have this have these problems live in this world and Clearly it makes a difference to be able to turn on and turn off Extra resources when you're into like pilot season because that's a scary amount of extra work to do I know trying to get meetings with you as a challenge So I really only have one one additional question here And I think that it's a really important one to cover get you know, why are you? Why did you pick open stack versus some of the other to some of the other like options out there?  Okay. Sure. Sure. Yeah, but what's the why open stack because you did you know use open stack on top of Amazon? Why? Why did I choose open stack? Choosing a cloud solution is sort of like a marriage It's like a relationship and and you try to find a common interest that you both have and For us it was it was being open and it was about about being able to get away from sort of the proprietary infrastructure that Media and entertainment has been stuck in for a long time and and to some degree when we first got involved with open stack Three and a half years ago. It was the promise of federated identity even back them It was the promise of of being able to scale out instantly and and migrate across Providers and not necessarily really locked into one provider or another for for a multitude of reasons So that's why we chose open stack Cool. So I'm gonna now turn us over to Jesse so he can talk about Hosted private cloud and the awesome stuff that blue box did to make this happen Right. So blue box. We are hosted private clouds. Every one of our clients gets their own entire cloud So in this case Yom and digital film tree got their entire cloud to themselves But I think we had maybe the easiest time out of everybody in setting this up because we give them their own cloud We didn't have to implement it on an area that had other people on it All we had to do is stand up the cloud set up the relationship and give them the access and off they went but let's talk a little bit about what was Specifically different in a blue box environment so our clouds One of the options we have with our clouds is hyperconvergence where we're running our Control and our compute in the same place and we're running some of our services a lot of our control services in the same place and We're also terminating SSL with hop proxy and we're doing active active load balancing with hop proxy as well so what that means is our services like Keystone aren't necessarily directly listening for external communication all that's bouncing through hop proxy and That also means that they're running on the same host as some of the other services and what that meant as a challenge Is that the Keystone as a service provider is designed around running behind Apache? And we weren't really running behind Apache for for Keystone at that point. We were running Horizon behind Apache and that was one thing but trying to introduce Keystone behind Apache on the same host that horizon was running behind Apache was somewhat entertaining Particularly because we implement our software installs as virtual environments You we want horizon to exist entirely within its own virtual environment We want Keystone to exist entirely within its own virtual environment Apache WS GI It doesn't really like that idea of running multiple processes in different virtual environments So in this particular case we had to allow Apache to share the Python path of both virtual environments and you were pretty lucky that That the services didn't have too wild of conflicting ideas about what they wanted in their environments And so it worked out pretty well Some of the other challenges were had to do with with HTTPS termination SAML is wants to have The HTTPS come all the way through to Apache and we weren't doing that We were terminating that the SSL at hop proxy before sending it on to Apache So there's a few tweaks we had to make in hop proxy in order to pass all the right things along for SAML to accept what it was getting and a few tweaks on the SAML side as well so that it was Getting it was expecting what it's going to get out of out of hop proxy Yeah, some of those were pretty much just documentation tweaks some of those We were already discussed out in the community. We just had to find them and implement them But that was that was pretty much it. I Think that's Yep Testing Yeah, so We have a little bit of a hard time. So Jesse have an easy time. We have a hard time getting the stuff to work in public cloud Primarily because we are multi-tenant clouds. So that's what means is that we you know share hardwares and you know things like that So we have a lot more requirement to get up and running then just spun off in a separate instance So first of all HP public clouds. So like I said, we have multi-tenant cloud and We have MongoDB back ends which have two regions. So we have East and West and then We have a Mongo web cassette which Running on those two regions and then we have our own mongo drivers. So which means that we are running Keystone From upstream, but we have our own mongo driver back ends and we also run our stuff in Apache So we've been running Apache. So lucky for us unlike Bluebox We've been running Apache since day one when we have Keystone up in public cloud So that's that part is much easier. And then of course it requires a shiplit So that's part of the requirement for Keystone's Keystone Federation. I think that's part of requirement for Keystone's a service provider type of Federation as well And like I said, we are tracking kilo. So what's running in public cloud right now? It's pretty much based on kilo So before we can run this stuff in public cloud So when we deploy a new feature in public cloud, so we have to go through a whole bunch of crap I think one of them is security review, right? So our security You know team got to ask this question. So the base on there, you know threat modeling on this strike modeling like You know things like spoofing tampering and all that stuff, right? So to ask questions like, you know, hey if the identity provider Get compromised, you know What happened, right? So if somebody say intercepts a Semal assertion can the guy replay over and over and get tokens If we don't protect the communication link, you know, what happened and how do we set up trust? You know all these kind of stuff So they asked us a bunch of questions as turns out there was a bug that was pretty critical that we fixed Which is 104 2916 Be like Adam, you know That bug is that we basically had to you know without that fix we would have to turn off signature validation which Which is that good So we basically had insecure SAML assertions like a non validated SAML assertions. Yes So yeah, so we had to fix this bug before we can make it into production That bugs had to do with you know, the way we treat namespace in in XML So if you know the way we do, you know, we sign the the samples that we use this to call XML SCC one and We sign the stuff and then we basically bundle that up and then when we on the other side when we validate that Turns out, you know with XML library if you don't explicitly namespace this stuff We just assign you an arbitrary namespace and that basically invalidated the signature so we have to fix that bug and Also, unlike private cloud with with the with the public cloud we you know identity data is Tied to accounting. All right, so when this keystone keystone Federation feature first Introduced it was based on this Greek identities. So which means is that you can map an identity to a group, right? So that identity doesn't necessarily need to exist in the in the service provider But with public cloud that's that's different because we need To be able to map an identity to an account so we can meter on that identity and be able to build the guy right on the usage You know things like that. So luckily, you know We got some help from from American I CERN basically You know introduce this map to a direct identity feature Which we can take advantage of Yeah, yeah, absolutely So, you know like Jesse touch on earlier So we have to make network changes like we know we have a load balancer. So we have to make it So that the session sticks, right? So we have session affinity and then we also have to make sure we preserve the request URL turns out Shiplet has they validate this binding.  