Okay, I believe it is activated. We have activized the live stream. Hello, everyone. Hello, WJD 85. Hello, Rob Vegas. Hello, comic tropes and Matt and Joshua. Hi, everyone. How do you do? Welcome to Tuesday. I have confirmed it this Tuesday. I thought it was Monday for a large part of the day really messed me up. You know, and you know what, you don't want to have two Mondays. One Monday is enough. But for a while, I thought I thought it was still Monday. I've confirmed. Check the calendar is in fact Tuesday. Good evening, everyone. Nice to see you. Hello, McCleary dear and Cyclonus and Josiah and Joe fan 84. If Mr. S is watching. Hello, Mr. S. So, since the last time we talked, the Cobra convergence calendar has gone up. Hey, look, it's check this out. It's Mary Ann and she's waving and you know where she is right over here. So she was up. We're at the couch and see this. See this. I push buttons on her phone. Mr. S isn't watching right now. He said, well, that's okay. That's okay. In fact, since he's not here, you know, I don't have to be clean. So this is going to be the dirtiest show I've ever done. Hello, Bart. I think I saw Bart up there. Hello, Bart. Hello. Alright. Hi, everyone.  It's Cobra convergence time. So in this, in this episode, in this, in this episode, I'm going to I'm going to go over the calendar for Cobra convergence. I have that over in this other tab. First, I want to remind everyone. I want to remind everyone that it's Tuesday. I had to remind myself that it's Tuesday. So that means there's a new episode of half the battle with Timmer. This time he covered the super seven reaction figure of Raven, the animated character, the female. The female strato wiper. So that's a new review for Timmer. I always keep up with what Timmer is doing and he does his new videos on Tuesdays. Oh, yeah, Green Yeti is hello. It has been a minute. Hello, Green Yeti. How do you do? Good to see you. Welcome. Nice to see you back. Also, and maybe Green Yeti doesn't know this because, you know, it's been it's been a minute since since you've been here. What's on Joe mind is now doing Tuesday nights so they will be on right after this show. There are links. I put links in the description. I remember to do that this time. I put links in the description of this video. So as soon as you're done with this, you can roll over and watch. Watch, watch on Joe mind.  It's a bit of a mess. But anyway, hi everyone. And Curtis. Curtis says hi from Detroit. It's been a minute. Hello, Detroit from the United States. Thank you so much for joining. Hello, Stonegate. Stonegate creations. We have much, much to talk about. And you know what I just noticed. And I didn't notice this before, but this the shirt seems to have some some writing on it. Look at this. What. Who might have done this. What you know what what Vandal might have written written on this on this shirt. I don't know that's that's pretty wild. Curtis says what did you do without internet board games or board games. Well, both. A lot has happened. Oh, yeah, yeah, gung ho. Where did gung ho go. Oh, gung ho is somewhere. Oh, yeah, right here. Yeah. I don't know. I don't know that we can get to gung ho this time because we've got a lot to cover. If, if, if we get through everything we need to do, then we can try to open gung ho if we have time. I know that's been waiting for a long time. We'll see we'll see what you do. Hello Raymond. Oh, it sparks there is a sparkster is here and he's sorry that he's late but I'm just glad you're here. So, what was I saying. What's on Joe mine. Timmer. It's Tuesday. Cobra conversions. So a few days ago what was it. I guess it would have been Saturday night. A really strong storm blew through here blew through my town. And reached havoc. And a large part of the town is still without electricity as you can see, I have electricity so that's covered. However, my internet was down for an unreasonable amount of time. But it did come up and it popped back up last night. Before it popped up, I was on the show audible interlude. I hope some of you were able to join me for that. But I had to go over to my parents place and use their internet, which is not ideal. It's not ideal. But yeah, the storm. It like it wasn't we didn't have tornadoes it was just like straight line winds. Very strong straight line winds. But for a 20 minute storm. We have days or potentially a week of outages. Because that's that's how we do it in our modern society. So cyclone is nice to see you wreak havoc. Yes it. What does the havoc smell like it reeks. Let me tell you the the havoc it it it reeks. And that's what it smells like to well, you know with a lot of power out people's hot water tanks are not working so people are not showering as much as they used to so you know it kind of does reek. This the store the storm has wreaked havoc for a 20 minute storm. It's like the apocalypse happened here. And now we have gasoline shortages. I can't I can't get gas in my car. There's there's hardly any gasoline in this town. Total apocalypse 20 minute storm. And we have a total apocalypse. So I was supposed to have posted stuff about covert convergence but that was difficult with no regular with no regular internet service. Mary Ann says her what hot water tank is gas that's fantastic my car needs gas. Can I can I use that. I don't I don't know how things work. Oh thank you for the super chat comic tropes did you order a classified deal I know you love him. Good question, and thank you for the super chat actually that is on my list of things to talk about. So we did get some some classified figure reveals. And there's so like, it's hit and miss it's hit and miss. There was a desert uniform snake eyes, which was, I don't know, kind of plain, not too exciting. There was a tunnel rat, which looks good is very keeps very close to the design of version one tunnel rat really adds very little. But you know the the design of version one tunnel rat is good so they don't really have to add very much that that looks nice. But they also gave us a cobra eel in the classified scale. Now the cobra eel is my favorite army builder I wouldn't say it's necessarily my favorite figure even my favorite cobra figure. But I really like the way the cobra eel looks on a shelf with in a group or on the cobra more when all the guns are manned by cobra eels I just think that looks really cool. And I like the gray and the red and the black I just think it looks really nice. So I'm a fan of the cobra eel. So yes, absolutely. I jumped right on. And, well, first of all, the on the Hasbro site that those sold out really quickly. So I went to Amazon, and I ordered one immediately when it went available and yeah so I am definitely getting a cobra eel I'm very eager to see what they have done with the cobra eel in that scale now. As with torpedo. They seem to have kept very close to the version one design. In the case of the eels that may not be a bad thing because the version one design had a lot of really nice elements that I think would translate to a larger scale. So we'll see but yes, yes I jumped on that thank you comic tropes for the super chat and absolutely I did. That was one that took us by surprise. That's not one that we expected right that we kind of knew that the desert snake eyes we was coming we knew that the tunnel right was coming. Nobody knew that the eel was coming and yeah I jumped jumped right on that there's another figure. There's another figure that that was announced sort of. The next stretch goal for the has lab dragon fly has been announced and it is Glenda Glenda international character based on scarlet and comic tropes again is right on top of it. No I did not expect Glenda so let's talk about that. There are no peanuts in the drink. It's been a while since I've put peanuts in my Pepsi I'll do that you know what I'll do that next time I guarantee next time I will put peanuts in my Pepsi for this live show and less I forget. What did I expect Glenda I did not expect Glenda let me let me. So we thought there's been a lot of discussion right there's going to be a lot of discussion. We thought that it might be airborne. So we're getting a night force. Ripcord. And we were thinking we think there are two other unlocked figures were thinking airborne and a new character based on the name that's on the canopy of the dragon fly, which again I've forgotten I know I can't trust my memory for it.  But anyway, the dragon fly canopy has the name of a character that does not match any known GI Joe character and with the with the the has lab sky striker. Well right here this one is right in front of me with the has lab sky striker. The original sky striker also had Wayne Ruthle on the canopy. Well they gave us a new character for that name so that's nice I thought that was really cool and we were kind of expecting them to do that with with the has lab dragon fly in fact I kind of still expect them to do that with the has lab dragon fly. But I was really thinking that the other unlock figure would be airborne instead. It's Glenda. And I think that is. I think that's a really clever idea. Right, because for classified collectors who want to get you know the the main characters the main line, the important characters the ones that are the most memorable. You don't want to make those so exclusive that that most people can't get them so if you're going to have an exclusive figure that most collectors are not going to get let's just be real most collectors are not going to get the the has lab figures. Then why not do it as something that's a little bit more obscure something's a little more specialized something that the long term fans the long term collectors would recognize. And would be interested in because really those are the ones who are more likely to jump on the has lab project anyway so I think that was a really clever idea. I think that makes a lot more sense than airborne.  