So we have to make some, you know network changes to make sure we preserve the request URL and Identity management for public cloud is a little bit Involved because it involves right now when you create a new identity is a both configuration and administration changes So the lines basically blur between configuration administration and administration to me is just API, right? Configuration it requires a bunch of stuff like, you know, you know, you write chef recipes and public whatever So for us to deploy this feature we have to you know, write bunch of chef recipes Create the data bags to push the the the meta XML file that contains the The public key for for to validate the signatures and Also administration for us, you know Right now if you want to create a new identity provider create a new map Those have to be done with someone with L3 support privilege and above and those API has to be Audited right so it means nobody can just go in and mess with the map. What do you mean by L3 support? So what is L3? L3 is basically guys like us The guys that know deep into the code and all that good stuff Yeah Yeah, so, you know when you yeah, so when you have problem with HP public cloud you pick up the phone, you know someone You know probably L1 L2 guy would pick up the phone and they'll try to troubleshoot it And they can't do it. They call up the L3 guys and you know, so we go and then and then Look at a log and all that but even looking at the log itself or because we have to deal with compliance We can't just log into the box and we have to request permissions and all keystrokes are logged, you know, that's all that good stuff So all the changes are fully audited so you can't just change the map because you know One of the dangerous thing in in Federation keystone keys keystone federations If you don't have the map set up correctly, you could you know accidentally map to a different account, you know Which you can get some freebies from those accounts So we have to make sure those are correct Yeah, also for public cloud whenever we deploy a new feature in the public cloud We have to make sure you know everything still works correctly, you know make sure our performance is good and basically Simpli is a different process that we introduce. We have to make sure we monitoring that process You know make sure if we you know doesn't chew up a whole lot of resource in a note We have to make sure our regression test is still look good and you know rate limiting Documentations and support runbook, you know the whole bunch of stuff that we have to do before we can introduce a new feature in the into a public cloud so runbook is something like you know if shiplet, you know You know decided to a tandem, you know, what what what can I support guys do right? So we go reboot it or so, you know, how do we safely reboot that box things like that? So we have to document those So that's pretty much What we did so You know, there's a lot of there are a lot of rough edges on identity Federation Let we'll be up front and say that The really cool thing is that they're just they're just rough and easy polished. We have a lot of wish list items We would really like to fix before You know we tell the Pearson who's just getting into open stack and just barely scratching the surface That it's really easy to do this. Well, it wasn't really easy to do this It's quite doable and none of the rough edges prevent this from being a reality and that's the really cool part But you know, let's be fair We're not really chasing down a rabbit hole here It's the Cheshire cat that's gonna come after us But here are all the things that no one really would tell you about unless you happen to have done a project like this And I'm gonna let Jesse and Gwang go over the variety of wish list items and rough edges So doing our senior VP keynote so people say, you know, he wants to be able to run a open stack without a PhD degree So this is PhD education right So so some of these basically That we can do to make it better things like I said, you know earlier we have this You know the fine line between configuration and administration, right? So right now to be able to deploy Keystone keys to Keystone Federation is both so Ideally we want this to be a purely administrative function Which means that whenever we need to create an IDP we should be do that all through API's create IDP Create the protocol create a mapping all down to API's and any things would just work, right? So this is a similar would similar to how you know, where we moving toward in the per Domain specific driver configurations. So we need to store these IDP data into into sequel backend Yeah from our point of view on this one it meant that All of our configuration is driven by Ansible playbooks And we have published Ansible roles that are all open source But in order to implement this type of feature we had to start leaking not leaking, but we had to start faking customer data into the public Playbooks that would get filled in later by site specific configuration But we had to couch it in a way that you could have one Provider you could have ten providers We have to be able to loop over them and have a bunch of stub things in there that if you actually ran it without Providing a real provider you could get some things on your file system that you might not want and your keystone may not work So we'd really really like to see that Site specific that customer specific type of stuff stay out of the system configuration instead be data that goes into the database Once it's all set up, right? Yeah, and then death the other thing for us Which you know is like whatever we make configuration changes our security team team get freaked out Right so which means that you know say hey, what what do you change and so we have to explain to them You know what what configuration changes are and you know, how does that impact security and So so that's you know, we have to go through all internal reviews and internal audits and so that's that's not fun Okay, so second, you know because of this Shiplet You know This this binding validation in in shiplet what we found out is you know shiplet I'm not sure you guys familiar with that. So it has this XML policy that you can set up on, you know, how to validate the You know the IDPs and how to validate the signatures and all that and one of them is validate the binding Which is you know according to that documentation It can't be done through policies But what we found out is it's not the case because the policy validation happened Prior to the binding validation, which means is that it's hard-coded So so we would we don't have a whole lot of choice, but to you know to It's just like endpoint binding right let's let's say you sign a Samo, let's say I will sign something for you Exactly for the particular endpoint and that's that endpoint is part of signature So doing that validation if your endpoint does not match to request URL you got