The since Glenda is the next unlock. It's, it seems like maybe airborne will not be part of this set. Because if that's the direction they're going then airborne may be to mainstream a character to just make a part of the has lab project airborne may be mainstream enough a character that they want to do a regular retail release on it. So now I'm thinking maybe it's not airborne. Now I'm thinking maybe the final unlock is the new character, but I suspect if we get the new character I suspect it will be. It will have at least the body of someone else someone that they may release in the future maybe they'll have the body. Excuse me of the body of airborne with a different head or something like that. So, so yeah, I'm guessing that that's the direction they're going now airborne to mainstream a character. They probably want to do a retail release with that figure. Bart says, give me an updraft an updraft that's a speaking of which, like, I still got, I still have my retaliator. By the way, okay, I don't want to review this right now because I want to review it when I review it but so this is the retaliator. Why, why, why couldn't this just be the dragonfly mark to why not just call it that I mean it looks even more like a dragonfly than the first dragonfly. You know, this and this looks like a dragonfly mark to quite frankly even he still has the orange rotor blade tips. Since you mentioned updraft though. I got this at Joe Fest did not have the figure of the file card. I have since I have since ordered the figure and the file card I got a good price on them got a good source for them. So now I will have the vehicle box figure file card for less than what you would pay for just the vehicle in some places so I feel like I got an excellent deal. I'm getting sidetracked updraft though updraft is another fairly obscure character I don't think most Joe fans would like right off the bat know who that is. Obviously I do because I had I had to just order one. But updraft the updraft figure looks really nice it's a really good looking figure. But I really think I really think it's going to be a new character I really think it's going to be a new character with a body that they will apply to a more mainstream retail character at some point in the future that's my guess. But I did have to give kudos to the Hasbro team for going with a figure like Glenda for a campaign like this. I think I really think that's the right move. I really think that's the right move. If it's if it's to mainstream a character. Then you then the collectors that want that mainstream character are not going to be able to get their hands on. So if it's if it's a mainstream character you want collectors to be able to get it even if they don't want to back the the has lab so I think that makes sense I really do. Also a side note a side note. Glenda has the same body as scarlet right and based on the digital renders that we've seen. The Glenda figure appears to have a classic scarlet body. Which means that mold in the future ought to be used for a excuse me for a retro style scarlet and that is something that I know that a lot of fans have been wanting. Now we we did get a scarlet in actually we've gotten two scarlets in the vintage. I'm sorry in the classified line we got the scarlet that was in the first wave. It was kind of updated had an updated uniform updated details. Then we got the scarlet from the snake eyes movie. Neither of those had the version one scarlet look that most people are familiar with. But with Glenda you should in the future get get a scarlet figure. Joe fence is I thought Glenda and scarlet were allies. I don't want to dive too deep into the Glenda lore but I know that there was like a post vintage or modern file card that had the Glenda uniform but the scarlet code name. In fact they really should be considered different characters. But yeah I think it's a fun idea I think it's a fun idea. See hello Christian bricks nice to see you thank you for being here. He says they also changed classified scarlet hair color yeah the class and I did like the classified scarlet the wave one classified scarlet I did like that figure I like the updated uniform. But I know that there is a clamor a grounds well a grassroots movement to get figures in their classic looks with Glenda we should get a scarlet. So that's that's an extra bonus that we we should look forward to but again my guess and I have no insider information whatsoever. My guess is that the final unlock will be a new character. It will be a new character that has a body of a more familiar character that they will use in the future. That's my guess that's my guess and you know hey you know what I think we learned we learned from the from the dragonfly has lab rumors that you should believe all rumors. They turn out to be true so I think that's the lesson learned believe all rumors. So any rumor that you've probably heard is probably true. So I don't want to spend the I don't want to spend too much time talking about modern stuff and classified stuff and has lab stuff but I want to make sure to cover that because it's it's news it's in the news. There was also a GI Joe shirt like a button up shirt by what's the company. I forget who is doing it I think it looks really nice. GI Joe print button up shirt I think it's nice that they're giving us some formal where it's nice and thank you for the super chat it's nice that they're giving us some formal where so I'll have something to wear to weddings and funerals and such. Comic tropes GI Joe comics news OK. Let's get to that. That's the yes. That's the company. Thank you. We talked a bit about the GI Joe comics news. Last time there's been some more developments. The Larry Hama series will continue with issue number 301 I think that's a big relief to all of us that's important. I think I honestly I think whether you read the series or not Larry Hama has been so associated with GI Joe that I think most of us would want him to be able to continue this series. If anybody has earned the right to continue as long as he wants to I would say that's Larry. So that's good news Larry is going to get to continue. Also, my understanding is that they're supposed to be a special edition of GI Joe number one. That's going to be based on the original script that I guess was altered for the original release so we will get to see GI Joe number one in the form. That it was originally written on I think that's very interesting for for historical purposes I think it's kind of cool to have those. To have to have those. Those other perspectives these things that you might not have known about and may not have seen the light of day if not for projects like this. Again with comic. See comic tropes is the actual expert like comic tropes is the comic book expert. I am the nothing expert I am an expert on nothing. But but thankfully we have comic tropes in here expert in comic books says how much book will have Chris. And art and covers by Andy Kubrick. And that's also really cool Andy Kubrick art. Andy Kubrick covers. I know that I believe he's done some in the past like in the Marvel series, some fairly well known covers. So it's nice to see him picking that up. And it's nice to. I mean I like Andy Kubrick art anyway so I'm glad they were able to get somebody like him to do the covers. GI Joe number one without the comics code influence yeah the comics code isn't what it used to be. You know the comics code is a. It had a lot of influence at the time it. Well a lot changed you know I'm not a comic book expert I don't want to dive too much into that. But the comics code was once was once very important. Matt noon says he just subscribed to comic tropes. You know what that's fantastic. Chris has been my friend for a long time. Chris the host of comic tropes excellent show had a great episode about a Marvel comic based on a pop star sort of it's a great episode and really funny and a lot of fun so make sure. Make sure you check out comic tropes and thank you for letting people know that that you're subscribing to comic tropes when you're on this stream because that I'll make sure to get my kickback Chris. There's another one make sure you send me my kickback checks in the mail I'm sure anyway. There will be again Chris there will be a four issue miniseries for GI Joe in the energon universe and a secret miniseries that might be a crossover Joshua Williams Williamson writing Tom Riley and Andrea Milana on art. They have announced I mean there's got we know that there's going to be a Duke miniseries there's going to be a Cobra commander miniseries and right now they have the void rivals series out. I honestly have no idea if this is going to. Yeah, yes I'm noir I'm noir tonight. I see I should have a fedora. I should have a fedora cigarette, you know, I don't know if I'm going to like I really don't in general I don't typically go for for GI Joe and transformer crossovers I just I don't think they cross over very well. I don't think they're a natural match for each other. Having said that, you know, good writing can overcome a lot right good writing can overcome even a bad premise, you know, you could have a mediocre premise with some excellent writing, and it can turn out great. So for that reason I really have to give it a shot and I will give it a shot. And again I was mentioning on audible interlude that I, regardless of whether I want it or not. Regardless of whether I like it or not I want it to succeed. I want GI Joe to have as many successes as possible. The more it succeeds, the more they will give us right the more they will more different kinds of GI Joe, they will give us people have been saying, Hey, we want. You know we want cartoons we want a TV show we want all this. Well, in order for any of that to be possible. We've got to succeed right we've got to have some hits. We've got to demonstrate that this brand in the media can be successful so I'm for it I wanted to be successful I wanted to make a splash I want it to get people talking again. So I really hope that it succeeds as for whether I will like it I really don't know. I really don't know it's definitely not in my wheelhouse, but I will give it a shot I will give it try and and hopefully it'll turn out better than I'm expecting. Let's see so. So what non transformers comic crossovers do you want to see.  Oh, if you got the snorks you can do a crossover with SpongeBob SquarePants to you know Hasbro give me a call Hasbro give me a call. I'm not giving you this one for free. We got rainbow bright Smurfs the snorks SpongeBob SquarePants crossover with GI Joe. This one's not for free.  Just send me a check for that one we'll we'll we'll we'll negotiate it this this is brilliant. Killed in I remember the snorks also stop okay fair fair. Oh wow. Who are you know what. Michael Bell did a voice in the snorks didn't he. Anyway I'm sorry we're getting we're getting a little far field. And we're the show is almost halfway over and we have not talked about about Cobra convergence which is the main reason we're doing the show today I want to do a Cobra convergence preview so I could not figure out a way to share this list on your screen so I'm going to go over it with you. The calendar is up on hcc788.com right now it's on the main page. So let's go over this let's see who's in. So on July 1 we have Sergeant slaughter slaughterhouse again starting the event like they did last year always excited to see that Zazel who runs that channel I got to meet him. In Augusta at Joe fest that was a blast. Great to meet Zazel. He he's from Australia. So he came here all the way from Australia. I believe he's on his way back now to you know Europe or wherever he's from I don't know geography. I assume Australia is near Europe or something like that. I'm sorry I'm a product of the Oklahoma education system. Then we have Woodman 29 and this weirdo here hcc788 and then sparkster sparkster who I believe is in here and always nice to see sparkster I'm sure you are familiar with sparkster from the this live chat. We've got it's Chad another guy that I met at Joe fest actually met him at Joe fest last year but I saw him again at Joe fest this year. What's on Joe mind the show that is going to follow this one the show that you should go and check out as soon as this show is over what's on Joe mind what's on Joe mind probably is the most important GI Joe show the longest running GI Joe fan podcast and really great guys. They've done immeasurable things for the community so do check out what's on Joe mind. Cobra Island another long time participant in Cobra convergence a toy kind of mood. Talking Joe go figure real American Brian real American Brian that's I like that name is a good name you know I that could apply to me. A snooves corner cafe the full force podcast there their old friends as well the skull reviews that dude does a lot of like 12 inch GI Joe really cool Joe motion videos 82 Byron our friend Byron also our friend Cujo from originally from GI Joe Berg Cujo also I have met a couple of times in person half the battle with Tim or somebody that I have not met in person. But is one of my oldest friends on this platform and a side note time out a side note about half the battle during the year that I took off right I was out of this for a year and I missed the Cobra convergence. So there there's a gap between Cobra convergence five and six. In that gap year. Half the battle did a Cobra month in that gap year. I really should have counted that as a Cobra convergence and started you know restarted the numbering with Cobra convergence seven instead of six so this year's ought to be Cobra convergence days it's too late to change it now but. What that means is Timmer is the only person who has been in every single one every single year without fail. So honestly this event is as much his as it is anyone. So thank you for being a part of it again Timmer and peg warmers. One of the things that I've met in person a couple of times Kevin from peg warmers just the one of the nicest people that you will ever meet. Also Jay Bartlett. He is Canadian. So will we forgive him for that I'm kidding. Jay I'm kidding. We love Canadians here. In fact we like Canadians probably more than a lot of our own neighbors. I've yet to meet a Canadian that I didn't like in fact. Jay Bartlett is great to have Jay Bartlett back.  Again someone that I met in Augusta at Joe Fest I believe he gave me a shirt for Chaplain's assistance motor pod and I believe I've misplaced it which I feel terrible about. If there's a way for me to order a replacement I will purchase for myself a replacement I feel bad. But I can't find the shirt anywhere toy connections. Another person that I met at Joe Fest. Ken from toy connections another Canadian. You know we are being invaded by the North but honestly that's probably a good thing. So toy connections it was great to see Ken JLS comics another comics expert. And that show is a lot of fun very informative action robot punch and audible interlude I was just I was just on audible interlude yesterday but I also. We went to the audible interlude panel at Joe Fest and they they allowed me to come up and talk about covert convergence for a while so thank you guys. Order of battle. Our good friend Jay LaTroll who is a guy that collects pocket patrol packs. You know we all have our things. We all have our things. But order of battle Yorktown Joe Joe on Joe podcast you remember when Joe on Joe podcast did. See they did a behind the music with about cold slither it's like the VH one documentary like a VH one behind the music documentary of cold slither. And then last year they did call it they did a Colombo GI Joe crossover it was very clever. My side of the laundry room long time Cobra convergence participant love having that guy back Rob Vegas Rob Vegas. Last year he did a Cobra convergence episode every day in July. That was amazing. And when we had somebody drop out Rob he came in he took over. He helped us out. You see what is happening here. You see what it's happened stop it. Just just stop it. Move I don't I don't I don't want the butt end in my face. I don't want to tail in in my face. Wow. My apologies Rob.  But anyway thank you thank you Rob. Oh there's Sergeant slaughter slaughterhouse I hope he's back home in Europe or wherever he's from I don't know geography. I'm kidding. I'm dumb. But anyway I hope Sergeant slaughterhouse made it home. Made it home safely the photo viper toy photography we've had toy photography a number of times and I think it's amazing what these guys can do with just with a camera and with toys and how they make it amazingly realistic and action packed. GI Joberg GI Joberg always goes over to the top GI Joberg does always does something incredible. From the so my fork for cover videos account this year of course they will count they will always count I everybody counts. Yes he's a root I agree. Johnny he's very rude. I'm not even going to tell you what he did yesterday he did something yesterday I'm not even going to tell you that it was rude though. I'll say that it was rude. So Joberg rat face 44 reviews that's a new one. Thank you for being in it rat face 44 reviews I believe we saw rat face 44 in the chat earlier I don't see him now but thank you. And you should be and that's another one you should be familiar with from the live chat we see him often I'm so glad to have him in. We've got island of misfit toy collectors didn't interview with that guy treasures for trigger he participated in the promotional videos last year so now he's somebody that we're bringing in to be in on the calendar this year. Anything Joe's another veteran thank you so much toy domination that's a new one. Did an interview with those guys codename new to very very to one of our oldest friends and a Cobra convergence veteran articulated points these guys are the true historians of GI Joe podcast from the pit. Who again I met at Joe fest I met them at Joe fest last year ran into them again this year. Great guys podcast from the pit make sure you check out their show and agent chuckles another new one and that agent chuckles that's perfect for the theme this year the theme this year being spies infiltrators and double agents spies infiltrators and double agents. That can be interpreted very broadly very broadly. But I wanted to take a minute to first of all remind everybody the calendar is at hcc788.com. It's right on the front page. It has everyone that it has every day of July and who and has the person who's going to be sometimes more than one person who's who are presenting on each day. And there are links to each of those people's channel podcast blog, whatever they do there's a link to it all I miss go for it. I don't look in here I don't know if I said go figure. I'm sorry go figure if I if I didn't say it but go for it. I don't want to miss anyone because every single one of these people are important and that's why I'm bringing this up and that's why I'm going through the calendar because I would like for you to look at the calendar. To click on each one of those links to subscribe or follow you know depending on what platform they're they are on. So that first of all so that you don't miss their cober convergence presentation but also so that you don't miss their other stuff. These are every single one of them is a fan that is doing something and creating something special something related to gi Joe. And they're doing it out of a passion and love. They're doing it because they love it so that's the kind of that's kind of people I like to follow, and I hope that you will like to follow them too. So, if you are wondering if they if there are any good gi Joe creators any good gi Joe content out there. That is a pretty darn good list of people who are out there doing the work, doing the work. And Rachel wait wait wait wait wait wait. Sorry. Wow. It's getting away from me. There we go. Um, Rachel, uh, Salinas says, Lord Hoodie, will you grace us with your presence at DFW Joe show this weekend? I am expected to. In fact, I'm pretty much committed to doing it. The only hitch, all right, the only hitch, um, is that I've got, I'm going, uh, my plan is to drive to Dallas. It's just a one day show. So I'll drive Dallas, drive back. Um, there's no gasoline in this town. My car, um, it's, it's a gasoline powered car. It requires gasoline to go. Um, so long as I can get gasoline by Saturday morning, the plan is to head out there because I would really like to see Ron. Ron Rudolph will be there. Pixel Dan will be there. Um, and those are both people I would like to see. So that's my expectation is to make it, uh, to, uh, to the DFW show on Saturday. Joshua said last year, I watched every CC six entry unless it required a social media account. Yeah, there's a thank you. Thank you, Joshua. Thank you for following and thank you for watching all of them. That's, um, I mean, that, that's what we're, that's what we're doing. We're trying. We want you to get to know these people. Now, of course, you may not latch on to every single creator, but there are so many of them. And there's such a wide variety of them that there will be somebody there that you latch on to, you think they're great and you want to follow them. Right. So, um, this is the opportunity to explore, to learn what's happening in the GI Joe community, to learn what's happening, you know, out there on the internet, what kind of creative stuff is going on. Um, and, um, and hey, Firefly says, Hey, CC, I'll be there this weekend. Look forward to seeing you. I look forward to seeing you too. That would be totally awesome. Again, the only caveat. There's no gasoline in this town because of the, the storm. We had a 20 minute storm and it's been the apocalypse since then. So as long as I can get gasoline in my vehicle. Um, I will, uh, I should be there. The plan is to be there in Dallas or the Dallas area on Saturday. Um, so, um, uh, Hebrew says, Where is the next Joe con? If you're referring to like the official GI Joe con, they don't really do the official Joe con anymore. Uh, what most of us are talking about is, um, Joe Fest, but there are regional shows. In fact, assembly required in Des Moines, Iowa announced their dates. They always do it in November and it looks like it'll be November 3rd and 4th. I'm going to do my best to make it to Des Moines, Iowa for assembly required. I love that show. I love that show. In fact, I had such a great time at Joe Fest that like I immediately start thinking what's the next show I can go to. I want to go to the next show. Uh, well, the next show I'm going to is actually this Saturday, uh, the DFW GI Joe show. Um, and I want to say grapevine. Anyway, it's this Saturday. It's a one day show. Uh, so I'm not super far from Dallas. So my plan is to just scoot down to Dallas, do the show, hang out, see what's what, and then, and then head back home. So, uh, but yeah, I, um, a lot of folks have already done their Joe Fest retrospective. I did one last week. I did one. It's Chad did one. Lots of people have done their retrospective. Uh, the folks that were at Joe Fest and, um, uh, you know, it, it really was special. That was a special show. I don't, I haven't found anyone who hasn't had a fantastic, didn't have a fantastic time. I had a great time. Uh, I saw Bart there. Speaking of having a great time, saw Bart had, uh, a cigar with Bart out on the, uh, by the, um, amphitheater. His was apparently better than mine. I couldn't even finish mine. It was nasty. Um, but it was nice to see Bart. Uh, but yeah, it was, it was a lot of fun. And when I got home, I was like, when can I go to the next one? I want to go to another one. In fact, if I could just not work and just go from one show to another, I think that would be fun. I could, I could live that lifestyle going from one show to another.  