a signature in about in ballot So if if we were to do a cloud with multiple regions that some of our customers may want that means that we have to create Relationships between each region and the service or the identity provider rather than having one to a complete vendor That we could assert multiples in Right So yeah, so so we are looking at some other alternatives I mean the second point is basically you know when it like I think I touch on that part earlier Is that when you put a new service in there, you know all kinds of stuff have to happen We need to monitor it, you know We want to make sure you know our performance is still good and then we make sure it's footprint And you know it's it's still within you know our tolerance level and make sure it's you know Available on the platforms that that we support right and so that's you know Introduce a new service on the service looks pretty simple, but you know for us it's quite a bit of work From our side I mean from the public cloud side the the customers of public cloud aren't necessarily seeing what the infrastructure to run the public cloud costs So if they needed more to run Shibboleth on their keystones They might be able to launch more keystones or make bigger keystones on our customers They get the entire stack and their capacity of their stack as it is a little bit of it's eaten up by the control services We run so the more control services be run the less Capacity the customer has for the stack so that's a value proposition where if we introduce this service They now get less cloud for their money, and that's a big concern for us Okay, so yeah, so this is mostly my complaint is that IDP should be owned by domain right because Yeah, so because you know for us self-service is very important So because when you sign up with a public cloud it's people of cloud we create your domain You are the master of your own domain You can you know you have all in this your own administrative domain By that you should be able to say hey, you know my users You know for cloud bursting myself things say hey my use my users manage in my own private cloud I should be able to you know hook up that through You know through through through the Federation So right now you can't do it right now you if you sign up in HP You want your own IDP you would have pretty much have to call call up our support and we'll file take it and we'll basically have to You know Okay, that's that's the second point right here mapping right now. We only validate the syntax We don't validate the content which means is that you know I? Can I can set a map that map to somebody else's domain right so there's no way no easy way for me to validate that today was The question was is the endpoint validation a reason that you have a hard time federating to somebody you to into a provider that You know arbitrary, but the user are really what's yours? Yeah tequistus No that that the endpoint validation piece. That's just a it's a configuration It's a piece of configuration comes along with how you run shibboleth and how it validates It's just the nature of a SAML assertion. It has to be targeted at the endpoint What's the problem here is that we don't we're right now? We don't have a way of we validate that syntax of the map the mapping is the bundle of attributes in sample in the SAML Assertion to something useful to Keystone We validate that the syntax of that mapping. It's a declarative It's a declarative of like a DSL type thing that we wrote specifically for this this set of the set of tools, but It doesn't validate what the result would be we don't have Given this assertion. What am I going to get the other end at the moment? You you have to have a lot of eyes looking at and try things Yeah, that's it could map to something completely wrong But for the most but but we can guarantee the syntax is right, which is again. It's a rough edge It doesn't mean that you're never that you can't use it It's we should fix we should make this better Yeah The the safe error is that you map to identities that don't exist and the bad error is the map to identities That do exist that aren't yours and now you're able to you're now able able to either Create instances under their account and charge them or worse read their instances and get access to their content Which is never a good thing Yeah, so so this one, you know, you know just put it here But I mean to be fair right right now if you know this You know pre-existing relationship between IDP and SP's through a you know metafile But if an account has been suspended at the IDP, how does the SP know to you know to invalidate that token, right? Yeah There's no revocation, yeah Yeah, so you wanted to have a real-time revocation you would have to build some workflow on top of that So, you know just like the way we have the same problem with LDAP today So if somebody Some user status change in LDAP, you know keys don't know about it Yeah, so The last thing is that key, you know identity Federation is good, right? I mean we solve a lot of a lot of issues with that But the next step what's the next step, right? I mean how do we how we do this complete solution of cloud Federation? I mean, how do we have a global catalog? How do we discover resource and how do we make these workflow process more smoother? I think that's that's something that it's That we'll need to take a take a look at yeah for the demo. I mean, it's it's really we On the blue box side because everybody's a full admin on the cloud All we really had to do is give them map DFT into an admin user and they could create the flavors as they want they can create the networks So they want to create the images that they want that's much harder to do in a public cloud environment But what what we really want is for Digital film tree to be able to do that within their domain so that all they have to do is a stab all the providers have to do is Establish that relationship and then step away and they the the identity provider the source of that information can push All that they want for all those configurable tweakable things push that from their central place out to the endpoints And then everything looks the same to them. It's a it's a happy accident. They're not happy acts but it's a result of some process that it works well In the in the demo, but in reality it would be a much better story to push Yeah So that's so a couple of things from our end the tooling for the service provider It's it's pretty rough right now There there are a few things where you have to copy and paste in Python code and poke at the keystone v3 API directly in order to get some of the mapping in the configuration done Which is difficult to to administrate difficult to automate It's it's not something we want to carry forward into a production environment Also, it involves XML written to a file system and nobody likes that And then we're we would like to see better visibility into the federated usage in our in in the public cloud's case They're mapped to an actual user that exists and that user is getting tracked for all the usage in the blue box side There is no user. There's just a Project and there's just roles or groups within that project But as they were using the cloud we couldn't really see that they were using the cloud and that from from a Showback or from a tracking that are they are they capable of using it? You know, that's not visible to us and we'd really like to see that and before we take it into production as well Yeah, I think I think the IBM folks have a nice demo on horizon side and how to use it You know keystone keystone Federation earlier, so I think that those patches