Plus I love to travel. But you know, that's not how the adult world works. So, you know, so I go, I'll go to as many as I can. The expectation is, is I will make it to Dallas and I'm going to do my sincere best to make it to Des Moines. I've been to two assembly required shows in Des Moines. Really enjoy both of them. Lots of fun. Uh, Bart says, Hoodie Con 2024. Absolutely. Hoodie Con 2024. I have no idea, uh, when or what we will do. But Hoodie Con 20. Oh, thank you, Joshua for the super chat. Shout out to Mary Ann for her footage. Thank you. Thank you, Josiah. And thank you, Mary Ann. I did put up the, the Joe Fest video. Mary Ann got a lot of that video, a lot of it. And I absolutely could not have done it without her. So I have thanked her. I've thanked her more than once. I will thank her again because she is the main reason that that video exists. So, so absolutely. And thank you, Josiah. And thank you to Mary Ann. She had a blast. Is she? Hey, are you still in here? Yeah. Oh, she's still in there. Well, she's still in the studio audience. She has said on multiple occasions that she had a really good time. Now, assuming that she's telling the truth, then our hope is that she will be back next year. In fact, I think she has to be back next year because her and Jason have a contract, an agreement to participate in karaoke. In fact, there's a specific thing. I don't think I'm allowed to say what it is, but there's not yet, not yet, but there's. Yeah. She's listening to me IRL. She's listening to me the old fashioned way through like sound waves through the air, but her, her internet service isn't very good. So she can actually type in the, in the live chat. But yes, the expectation is that she should be back next year. And that she's supposed to do a duet, a duet, a duet with one of your other GI Joe fan creators one of your other GI Joe Cobra convergence participants, which I absolutely will record every second of it. And you better believe that's going up on the internet. Absolutely it will. That's, that's, hey, it's going to be, it's going to be great. It's going to be great. But yeah, her service is spotty, as she said there. And Hans Chow, the, yes, Hans Chow was great. Also, Ritz Murphy apparently did good. I missed that. I missed it. There was a lot going on. I missed it. But that's, that's what, that's what we were told is that Hans and Ritz absolutely killed karaoke. We're talking about two very talented people so talented it's basically unfair. And, oh, hey, yeah, it's Diana. Hello Diana Davis Diana Davis says sorry I'm late I was talking to my mom I was talking to your mom too. I don't know why I said that I'm I apologize that was that was uncalled for hi Diana nice to see you thank you for being here. I wanted to say, since we've got a few more minutes here we've gone over Cobra convergence. Okay, before I do this before I do this, I do want to say one more thing about Cobra convergence. You are not on the calendar, but you still want to participate. There is a link at hcc788.com, say it right hcc788.com with instructions of how you can participate, even if you're not on the calendar I want everyone to do something. Within the sound of my voice, I would like for you to do something for Cobra convergence seven. And I will be doing a promotional video every week just like I did last year, where I will get clips and images of your thing. And I will put it out there so that everyone can see it. Also, if you'll tag me, tag me, then I'll share it. So I want as many people as possible to participate and I want as many people as possible to see what you do when you participate. So I wanted to make sure that I covered that because we've got a full calendar. We've got a full calendar of folks doing Cobra stuff this year, but it needs to be everybody. I would like everyone who is a fan of G.I. Joe, anyone who's ever heard of Cobra, anyone who's ever had one of the toys in their hands, read a comic book, seen a TV show, anyone who has anything and any desire to do something for Cobra convergence. I would like for you to do it. This is supposed to be an event for all of us, or at least as many of us as want to participate. So please consider that. Please consider if you have any creative anything. I don't know if you write, if you make videos, if you draw, I don't know if you create something. Then please consider participating in Cobra convergence. Again, there's a list of instructions. Link is at hcc788.com. So please, please participate if you can. This is, it means a lot to me. It really does mean a lot to me when I see a lot of folks getting into Cobra convergence, doing their own thing, kind of spreading the word, but also being creative themselves. I love that. I will never get tired of that. I love that. That's one of the reasons I love doing it. So please, please consider jumping in and doing something for Cobra convergence and make sure you let me know about it so that I can share it and include it in the weekly promotional video. Now, now that I'm short on time, WWJD says, even if it's deep GI Joe, yeah, absolutely.   You can do big deep or a little deep as many deep as you want. You know what, as many deeps as you want, you go and do it, right. And Mr. S is not watching. So I can do those double entendres tonight. I can, I can do blue, Cobra blue. So, Comma Trope says hoodie the snow serpent and grunt leak on sale tomorrow we get drunk. I probably will get grunt. I really like that they are doing the 82 characters in classified. I started in 1982. I know a lot of those 1982 figure designs were rather plain by the standards that we later got, but I'm still very partial to them. So I'm really glad they're doing grunt. I'm glad they did breaker. I'm glad they did rock and roll.  Yeah, anytime they do an 82 character, I will probably get it. I'm just I've got a lot of nostalgia for those 82 guys. So now I've got to wrap up. I can't go long right because what's on Joe mind is going to start right after this. I did see that grunt looks like he's going to come with a steel brigade not exactly steel brigade because somebody else has the steel brigade trademark now but generally speaking, the steel brigade look helmet to army build which is an intriguing idea. Bart Bart said he would do scarlet to I I won't tell anyone. In fact, I don't think you have to worry about that getting out because nobody's watching this anyway. I think I'm sure this this is basically a private forum so nobody else tell no one. I wanted to say, I want to spend the last few minutes talking about Mary Ann my significant other, my girlfriend, who I think is absolutely fantastic. She was great at a Joe Fest. She, you know, she participated she had lots of energy she you know, I mean she has a great personality anyway she has a great sense of humor. She got along with everyone.  She is a very delightful person. I consider myself very lucky to be with such a delightful person. And we are coming up on eight months, eight months of dating and eight months relationship so far, which some of you folks have been like married for years or whatever that may not seem like eight months. But, but consider this like those eight months have both flown by and felt like they've taken a long time because we've done so much. Right. We have done a lot in those eight months, including this this huge trip to to Georgia that we did together. And, despite like spending every minute with each other for six days, you know, we still want to see each other is no fighting no bickering, we still really enjoy each other's company and so I to Mary Ann, who is is watching in real life. And listening through the sound waves going through the room. Thank you. And thanks for being awesome and thank thank you to everyone who met us at Joe Fest for also being really kind because I really wanted Mary Ann to see that side of the community. I knew that we have a lot of people in the community who are just really great folks, very positive, very friendly and you guys showed that you, you did it, you did it. So thank you so thank you. Thank you to everyone who helped make Mary Ann's experience, a good one. But thank you to Mary Ann for for making my experience a good one so with that. I have to sign off because I cannot go along. What's on Joe mind is right after this I'm all I will turn it over to the Watson Joe mine. They're they're live shows be starting in just a few minutes. Cobra Convergence seven starting in July running all through July we have a full calendar of presenters it is at hcc788.com also at that same website. There is a link with instructions if you want to participate even if you're not on the calendar, you can still participate and I strongly encourage you to do so. So please check that out. Thank you to everyone who is participating in Cobra Convergence. Thank you to everyone who watches and follows Cobra Convergence. You make this special. So thank you very much. And with that, I will say good night everyone see you all next week. See you on what's on Joe mind rolling over I'm not gonna be on there but I you should be watching it so I'll see you there watching it. But I'll but catch what's on Joe mind next and I will see you all later. I need to stop mumbling and just just say good night. Good night. Say good night Gracie. Bye. See you.


How do narcissists react when you know who they are, when the narcissist knows that you know? When they know that you figured them out, how do they react? Before you had figured them out, you were susceptible to their revelation. They were able to use you to meet their needs. You were an excellent source of supply for the narcissist, but once you figure them out and they catch on that you have figured them out, you're no longer a good source of supply. Because you are holding them accountable for their actions, you're not seeing them in the way that they want to be seen. You're seeing them as they are and that is not something they want to deal with. They don't want to be accountable. They don't want to be exposed for who they actually are. They don't want to take responsibility for themselves. Narcissists need constant validation. They cannot deal with people holding them accountable. They cannot deal with people telling them that what they did was wrong. They cannot deal with you not giving them attention whenever they need it. They need the relationship to be all about them, often at the expense of your health and well-being. They need to be able to control you. They need to have influence and authority over you. They have to control how you think of them and how other people think of them. There's nothing more important to a narcissist than their image of reputation. They care a lot about how people view them. They need to be able to get you to do what they want. As though if you do what they want then they will be happy. This is their narcissistic supply. When you're telling them everything they want to hear. When you're giving them whatever they want whenever they want it. When you don't hold them accountable for anything. When you act as though they never do anything wrong. And you just forget about your own feelings and needs. And just focus on theirs. They do all of this because it minimizes the risk of abandonment. It minimizes the risk of you leaving them. Narcissists feel very vulnerable. They always feel like they're at risk of danger or harm. Or they're at risk of losing their supply. And that is why they always have to be in an authoritative position. Where they can give orders and make demands. But when you stop following their orders. That is when they're going to realize that you know. That is when they're going to feel like they're at risk of losing their supply. They will become very angry. They will try to punish you. And most of all they will try to prove you wrong to the people around you. When they know that you know. They will often discard you and then immediately find someone else. They will display their new relationship on social media. In an attempt to provoke envy within you or to show defiance. They will tell all of their friends and family. That they're so much happier with this new person. Because they need to convince everyone. That you were the problem. But none of this has anything to do with you as a person. There was nothing you could have done differently. Narcissists are very weak and insecure. They will do whatever it takes to dodge accountability for their actions. And when they know that you know. They will leave you like you never existed. Like you never meant anything to them. Because you're no longer susceptible to their manipulation. You're no longer a good source of supply.   So don't think that this has anything to do with you. Don't think that you're not good enough. You were better than they deserved. And nothing good comes out of being around a narcissist. Be thankful that you have this awareness. Be thankful that you have figured them out. The narcissist may have discarded you. But that is actually a blessing in disguise.  You weren't willing to be their doormat. Or their emotional punching bag. When the narcissist knows that you know. It will cause a narcissistic injury. Which will then be followed by a narcissistic rage. At this point their mask is all the way off. And you are face to face with something so unpleasant and disagreeable. Something so immoral and harmful.  The monster. An inhumane, cruel, violent and depraved person. With brutish and untamed characteristics. A savage. A barbarian. Someone so fierce, violent and uncontrolled. Someone so vicious and aggressively hostile. You will see things that you may never have seen before. You may never have imagined that a person could even act in this way. It's like they become the exact opposite. Of everything they were in the beginning. When they experienced narcissistic rage. They can become very dangerous. Because you have taken away their supply. You have taken away their source of validation. You have removed yourself. And just by seeing them as they are. Rather than how they would like. They feel like you are trying to expose them.  You are no longer validating the illusion that they were trying to portray. Which is something that maybe no one else has done before. By you just seeing them as they are. It's enough to trigger narcissistic rage.  It's their way of trying to deal with the situation. Because now they feel like they're not perfect. They feel like they're flawed. When the narcissist is trying to portray an image of perfection. As though they never do anything wrong. Which is why when you see them as they are. And you point out false and mistakes that they have made. Or even if you just try to give them constructive criticism. It can make them really angry and upset. When the narcissist experiences narcissistic rage. They will say and do whatever they think will hurt you the most.  They will bring up stuff from your past. They may damage your property. And even become physically violent. They will deny anything that you say. They will project their insecurities onto you. They will shift the blame onto you. They will gaslight you. They may even try to smear your name and ruin your reputation. Or they will play the victim. They will act as though you didn't do enough for them. You didn't understand them. You didn't treat them right. Even though you may have gone above and beyond. To meet their demands and expectations. Nothing is ever good enough for the narcissist. They can never be satisfied. They will always have a bone to pick with you. They will always have a reason to argue or disagree. They will always have a reason to be annoyed with you. So they will use that to play the victim role. But it really depends on your individual narcissist. And your situation.  Once some time has passed. Their rage may become less intense, violent or severe.  They will go back to the love bombing. They only got angry because they were trying to gain control over the situation. So once some time has passed. They are going to start being nice to you again. In an attempt to gain control over how you think of them. Or how other people think of them. It's all part of the cycle of abuse. They still know that you know. But they just see it as though they have to win you over. They have to make you question your perceptions of them. And this is what creates that cognitive dissonance. It creates two conflicting beliefs. Where you question yourself and wonder if it's you. If maybe you said something wrong or made them angry. But while they are playing the nice character again. They are going to be looking for ways to discredit you. To make it seem like you are not a good person. Or that your views and opinions aren't to be trusted. They have been studying you for a long time. They know how to get to you. They have made mental notes of every thought and mistake that you have made. Of anything that you have confided in them. Because they knew that one day they were going to use it as ammunition against you. They knew that they were going to use it to tear you down when you finally figure them out. They will push and provoke you until you finally react to them. They get a kick out of watching you suffer. And it makes them feel better about themselves. It makes them feel like they are not the problem. But as soon as you react. They are able to calm down and point their finger at you.  If you question or confront them on it. They are only going to deny it.  They never did what they did. This is designed to create further confusion.  So that the narcissist is able to gain further control over you. They will try to take things away from you. Whether it's your money or children. Because they just want to hurt you. When the narcissist experiences narcissistic rage. They will say and do whatever they think will hurt you the most. And they are doing this because they feel exposed. Because they know that you know who they are. When the narcissist knows that you know. They are going to rage at you. Because they believe that they can get away with it. They believe that you are going to tolerate it. And as long as you remain in their presence. You are tolerating it. You are saying that it's okay for them to talk to you in that way. You need to teach them how to treat you. By not tolerating their behavior. When the narcissist is experiencing narcissistic rage. You need to walk away. You need to show them that you are not going to tolerate that behavior. They may play the victim.  Whatever you do. They are not going to reflect on their behavior. Or understand that what they did was wrong. But they will think twice. The next time they do that. Now that you have made them realize that there are consequences to their actions. Now that they know that you are not going to tolerate it. Now that they know that you are going to leave if they disrespect you. When you leave. They will hoover you. They will try to get you back by using love bombing.  To being this kind caring character. Who only wants the best for everyone. They will try to make you feel guilty. They will provoke fear within you. Whatever it takes to get you back. But you need to enforce strong boundaries. You need to hold them accountable. And once you stop letting them talk to you however they like. Once you stop letting them disrespect you. They will be forced to find another source of supply. They will be forced to find someone else. Who will listen to their endless rants. Someone else to use as their emotional punching bag. Because the narcissist needs supply. They need validation. And once you figure them out. You no longer a good source of supply for them. So the only option is to find someone else. Because they don't want to deal with the truth. They don't want to deal with reality. But while it may seem like they're discarding you. They're actually just discarding themselves. And that is why they don't stick around. When you know who they really are. Once you put the mirror in front of a narcissist. You may never see them again. They won't want anything to do with you. Because they don't want anything to do with themselves. Thank you for watching. I hope this video isn't with you. Please like, comment, share and subscribe. Click the bell icon to receive notifications. For my future videos. Check out the new Narc Survival website. At www.narcsurvival.uk Where you can read my blog posts, book coaching sessions and join a support forum. If you would like to donate. My paypal link is in the video description. Coaching inquiries. You can email me at coaching.narcsurvival.uk Thank you for watching and I'll talk to you soon.