may land pretty soon awesome so With with federated identity we we are a we are able to build federations and we've been doing that for Probably something like 10 years now And and the typical use case is you give access to a resource That to someone that doesn't own the resource We have several federations we can do the same with open ID connect so my question is can can you talk to the relative merits of Doing keystone to keystone federation as opposed to doing it on top of open stack and consider the different open stack Deployments as as separate Relying parties that you can give other people access to Let me think about that for a second I'll throw something out here, so The reason why you might want to do keystone to keystone is particular is specific to Bursting from one cloud to another so keystone has the flexibility that you can back end it with your own Internal identity provider you can back in with LDAP. That's that's your controls. You have everything like that so you've already got this this Your local keystone your local cloud backing into your identity pool What you don't want to do is try and create a connection between Somebody else's cloud somebody else's administrating into your identity source That's not a relationship that you want what you want to be able to do is take your keystone that you're configuring let it Talk to another keystone the other side doesn't have any access to your stuff So it's keystone talking to keystone. It's a it's a communication protocol that they can understand that and as clouds move you you have the API version compatibility going on The HP cloud was it was kilo we were Juno Digital film tree what was it was kilo and it didn't matter because the the protocols were set up in a way that they were able to Talk to each other correctly, so it's it's really about a matter of compatibility And there's a second use case that's very related what happens is you have a You have digital film tree and they have a variety of people who are consuming a service and they each of those each of those Consumers have their own identity provider. Well, do you do you really want to in this case have to have you know 15 identity for 15 people 15 different organizations set up the mapping that the the trust relationship between now HP And then you change and you add blue box now. We have to set up 15 more times. It's really about Making it a little bit a little bit easier a little bit better experience or On the flip side of it making it a little bit more opaque when you don't want that to be visible Yeah, I would say yeah just to add to that. Yeah, I mean we were we're a Service that has clients that is then a client of other services. So so yeah the the How transparent you want that to be or how opaque you want that to be is is key to how we do business So yeah, I would support that absolutely Okay, I'm I have a Few questions and comments. I will first start with the comment you said that you were thinking of different way to integrate with SAML 2 and Maybe you search for a simple SAML PHP. I don't know if you know this product, but it's developed by the R&E community Okay, so that wasn't Okay, so my question It's worth bringing up. Thank you. It's good to know it's good to know it And we will keep a look on any of those options because maybe something will be better mod-off melon is one of the ones Yeah, lots of options Okay, the the question I had was with Shiblett For the moment, I'm not specialist in terms of Federation, but my colleague is and and he Basically said that those there will the Shiblett version 2 if I recall correctly will be end of support And it's been extended a few days ago or something like that to 12 additional months But what what is the plan in the future? So you saw us mention us. I wasn't even standing up there. I'm Adam Young work for Red Hat and I'm Keystone core When we were evaluating the different ways of implementing Shiblett There were a couple things that stuck out and the biggest one for my opinion was the fact that I had to do something Different on the client side than on the server side and there's a library out there called lasso That we could use on both sides and mod melon is in a patchy module that does that now mod melon also Does not require spooling out to another service to do the Shiblett stuff So I really like the idea of mod melon Last so and then that being the the groundwork of our strategy there So I think it's going to be something along those lines having said that and on the on that note A lot of what we're tied to in Shiblett is tied to the patchy modules that are available in distributions once the distribution moves to the New stuff that the later versions that are that aren't near end of life We will obviously be moving with them and making sure we support a lot of it was This was developed on trustee trustee has very specific Acquirements and same thing you know and and support of sentos and rel I mean, there's just specific versions that are out there and of a distribution for lock We're locked to really what the distributions have in this case because it's outside of open stack It is a service that is available via the distributions long term Of course we will move So a quick question and maybe you get maybe this is a bigger question if I have If I have multi-region and so let's say I have three Separate open-stack installs. Have you guys ever considered like the ability to confederate within an identity? So if I want to establish a trust relationship between say partner a my organization I've got three different installs I confederate have one relationship initially and those other installs are are basically already associated with One of the keystone boxes as opposed to if I have you know eight different sites And then I'm setting up point-to-point or separate federations with each of those organizations Yeah, I mean you should be able to do that with multiple regions because I mean it depends on how you set up the Providers you can have a chain of providers Configure in in shipments. Remember what you said about a mapping to an existing identity once you have that mapping setup once You can map multiple federations to that same identity come in by different maps, right to the same identity and do a single identity Okay, you can do it. You don't have to do it So a question with with with regards to how keystone and Amazon kind of could confederate I mean have you guys considered? exposing identity from keystone to Amazon and I don't know if it even makes sense But but what about vice versa, right? I mean could you take I am identities from Amazon and make that available on an open stack Right, we have considered making keystone a full-fledged IDP Let's we have we chose to avoid doing so or both simplicity sake and that we weren't sure that was the right choice There are many many extra things to come along with making keystone a full-fledged IDP It theoretically you could probably do it today. It would be a little stubby and it has some limitations It's not off the table. We're definitely open to considering these types of things Please come to maybe one of the one of the work sessions and talk with the keystone development team and explain You know and help us understanding the your specific use case in that for that and we'll consider it. I mean with the right amount with the right type of demand the Clear benefits will work that and in reverse You know as you said with the I am It same kind of thing. It's help us understand the use cases help us understand What the clear benefits are and we're not going to say no to that should be a different just another