Hello everyone. Thank you for joining this session. My name is Mario Vazquez. I work for VAHEAD in the Telco engineering group, helping our partners and customers to run their 5G workloads on OpenShift. And today with me I have Alberto Lozada. Thank you Mario and thank you everyone for joining this session. My name is Alberto Lozada. I work at Redfield as a senior software engineer currently focusing in the telco space. So my background is mainly systems administration. I work as a security consultant long time ago. And for the last 5 plus years I have been involved in Kubernetes and OpenShift. So in these 40 minutes, 45 minutes presentation plus questions, we will deal with the security context constraints, short and SCCs in OpenShift, which is a huge and dense topic. So the main goal after this presentation is that you understand how SCCs can help you to limit the permissions given to your applications and how your applications can run or how you can configure them with the minimum required permissions in the OpenShift world. So let's move to the what are SCCs. So let's put some context first. So historically Kubernetes didn't have any way to apply security policies to the applications that were running in your cluster. So basically all applications could get high privileges. They could run as privileged container, which means that they could use any current capability. Any Syscall can make any Syscall pretty much the same as a privileged process in your system. So Red Hat, since it wanted to be a Kubernetes offering for enterprise customers, so realized that lack of security policies to have some kind of control of what applications can do in the Kubernetes clusters. So SCCs were included into OpenShift from the very beginning and they are still an OpenShift thing since they were not merged into a Kubernetes upstream. Unlike role-based access control, for instance, which started being OpenShift-specific and now it's part of Kubernetes out of the box. So by default OpenShift scans with SCCs. So when you install an OpenShift cluster, it comes with eight SCCs actually that are thought to cover most use cases. It is worth mentioning that there were some similar security controls introduced into Kubernetes like the pod security policy, but didn't flourish. I mean, the currently PSP is appropriated in Qube 1.21 and also there are some other proposals by the community. Here you can find a link in the slides if you are interested like the pod security admission and there are others like the OpenPolicy agent which some folks are using as a replacement. But what are SCCs? What are security context constraints? So similar to the way that role-based access control controls user access and authorization the administrators, the cluster administrators can use security context constraints to control permissions for pods. So these permissions include actions that a pod, a pod in a collection of containers or one container, so actions that a pod can perform. For instance, it can change the owner of a file or the pod can run as a root but also include the resources that this pod can access from the node it is running. It can access to the network, to the host network or even to the file system of the host the pod is running. So SCCs is a Kubernetes resource that defines a set of conditions that a pod must run in order to be accepted into the system. And I want to be clear here, so SCCs are not added directly to a pod. They are assigned to users, so this user or service account is the one responsible for running the application for running the pod and those permissions or restrictions are somehow transferred to the pod. Okay, so it's important to note as well that SCCs are managed only by cluster admins in OpenShift, so cluster admins can create, delete or modify SCCs. And here you can see a list of things that SCCs can do. So an administrator, when they create the SCC resource, it can control if a pod can run privileged containers. So, I mean, with that I mean, even if the user sets the security context specification of the pod as privileged equals true, so the developer configures the pod specification and sets this flag to true, if the SCC does not allow it to do that, then the pod will fail to start. I mean, so there are other things that an administrator can control, like the capabilities given to a container, the SC Linux, the user ID, the user that is running the container, etc. Summing up, I mean, so I want to be clear here, so summing up with SCCs, you control a lot of permissions that your application may or may not have, so one of these permissions that can be managed, for instance, are capabilities, or set in another way, so in an SCC resource, a cluster admin can add, remove or allow to add capabilities in their specification section. So what are Linux capabilities? So let's explain them a little bit first. So in traditional Unix implementations, previously to kernel 2.2, there were two categories of processes, I mean, privileged processes running with effective UID 0 that can bypass all kernel permission checks, and there are another kind of processes called and privileged whose permissions are always checked to be sure if it can execute the task that they were requested. So the idea of capabilities is simple, so just split up all the possible privileged kernel calls into groups of similar functionality. So then we can assign the processes only the subset of privileged kernel calls they need instead of the whole cake. So I think the picture represents here very well the concept. So we can see how in previous kernel 2.2, root had all the permissions, then it were, I mean, the permissions were divided into groups of capabilities, and then it is possible, even possible to restrict capabilities from even the root user. So we can see in the last picture that the root user doesn't have all the capabilities, all the permissions. And remember, so I think this is the takeaway here in this slide. So the power root doesn't come from having the name of root or for having the UID 0. So the power root is based in a concept inside the Linux kernel called capabilities. So in OpenShift, you manage kernel capabilities that are given to your application through SCC. So for instance, here you have a few examples of capabilities that can be managed in OpenShift, for instance, the NetRow, which is used to manage row and packet sockets. For instance, the ChanChowner, which makes arbitrary changes to UIDs and GIDs. You have also the famous NetBindService, which I think it's required, it's needed for allowing the users to open up a port below 1024. And from network capabilities, for instance, comes to my mind the NetAdmin. Also, it's important because it basically adds no restriction in controlling network interfaces or configuration. I mean, you can configure the NIC to cop tour traffic. It allows you to configure the NIC to control traffic. So in OpenShift, some of these capabilities are configured by default in the Cryo container runtime. I mean, if you are interested, you can take a look at the Cryo-enabled default capabilities in the link included in this slide. So these default capabilities that are included in Cryo are assigned to every container, but it doesn't mean that they are effectively included to all containers. So actually, as I mentioned, the SECs can add, can drop or allow capabilities to your applications and you can end up running your application with less capabilities than the default ones given by the runtime. So that's, for instance, the case of the restricted SEC that we will see later. Another important concept is that capabilities are handled at runtime and are independent of the container image. So you can launch a development version of a container and give it tons of capabilities in a development lab, for instance by assigning a permacive SEC, but then launch the same container in production and assign a different SEC which gives a very few set of capabilities. So SECs in OpenShift makes it easier to manage capabilities. And yes, finally, last but not least, there is no magic tool that will tell you which capabilities are actually required to your application. So it is or should be the developer of the application who is in charge of knowing the capabilities that are needed to run the application. Another security feature that can be managed by SEC are the secure complete profiles. So SECOM can be seen as an instead farther in setting the minimum required permissions to your app. So as written many times, I mean containers typically run a single application. So SECOM or security complete profiles allows for filtering the CIS calls directly, the CIS calls invoked by that process and then can be used to restrict which CIS calls are given application is allowed to execute. So previously we talked about capabilities which can be seen as a group of CIS calls and now we are dealing with CIS calls at a much lower level. So SECOM broadly set can be seen as a firewall on CIS calls. So you are actually allowing or denying CIS calls from your app. And there are many projects that are actually using this technology like Android, Chrome or Flatpak etc. OpenShift ships with a SECOM profile that is used by default unless otherwise specified and can be found in each node in the ATC cryo SECOM.json file. We will see an example of the format of this file in the next slide. So the default SECOM profile limits a lot the number of available CIS calls. Of course it can be replaced that you can create your own SECOM profile into the nodes and then create a new SEC to select the proper SECOM for your needs. Creating SECOM profiles that it has been mentioned with capabilities require the knowledge of the application. I mean knowing CIS calls, the CIS calls that are executed etc. There are some tools like the OC SECOM BPF project mentioned in the slides and this project sets up a potman hook and intercepts the CIS calls executed by the container. It will even list them in a JSON file which is ready to be used as a SECOM profile out of the box. So it is worth taking a look at the project to understand better SECOM and CIS calls that are used by your application. And also it's important to happen to many of us when make sure if you are using this project when creating SECOM profiles you are using it with potman so select the proper runtime of your Kubernetes distribution since different runtimes may execute different CIS calls. So in case of OpenShift it is using the run C container runtime under the hood. So this is an example of the SECOM profile JSON structure that I mentioned before. So see at least for me it's like a firewall configuration so there is a default action if the CIS call is not in the list which in this case is the action equals to ERNO which means the night. Then it comes the different architectures applied. Notice that the architectures are important since CIS call IDs doesn't have too much CIS call names in all architectures. And next we have the right list of the CIS calls explicitly allowed in this case. So finally and recently as well you can use also the new action called NCMP-ACT LOCK to find out which CIS calls are required by your applications. I mean you can use the project that I mentioned in the previous slide but also you can use this in a similar way as a Selenium experiments if not for me. I mean this lock action will allow all CIS calls. I mean no one is denied and will lock the ones that are not explicitly allowed to an audit lock file. So then you can take a look at this audit lock file and check those ones that probably you need to explicitly include, explicitly allow in your application. Okay so until now we describe it with our CIS. We define what are capabilities and second profiles and we also know that they can be managed by CIS. So next what we are going to do is visit the eight default CIS that comes in OpenShift. So these are the ones that comes by default with any OpenShift installation. We will go deeper into each one but although these are expected to cover most use cases as mentioned it cluster admin can create custom SCCs to meet their needs. One thing that is important is please do not edit, delete or change these eight ones. Do not modify them since it can cause damage to your cluster. I mean take into account that there are OpenShift infrastructure components that are used in these SCCs as well. So if these eight of the ones that are here doesn't meet your requirements please create a new one. So the first one is the restricted SCC. So this is the security context constraint used by most of the pods and the most restrictive as its name implies. So it is granted by default to all authenticated users. So this means that if you create an account, I mean a user or service account this SCC will be granted and not only this one to the new user. So in the case where this SCC is applied to the user running your pod or pods the restricted will ensure that the pods cannot run as privileged so it will also ensure that the pods are running with a pre-allocated range of UIDs instead of UID 0 or any other user ID or I mean UID 0 I mean root. Same for the MCS, I mean the Multicategory Security which is part of the levels SC Linux context. So you are forcing your applications to run with a pre-allocated SC Linux label assigned to the namespace and cannot be changed with the restricted SCC applied to the application. However, this SCC actually allows to use any supplemental