federation thing I think it's one that we should deliberately deliberately look at but I don't know what I am exposes as far as Federation protocols if it did sammel then we could potentially make it work right now We'd have to see what what the modules are if it's not sammel and how what the path would be to do that But mostly it's a lot of it like oh, I use using oidc or sammel really at that point It's a configuration and using the right module in Apache to give the attributes out Okay, it's a more Technical question about how to get things you said that you mapped an IDP to a single account for the HP public cloud And I would like to understand. How did you plan to do their role-based access control? are all our members of an IDP Only members for the for a single account or do you have different roles like for example an administrator and sub roles or something like that? Yes, did you plan? Yeah, we have those in tree clouds. So when you sign up with a tree cloud We created a domain for you So you basically have your own administrative domain and then you can create domain specific roles So so you know you can Assign roles to to the to the users in your own domain But that's different from from federation because once once Federation is about how do you you know establish a trust and once you just establish a trust You basically fall into the service providers administrative domain So you can set up the map says hey, I want to map it to the user and then the user can you know What about access that user have is totally controlled by the service provider, right? well, yeah The service per the identity provider will push down to you what the user is and then on the service provider side That's where the mapping comes in of these particular users map into this role or these You can define groups or you can define Rejects is for how you want to map the user identity that's coming in into what rights they have on the cloud itself And that's a service provider level configuration The service provider is authoritative for author for the authorization decisions that's that that comes from service provider No, but that's Can we have time for one more question Steve the floor recognizes the gentleman from IBM You're really gonna let Steve ask a question This is totally your go ahead I Just wanted to know a little bit more about How HP public cloud is deploying keystone under Apache and with the modules With that like modshib and stuff like that, right? So we basically Deploy Yeah, with with Apache with the shiplit and with my shiplit What do you mean? Oh, we have our own ship recipes that we basically we basically created the data bags for the The meta XML file for example, and we have recipes for the for the configuration file changes Yeah, I hope so Well, thank you very much. I think we're at the end here appreciate you coming and There is I'm we got one more one quick thing There's a white paper and I'm gonna hand this off so that you can get word the address Hi, there's a white paper with them It's pretty high level of about the background of the technologies used in the camera to couch demo It's on open stack org slash enterprise under workload portability. Thank you


OK, so welcome back from lunch, everyone. Hope you had an enjoyable lunch and an interesting set of clinics in the morning. For this set of keynote talks, the first talk is going to be given by Johannes Westering from the University of Notre Dame on the evolution of process and scale coupling coastal ocean hydrodynamic modeling. First off, thanks for the invitation. And I guess what I'd like to do is give our take on model integration model coupling and some of the things that might be helpful as we pave a path forward in this very rapidly moving business. So my co-authors, Rick Ludick and Clint Dawson are the original developers of the AdCerque Coastal Hydrodynamic Model. So the processes that we're interested in are predominantly the actual hydrodynamics of the coastal ocean, all the way from the outer continental shelf to the estuarine systems, the river systems, and the adjacent coastal flood plain. Obviously, the morphology is tremendously important, but we don't directly model its evolution. We do take into account, obviously, through data ingestion, as well as the ecology. It's important, too. But we're really looking at the rich scales of the hydrodynamics. So looking at the processes of the ocean, it's incredibly rich in processes. And there's a variety of forcing mechanisms. But we start off with tides, which are, of course, gravitationally driven, tsunamis tonically driven, and then weather and storms drive a lot of the circulation to energy in the ocean. And basically, we go from global circulation engines to windwaves to storm surges. And in between those, you have gravity waves. And then you have rainfall runoff.  It covers everything. The only problem is you have to go from scales of thousands of kilometers down to millimeters.  And so you need to do 10 to the 34th unknowns per day of simulation time. And so I'd say, roughly, we can do 10 to the 12th to 10 to the 16th per day right now. But we're way off from 10 to the 34th. So historically, where this is gone, instead of solving the Navier-Stokes, we've really compartmentalized processes and scales quite a bit. I think it's kind of fun to really look at the origins of this. Laplace actually predates the Navier-Stokes equations. And he came up with the LTEs plus tidal equations, which are long wave equations that are non-dispersive processes. So they do a really good job at doing tides, tsunamis, for the most part anyway, and swarm surges. So that's really at the heart of a lot of coastal ocean models. Then you go next and say, okay, I want to deal with non-dispersive type waves. And you go to Bousinets class models, and there's a whole variety of those. Of course, they started off with Bousinets himself in the 1870s, although most modern theories are based up here in 1967. And that covers waves, transforming waves, infra-gravity waves really well. And for example, when tsunamis are making their way out of land. So next up, we have dealing with waves in general in the ocean. There's just no way that you resolve them sufficiently based on the length scales.  And so the French actually in the 50s came up with wave energy transport type models, wave energy density or the whole bunch of variants on that. And the first really big operational model that was full of physics based and allowed the spectrum to change was Hasselman company who wrote the land model. That's pretty widely used non-phase resolving wave model. So it doesn't give you the phase, but it gives you where wave energy is going. Then next is Lighthill. He developed and derived the kinematic wave equation, dynamic wave equation for rainfall runoff. And those equations of course are used when you're trying to do over very thin layer over land flows before you jump over the shallow water equation. The shallow water equations are extremely difficult in order to resolve and compute those type of processes. And last but not least, you have global ocean circulation type models really were initiated in the late 60s and have evolved and really focused on the global heat engine and the bare-clinicity of the ocean and a lot of the energy that exists in the ocean off the shelf. So really it's this scale separation, process separation. And it's somewhat unfortunate that really all these communities live in a little bit of a silo. And it's nice to see that they're finally coming back to a little bit. And each one of the communities provides affordable resolution and covers the domain that they can. And they just alias the rest or forget about the rest and deal with it through boundary conditions. A lot of nesting goes on within these model classes. I think I'm always a little bit scared of nesting because you got to do it really right unless you have a really diffusive model because that will kind of wipe out your sins. But I think I'd like to make two points on nesting that people have a little bit of caution. First of all, the boundary conditions are always the most inaccurate. Either typically lower order than the rest of the PDE solutions inside of the domain. And second of all, if there's any kind of incongruity between the physics that you're forcing in the interior domain physics, you run into trouble. Unless again, you have a pretty diffusive model. So either you get extra energy being generated because of the mismatch between the interior and boundary energy, or you get stuff that's generated inside reflecting back. And you can just spend a lot of time with the boundary conditions. And last but not least, you have the data simulation. So we don't do things right in our little process separated world. And of course, the rest of that energy exists out there. So and we can't resolve it enough, et cetera. We don't have a large enough domain while we'll just assimilate something. And that has its own set of issues but also its own set of benefits. So really I'd say where we're coming from, enormous progress obviously since these models have been developed. But where we've been going is much more component interaction between the silos. I think for me, I'm a finite element person. So obviously unstructured grids are great. You can really resolve things where you need to and localize resolution. You can do large domains. And we are as computer capacity just grows in this wonderful age of our profession, better resolution and together with better algorithm. So the models today are a lot less numerically diffusive than they were in the past. And that goes right along with better sub grid scale physics as well as improving parallelism. The bad is that we've got largely solid communities still in development. Really, we're not talking enough to each other in my opinion. The grids have just been a lot of very suboptimal. We really haven't put all the homework into that that we should. And if you look at what kind of models existed in the 60s, for example, for my business Shell water equations, they were kind of second order accurate. And for the most part, most models are still second order accurate today. And that doesn't match well with the computer technology and often very inefficient parallel processing. So just to give you a little bit of a story about our model that's at the Absurc model. So look at the spectrum and where things are really energetic of the ocean. We have the gravity waves between, let's say one in 30 seconds and you have infragravity waves and then you have long waves. So what we do is we cover all the long ways with Absurc and we couple tightly to swan for the wind waves and we just close our eyes and don't forget to deal with the infragravity waves and say, they're not so important. And so we do have this tight coupling that works quite well. So Absurc, Solvage Shell Water Equations 2D3D, it's fully 3D, your clinic model, if you wanna make it that way, but I'll give you a little bit different twist on that. We use the lurk and finite elements, very simple linear elements and we typically do very large domains. The model is used by the Corps of Engineers to design levies, all the levies in and around New Orleans are designed using Absurc, all the post storm and storm risk studies the Corps does for hurricanes are done with Absurc. NOAA has a extra tropical and tropical now model called STOS and HTOS that is the foundation of it is Absurc. It's being coupled to WaveWatch 3 there, non-phase resolving wave model as well as to the national water model. And so then we have FEMA uses it for flood insurance studies. And so along the whole East Coast, Gulf Coast and Great Lakes Coast Absurc is used to establish flood insurance which actually can make me a target of some dislike because if your flood insurance rates are too high, you can blame me. So then we have SWAN that's a non-phase resolving wave model from Delft. It's a great model. It's more focused on the coastal ocean. They have an unstructured rendition that they developed together under a joint project for ONR and we coupled them very, very tightly. In fact, the parallel communications engines in unstructured version of SWAN are directly out of Absurc. And basically, Absurc informs SWAN in terms of water levels and in terms of current speeds. And SWAN gives Absurc back wave radiation stresses. That's that push that you get when waves break or it's the pull that you get when waves are being formed and being generated. So they work in these parallel worlds where we try to domain decompose using Parmitus or Metis. And basically we have equal size or equally loaded subdomains not equally sized per se in terms of area but equally loaded in terms of number of degrees of freedom. And again, they SWAN and Absurc pass information locally. When you look at wall clock time versus number of course on the log log plot you get this linear reduction in runtime which is what you want. So a typical model might look something like this. It's these coast model focused on southern Louisiana you see in yellow and orange continental shelf and I see the grid is much larger in the deep ocean than it is on the continental shelf and focusing in on southern Louisiana you can provide a lot of resolution or let's say southeastern Louisiana and oil is here in the Sippy River Delta, et cetera. And you can get all the features using the high-resolution finanilum grid. So this is a bathytopo chart you can see all the river systems, channel systems, the islands, the levees, et cetera. All that geographic detail is supported by the unstructured grid which is shown here. And this is a grid resolution now and for example over here the orange speed resolved at about two, three kilometers it goes all the way to five kilometers. The high energy conveyances are resolved at 30 to 50 meters. So we really try to pack in the high conveyances we try to put a lot of resolution. So a typical simulation might look something like this. We have Hurricane Gustaf winds over here with a wind model and then we have the waves computed with swan and the water surface elevations and currents computed with that sort. These two models are interacting two-way the wind model feeds down to the wave and water shell water models. And so you can see the winds coming up here and the hurricane making landfall over here to the west of the Mississippi River. You can see the waves going all the way. This slide over here up to significant wave height that's greater than 10 meters. A lot of wave radiation stresses being generated there and a lot of the storm surge here to the east of the Mississippi River is being trapped by the river on the shallow continental shelf. So kind of an interesting simulation and we do very well simulating this. So obviously we're evolving the capacity making up for the things that we're missing. And the good is that we're generating or we're advancing model integration and part of it is very heterogeneous. Part of it is actually in some aspects in terms of the miracle drivers quite homogeneous and we'll talk about that a little bit. The resolution is getting better. We're understanding better and better how to resolve our grids and where to put our costs. And we've been working a lot on discontinuous Galerkin