groups to your pod so in case you need for instance accessing to share a network storage you will need a supplemental group so you can mount this storage remotely. Obviously the restricted one does not allow you to access to the host file system or host network directly. So this is the most secure SCC and it should be used always if possible. Second one is the Any UID SCC which provides the same features of the restricted SCC but in this case allows users to run with any UID and any GID so this means that you can set in your pod configuration that you want your applications to run as a specific UID even as UID 0 so if running as root then it means that the container process is running as root in your node, I mean both inside and outside the container. So however, don't panic, I mean take into account that SC Linux also plays an important role here at INAA, a layer of protection to the node. The third SCC is the Host Access. Host Access permits access to all host namespaces which means access to the node file system, PIDs, IPC and network. However, it still requires pods to be run with a UID and SC Linux context allocated to the namespace. Anyway, this SCC should only be used by trusted pods so grant with caution. Next one is the Host Mount Any UID so it provides all the features of the restricted SCC but allows host mounts and any UID by a pod. So this is primarily used by the persistent volume recycler but if you are using for something else be careful since you can mount host volumes and also set the UID GID of your container to any. The fifth one is the Host Network SCC it allows using host networking and host ports but still constraints ports to run with a UID and SC Linux context allocated by the namespace. So this means that with this SCC you can execute pods that will be able to see, use and attach the node network directly. So an example in OpenShift of a pod or of an application that is using this SCC is the router pod which uses this SCC to listen in port 80 and 443 in the physical network of the worker nodes. The next one is the Node Exporter this must be used only by Prometheus as you can see has a lot of permissions host access to file system, PID, network plus running as any user so please do not use it it's used for monitoring only. The sixth one is non-root SCC so this is exactly the same as the restricted one but in this case you can configure your pod to run with any UID except root or UID 0 I mean we can say in another way so it's exactly the same as any UID but you cannot use 0 I mean you can choose any other UID except being root so this is mainly used by applications that need a predictable user which is not root and there is no other permission required so I can imagine for instance a posgres database container that requires a specific user or maybe an image, container image that has been built with a specific user and cannot be changed to run with the ones that are preallocated by OpenShift and finally the privilege container I mean it permits as you can see access to all privilege and host features and the ability to run as any user any group, any FS group and with any cylinders context so it is clear that's the most relaxed SCC and should be used only for cluster administration so this SCC allows a pod or a container I mean to control everything in the node is running so only trusted workloads should use it and even we can discuss it if it makes more sense to create a custom one a tellerate SCC that meets the requirements of your app application and as an example of applications that are using this privilege SCC in OpenShift is the tune-D operator or tune-D application since it needs control to the host in order to apply the different tune-D profiles and it needs access to low level configurations and I would like to note here that even if your application is using the privilege SCC it doesn't mean your pod is privileged I mean you must explicitly configure the pod to demand that privilege and now we are going to talk about OpenShift SCC strategies and I will hand it over to Mario Thank you Ruto So in this slide we are going to introduce the different annotations that are used by SCCs so in OpenShift every name and space will get three annotations related to SCCs by default so the first one is the MCS one which basically defines the Selenux MCS configuration that our pods will get by default then we will get a group a range of supplemental groups groups IDs that we can use so in this case this will be the first group ID and then we have 10,000 more groups IDs that we can use after the first one and the same goes for the UID range so we get a range of UIDs that we can use in our pods this will be the first one and then we have 10,000 more okay and then the objective of these annotations or of these settings is to provide a better isolation between projects so for example every project or name and space will get a unique Selenux context and UID, GID range so other name and spaces or projects cannot use these ranges on their applications next we are going to introduce the different SCC strategies that we have SCC strategies control the security features that a pod has access to there are four different SCC strategies so the first one that we define is the run as user which basically controls which user IDs can be used by the containers in our applications there are four different configurations the first one is must run as which basically defines a specific UID that has to be used by the application the second one is the must run as range where we define a range of UIDs that can be used and any UID between that range inside that range can be used by the applications then we have the must run as non-root which means that every UID can be used but the UID 0 which is the root UID and then finally we have the run as any which basically means that you can run as any UID including roots UID 0 next we have the selenux context which basically controls which selenux context is used by the containers as we mentioned earlier our name and space will get will get assigned one default MCS setting that's what will be used if we are running in must run as mode then we have the run as any where we could change the selenux MCS configuration for our pods then in supplemental groups these controls which file system groups are added to the containers supplemental groups and this is mainly used for search threads there are two possible configurations must run as and run as any in the next slides we will get into the details of the supplemental groups and on the next setting which is FSROOP so FSROOP basically controls which file system groups are added to the container supplemental group it's used for block storage mainly and again it has two possible configurations must run as or run as any next topic is the privilege escalation so the allowed privilege escalation controls whether a process can gain more privileges than its parent process so this boolean directly controls whether the non-imprips flag gets set on the container process this setting, the allowed privilege escalation will be always true when the container runs as privileged container or has the cis-admin capability and this boolean that we are talking here the non-imprips is consumed by the system calls as you can read in the current documentation then the Kubernetes design proposal for getting this boolean added can be found in the link in these slides and then if we have a process that has the non-imprips what will happen is that that process or their children cannot gain any additional privileges the process cannot un-set this boolean once it has been set process cannot change UID or GID or gain any other capabilities even when you are using set UID binaries or binaries with file capabilities and then Linux security modules like Selenix can only transition to a process type with fewer privileges and you can continue reading about this in the link on the slides but still this might sound scary but being able to run privileged escalation operations is required under certain circumstances like for example when your application uses set UID binaries or when your application uses binaries with file capabilities you can see some risk but in this case even if file capabilities can cause a privileged escalation we have great tools today to avoid pods from getting such capabilities for example via SCC where the restrict SCC that's a pretty good job limiting the number of capabilities available for pods by default on the other hand we have the becoming route or executing as route problem which in this case SCCs are not helping that much since all the default SCCs that we have in Opensiv have this setting a low privileged escalation set to true to maximize compatibility with the applications so what can we do about this second risk so the Red Hat Security team is working on the creation of a more restrictive default SCC so that work can be tracked on the link on the slides and at this point if you want to drop privileged escalation you should create a custom SCC until we provide a more restricted default also you should avoid using set UID binaries and use file capabilities instead so instead of running as route for example just provide the minimum required capabilities to your applications and as a last resort you can configure it out of the rules that can lock this except V calls where the effective UID has changed to zero to keep track of containers abusing set UID sudo to become route on your applications right so now next next thing is how can a workload get access to use a specific SCC there are two ways that a workload will get access to an SCC the user creating the workload has access to that SCC or the service account used by the workload has access to that SCC for example and this is a common pitfall in Opensiv Red so when creating regular workloads on Opensiv deployments, stateful sets demon sets etc the pod is not created by the user who sends the deployment to the API so if I'm creating the deployment I'm not really creating the pod right so the deployment will create a replica set and the replica set will create the pod which means that in this case the only way of getting access to the SCC will be if the service account has access to it that our deployment or our workload requires any UID and the service account assigned to that pod or to that deployment actually does not have access to the any UID SCC so that pod won't run even if I'm logged as class should admin and I have access to any SCC it won't work because I'm not the one creating the pod on the other hand when you create a pod directly so you're connected to the Opensiv cluster using the CLI or using the web console that user might have access to different SCC so if I create the pod with my user then now I can get access to any SCC which basically means that even if the service account assigned to the pod does not have access to a specific SCC if my user has the pod will be able to use it so before moving on the common pitfall is that sometimes people try things like I'm going to create this pod and let's see if it works and the pod works because that has been created with a user which is class should admin for example and then when they move from a pod to a deployment and then try to create the deployment again with their user it fails and that's basically because at that point the user is not the one creating the pod anymore it's the replica set and the replica set will have a service account defined and that service account defined should have access to the SCC okay and now that we know how an workload gets access to an SCC next thing we need to know is how SCCs are ordered so if we have access to more than one SCC how opens it decides which SCC gets assigned to a workload so the first thing that will happen is that when we create a workload an admission controller will create a list of potential SCCs that can be assigned to the pod based on the pod specification and the SCCs that the user of the service account creating the pod can use okay then for example the pod spec says that the pod must run as root then any SCC that can be used by the service account assigned to the pod which allows the pod to run as root will be added to that list okay let's say that in that list we have three SCCs that allow a pod to run as root so now we need to order those three and pick one of those three so once that potential list of SCCs is created then the SCCs in that list will be ordered as follows so if the SCCs have different priorities then the ones with the higher priority go first if priority is the same the most restrictive SCC will go first and if priority and restriction level are the same then they will be ordered by alphabetical order so that's how you will pick one SCC so the one on the top will be the one that will be assigned to the pod so we introduced the concept of admission in the previous slide so now let's review what's an admission controller not in very detail but just a basic explanation so as you might know, Kubernetes has admission controllers which validate requests before they get persisted into ETCD in OpenC we have an admission controller that takes care of configuring the proper SCC on every pod in the cluster the code for this admission controller can be found here and then the workflow of an API request and how it gets through the different admission controllers can be seen in this diagram below so whenever an API request gets made it