methods. The way to think about discontinuous Galerkin it's really a finite element problem on a finite element single finite element. And you actually communicate with Riemann solvers between the elements. So it's kind of like finite volume except that your whole high order stencil is on one element of itself. So you don't have larger stencils that go across cells. And that's a really, really nice feature. The bad is that the grids are still largely static and the physics is static. We basically decide on the physics beforehand. And the load balancing is less than perfect. And another thing to worry about is only peak performance on the process. And a lot of these things are pretty ubiquitous along across all modeling communities. So here we have what's happening now. So we have let's say the wind, gel, water, wave coupling there. But we've coupled now to high com. And the way we're using high com is really as a internal mode driver to the two-dimensional answer. So NOAA runs high com or variants thereof. And so instead of trying to mine the bare-clinicity out of our own model, which we can, which would be very expensive because of the high resolution that we use, we actually mine it out of high com. And let's start this. So the bare-clinicity, i.e. the temperatures and salinities, they drive all these currents that you're seeing in deep water. And that in turn actually affects the surface water at the coast quite a bit. So the two things that we drive with it is we drive these bare-clinic currents and we drive internal tight dissipation, which is heavily dependent on bare-clinic structure. And that actually is good for us as hurricane modelers because we move the dissipation off the shelf at the shelf break. And that's a very nice thing. So this is not ad-circ, basically computing what's called the internal mode. It's high com. So what you can see is in terms of a monthly mean sea level here, this is in September. And you can see that the water is much higher in the internal part of the ocean. And then the water at the coast is actually quite a bit lower. So all that intra-annual and intra-weekly structure we can capture by feeding and ingesting that bare-clinicity from the high com model, which is pretty cool. And when you match it with the water surface elevations at the coast, it does a really good job. So what's the future? So our vision is to really have much more dynamically coupled models and do it in a much smarter way and actually have them be living and breathing things instead of these static things that we predetermined what we should pick. So we wanna have dynamic physics, dynamic grid resolution, dynamic order of interpolants and to really match this all within, support it with the dynamic load balancing. Focus areas are these frameworks that allow this coupled and dynamic physics to occur and to optimize the grids for that physics when we implement it. They have higher order methods and to advance the engines for load balancing. So the first thing that we've been doing and this is together with NSEP and NOAA coupling to the Worf Hydro National Water Model. We're coupling actually for a NOAA project to see ice as well, as well as WaveWatch3, which has great ice physics in it. And this we're all doing instead of through our own coupler series, ESMF, WAPSI, which what I understand has some of the elements and thoughts of BMI as well. So in addition now, so this is pretty heterogeneous coupling, right? Heterogeneous physics and it's heterogeneous grids and models. And so, but on some other things, we actually wanna be heterogeneous in the models and the physics, but we want to be homogeneous in the actual algorithmic frameworks. So what we're doing now is we're actually growing these algorithmic frameworks that support multiple physics within them. So for example, if you want to get dispersive type waves together with non-dispersive type waves, you're gonna have to make a choice between shallow water equations and Boussinesse class models, right? So if we now want to transcend and go to the infragravity waves and do a better job at phasor-solving waves, we can actually take a shallow water equation and couple it to a pressure Poisson solver or Boussinesse class model and that's what we've done. And then we can couple that to the standard shallow water equation model and other portions. So through this interleaving. So the way this continues Galerkin works is you actually blow up the elements and you couple them with a Riemann solver. So for example, some elements you could assign the shallow water equations, some elements you could assign the shallow water equations plus the pressure Poisson equations that then couple back into those shallow water equations. So it's a very cool mechanism for doing multi-physics within the same computational framework and selecting it when you need it. So for example, when things are calm, you might not want to solve the Boussinesse equations anywhere. When the waves get really big and you have infragravity waves being generated, you might want to actually turn on the pressure Poisson solver. And so we've played Andrew Kennedy and some of his and my students have been playing with this for a long time. And there's a whole hierarchy of orders of model that models and precision that you can generate. And just as a little example here to do a wave shouling over this, this berm here, you can match the data really well. So it becomes this dynamic type of framework. Next thing is the hydrologic models. So for example, some areas in the floodplain you might want to be actually be solving the kinematic wave and the dynamic wave equations. And so that would be a very important thing to do when you want to have an integrally coupled model. And so over here, you might want to solve the shallow water equations. Next cluster or zone, you might want to solve the Boussinesse class models. And then for example, in the flat portion of the floodplain, you might want to solve the dynamic wave equations in the higher portion of the floodplain, the kinematic wave equations. And this is all integrated into the e.g. discontinuous Galerkin-based computational framework. The other thing is that we might want to adapt with P. So as I said, we've been living with these second order models. So instead of living with just this simple second order P is equal to one model, let's jump into quadratic elements or cubic elements. And then when things get quiescent again, not as high energy to the linear elements again. The idea is that today's models are basically simply linear models, but they're very high resolution. So let's back off a little bit and have coarser models with much higher order interpolants. And of course, what the advantage is there, you have a much faster convergence rate. So you're buying convergence speed on the order of the interpolants, plus you're actually allowing yourself bigger time steps and you're allowing yourself or loading up the vector-based processors that we have today with much more work. So increasing your workload towards peak performance. So examples over here, left side is you have high resolution with a channel over here. Here you have this higher order interpolant now and a much coarser mesh if you can see that. And here you have the linear interpolant on the coarser mesh. Of course this miserably fails in the representation of both of the symmetry and the currents. Here we get identical solutions, but runs four times faster. So we're really mining this. And you can do this in a dynamic way. So when you need that high resolution, you can provide it. So we also have adaptive H networks. So basically add resolution on the fly. And another nice thing about this continues to work and is you can do it so it's non-conforming. So you don't have to mate with the same interpolant, same type of element, et cetera, as the adjacent element. You can mix and match P, you can mix and match resolution. So we can simply insert more resolution in some elements when we need it. And we can take away that resolution when the flow becomes more quiescent. So an example, a kind of cute example is here. This is a hurricane study of New York Harbor. And post Sandy we did that study. And it turns out that, for example, this level of resolution is very fine for tides. You do a really good job getting the tides right in the whole system. But when the hurricane comes along, there's the Hudson River Canyon that said, okay, I can see it a little bit there. New Onsen smoothed out because of the poor resolution. But it turns out that this is a major release valve for the hurricane. So Hurricane Sandy actually pushed water into New York Harbor by blowing the wind over here. It maximum winds just walloped New York Harbor. But because of the depth of that channel, it allows it to be a backflow valve and actually lowers the water levels. The water levels are much higher in New York Harbor if you don't resolve that feature correctly. So we don't wanna have this grid just for tides. Work at a grid and that storm comes up and you wanna put this level of resolution in. And we can do that with that dynamic age adaptivity when we need it. So of course, all this now has to be accommodated with a framework that allows for changing load balancing. We're changing the physics. Some of the physics is much more demanding. Obviously, doing a pressure Poisson solver is much more demanding. Kinematic and dynamic wave equations are much cheaper than gel water equations. So as we're changing that physics, as we're changing the P's, obviously you're increasing the cost. As we're changing the H's, you're increasing the cost as well. So we're gonna have to redistribute and rebalance that whole calculation on the fly. So we've been working with the MPI forever, this last 15, 20 years. And so we've now turned to a piece of code called Zoltan from Sandia National Labs. And it allows us to dynamically redistribute and diffuse locally the elements to be load balanced. So the idea is, let's say this is an equal number of nodes and elements, domain decomposition. Well, when it's dry or let's say you're doing the dynamic or kinematic wave equation in this land-based area, in this calculation, you actually have a much smaller workload. So you can actually put much larger subdomains over there so everything keeps synchronized. And that we have developed a lot of technology in order to smartly and intelligently redistribute those workloads. We're also under an NSF-SSI project for software innovation and sustainability. We're looking at, we've integrated in HPX with a group at LSU. And HPX is a much more fine-grained type of redistribution mechanism. So it really migrates data instead of clusters of the subdomain as we did in the MPI-based subdomain decomposition and redistribution. And this is gonna be important as we go to a larger and larger number of cores to have that greater flexibility and that greater capacity. And it accommodates all those things that we want to change the dynamic. So to sum up really, I think that we come for you from years and years of things being pretty static.  And then that went to the PDEs, which in the finite element method, HPC. Of course, that was fed by not only the domain, but also by the forcing function and forcing physics and put that all together. And then you basically generate solutions. There's no feedback mechanism anywhere. So basically where I think we should be going is having this very, very flexible interactive feedback and that is represented by all those green lights that are basically spaghettiing all over the place and informing things and doing it dynamically. And I think in order to have cheap, effective, and accurate calculations, we need to have that total interaction. I think we ended there. Wonderful, thank you very much, Johannes. Questions. A lot of the recent hurricane events, rainfall flooding was really important in addition to the storm surge. So you said you're working to link with Worf. Is that the approach you take? Worf hydro, yeah. Yeah, so NOAA has decided that as part of their quote unquote national water, total water model at CERC is going to do the coastal part of it and Worf hydro is going to be the, obviously the hydrologic side of it. But then we're working at this interface with them. Yeah, so right now it's point to point coupling where I think the vision is is that the group at Oklahoma is doing that work. It's where Worf hydro is competing fluxes into absurd. We're actually doing the gritting part of it and providing the grits that go far enough upstream in a really cheap way so that you can couple the rivers far enough. But it used to be no man's land, you're exactly right. And obviously the downstream water levels affect things enormously and that adds to the upstream fluxes. Other questions over here. I was just wondering for these problems where you have real bathymetry that is pretty non smooth. How much do you think it matters to have higher order accuracy methods versus just having good refinement in the region? So we've done a lot of sensitivity studies and obviously critical high conveyance regions are really important, a lot of sensitivity. And in general, the near shore seems to be fairly sensitive to less than 20 meters to what the bathymetry is there working with different bathy sets. But if you look at some of the global data sets and versus the local lidard formed ones that we have to be lucky enough to have in the United States around water penetrating lighters in the back bay and things like that, it really improves things quite a bit. So I think bathymetry is in the conveyance is going to be really important where there's a lot of energy and that's what we're finding. But the high order that we're doing there's just to be cheap so that we can have lower, bigger elements, right? And larger time steps. And so then we still capture that physical shape. That's what we're doing that in. By the way, it pays off to have the higher P because you get much more efficiency on the processor. So it's a matter of cost function. Okay, one more, Irina. I wanted to ask whether you feel that the sediment transport formulations that we use with these models are sufficient for the sort of like unique extreme cases like big storm surge events. So, yeah, it's important. Dune systems erode in every major hurricane. Obviously there's breakthroughs. You have to have that a typical tidal inlet channel will erode by as much as 50% and become really deep. So, yes, the morphology is very important. We do have sediment modules, but we haven't played them. I guess it would probably be much easier to get sediment and this is just an educated guess. Sediment transport more accurate with high energy events than it would with the one a day work a day morphology. I think as part of a team for the core for a big project called Morphous some years back and one of the sediment guys made a point that when they looked at all the sediment transport formula that 50% of them, 50% of the data points were within a, 80% were within a factor of two and 50% no, 80% were within a factor of five and 50% were within a factor of two. And of course the morphology is the gradient of the sediment flux. So it's, I think, boy, there's a lot of work to do. Okay, terrific. Thank you, Johannes.