gets authenticated and authorized it will get through the mutating admission controllers which basically will mutate the request we'll see an example in the next slide then we will run the object schema validation since we mutated the request we need to make sure that it it can be validated against the schema and then we will get through the validating admission controllers which will run some validation on the objects and then finally if everything goes well it will be persisted to ETCD and at that point the controllers will start reacting to that change so the mutating admission controller have you repeated that workflow like a deployment or a pod without specifying any security context and you wonder why it worked so that's for example because the admission controller mutates the pod definition and adds the correct information for example the SCC admission controller will make sure that the pods run with the least privileges possible by default so for example in these examples below the number one is what we send to the API server so as you can see we didn't specify any security context and then in the number two figure this is what we got persisted to ETCD so as you can see we got the security context information added by default so this was done by the mutating admission controller so now we want to talk about common pitfalls with SCC ordering so let's go for them so let's say that you have a container image that's based on its metadata that's based on its metadata runs as root but in the pod spec you don't specify it providing that your service account has access to two SCCs and both have the same priority one that allows pods to run with UID 0 and another one that forces your pods to use and UID from an range your pod will be assigned to the later since you didn't specify the root requirement in the spec also keep in mind that cluster admin role has full privileges including the one that allows it to use any SCC so this is what we talked earlier about putting pods directly so if you create pods manually with the admin users keep in mind that you can face this issue last avoid assigning high priorities to your SCCs so your custom SCCs this might cause issues in priority decision if you create SCCs with higher priority than the defaults and you don't have the correct pod spec in place so for example if with OpenC we have any UID with a priority of 10 you don't want to create any custom SCC with a priority higher than 10 otherwise you can cause issues ok and now we are going to talk about some Linux capabilities in Kubernetes so as we have been saying capabilities in Kubernetes have some limitations at the moment but we are not using UID 0 on your workloads and that's why you have to use file capabilities at the moment there is an open issue to solve admin capabilities on the community which basically will bring admin capabilities support to Kubernetes and then we will be able to use admin capabilities instead of file capabilities and then last we will be helpful in the future this support has just made it to Cryo and it will take some time to be g8 but this will be also a useful feature when working with workloads that require UID 0 and also capabilities and with that we are done with the theory and we can get started with demos ok so let's get started with the demos so in this first demo we are going to see how a service account can get access to use an SCC by really granting access to the security context constraint to the service account so first thing that we need is a name space so we are creating this name space named SCCfun then we will create our service account which is named testSA1 next we are going to add access to the any UID SCC to the testSA1 service account and now we can check who can use the any UID SCC as we can see we have our service account listed here ok so that's a way that we can provide access to an SCC for one of our service accounts in the next demo what we are going to do is instead of running these commands we are going to create a role and a role binding that will allow a specific service account to get access to the any UID SCC so first of all we are creating a new service account which is named testSA2 and now we are going to create a role in this name space as you can see the role provides access to the security context constraints to the resource any UID and it allows the use of the perfect user ok so next thing that we are going to do is we are going to create the role binding and here in the role binding we are creating this use any UID RB and we are providing access to the use any UID role that we created in the previous step and we are granting this role to the service account named testSA2 and now if we can check who can use this any UID SCC we can see that we have the testSA2 as well on top of the test SA1 that we provided earlier so we can see that we have the testSA2 listed here and then in this last demo what we are going to do is we are going to see how SCCs are ordered in case that a service account can access multiple SCCs so first we are going to create a service account that we will use as a regular user that we can impersonate so it will be test user then we will add the edit role to this user test user so we can create things on namespace next thing that we are going to do is we are going to provide access to this user to the SCC restricted this is not really required because every authenticated user will have access to the SCC but since we are going to use hook and commands if the user has no direct access to this SCC like if it gets this access by an inherited group or something like that it won't sew up so in order to make things easier to understand we are going to provide direct access to the restricted SCC ok and now that we have this SCC what we are going to do is we are going to create a pod as you can see this is a simple pod which is using our test user and it's using a simple application image so now that we have the pod created we can run this command that will tell us with SCC will allow the workload to enter the cluster and in this case we can see that it will be allowed by restricted so we can create the pod as this user ok so we created the pod and now if we set the SCC that was assigned to the pod we will see that the SCC is restricted now let's do something different so now we are going to grant access to any UID SCC to this test user service account ok so now that we have access what happens if we run the SCC review again now we can see this pod will be allowed to enter the cluster by these two SCC's any UID and restricted so our pod specification doesn't have anything that will require it to run with any UID so let's check why any UID has preference over restricted so as we can see the SCC any UID has a priority of 10 while restricted has no value which actually equals 0 so now if we create the pod again so first let's get it deleted from the cluster and now let's get it created again and we will see that the SCC that was assigned this time is any UID because the any UID has more priority than the restricted SCC and this quick way of checking the SCC's for your pods instead of doing the old YAML and then you will get the pod name and a new column which is the applied SCC that will give you the SCC that is used by the pod and this concludes the first demo ok so in this demo what we want to show is how capabilities can be managed by SCC's so in this case we want to run an application that requires to sniff or capture traffic in the pod interface as you may know this requires high privileges ok so then I am creating a new namespace this namespace will I mean the application will deploy will be deployed through a deployment so we are going to create a service account so the service account will be in church of the deployment so we can assign permissions to this capable service account let's take a look at the deployment we are going to deploy an application control issue execute tcpdamp with the service account that we already created ok let's create the deployment and as you may expect there is an error in the deployment so we don't have permissions to execute tcpdamp to capture traffic first let's take a look what the SCC has been assigned to this application as you may know it should be the restricted it is the restricted one actually it is assigned to all the authenticated users to this service account so the service account has been assigned this restricted SCC another thing that I want to check is the user ID so as you may know the restricted SCC doesn't allow to run as root so the the user ID is not root in this case ok so next thing that we can do is execute the the application as a root user and in order to do that we need to create a new deployment this deployment is run as a user in the security context we are another thing that we need to do is assign any UID SCC to this service account because the restricted SCC as I mentioned before doesn't allow to run as any UID that we require so we will check that now the capable service account has two SCCs one with priority 10 which is the any UID so it has higher priority so it will be the one that will be assigned we are now executing again the modified application the participating but there is I mean we are seeing the same issue we don't have permissions so what we are going to do is we are going to access to the POT the debug basically execute the same container but with the bash entry point and in this case we are we are being I mean we are root but we are having we are not allowed to execute the POT so what we are doing now is taking a look at the capabilities assigned and we are seeing that these capabilities it's not I mean the NetROID is not included and that's why because those capabilities are the ones that are assigned by default to all to all the containers by the runtime as we mentioned during the presentation so the next thing that we need to do is we are going to create a new deployment and we are explicitly allowing or adding this capability NetROID to our application but this won't work out of the box because the NetROID SCC as you may know doesn't add any capability it actually drops one and it doesn't allow or add anyone I mean so the next thing that we need to do is copy this NetROID SCC and modify and create any one SCC I mean the thing that we don't have to do is edit and an SCC so we are copying the any UID SCC and we are adding the allowed capability NetROID here so allowing this capability we need to explicitly request it in the in the port aspect so now we are going to create again we are going to create the SCC we are going to add the SCC to the capable service account we are going to remove the any UID SCC because we don't need it anymore from the capable service account and now we are good to go I think we can create the deployment that we are requesting being userID 0 and we are requesting the NetROID capability and as we can see here the application is running we can access to the port all the capabilities that has been inherited and by decoding the capabilities we can see now that the CAB NetROID is included and our application is running successfully so with that ends our presentation


Exercise Red Dagger is a bilateral exchange between the United States Marine Corps Reserve and between 1-3-1 commando unit. We share best practices between the British unit and our unit so we can get better combat engineers out of the process. There's been a range of different activities which they've learned and developed over the last two weeks. The bottom line is interoperability is the way forward. It's the way we're going to be operating in the future so this is really the future of our training. The land navigation is employed by the British commando units tend to focus more on orientation so they move very quickly over the terrain and they will tend to shoot from terrain feature to terrain feature as opposed to maybe navigating specific asmets like we tend to do. The Royal Marines use an obstacle course that's quite a bit longer than ours, a lot more distance between obstacles. More use of water obstacles, obviously our obstacle course doesn't have any. Their obstacle course is just one test of many tests north of them during the commando qualification. The British units and the Royal Marines have a group called Mountain Leaders that are highly trained in mountain warfare so they came in and gave us a one-day training package on basically ascending and descending, sheer cliffs and just very difficult mountainous terrain. Utilizing steel I-beams and wood planking, we built a non-standard bridge. Following the construction of the bridge we were actually able to go down to demo range and place the bridge and detonate it. The detonation was successful, they completely destroyed it. So one of the things we were trying to accomplish in this training period was to take them back to basic MOS skills but also basic marine skills. So we set some time up in the schedule in order to do platoon and company level attacks. It's been about a three-day package so we've been assaulting essentially urban objectives in addition to doing reconnaissance patrols, moving the contact patrols. In this day and age being able to fight with different forces and allies is a key for modern battles and a chance to work with the Americans and get used to using different skills and working together is really important I think. This is an exercise that definitely needs to be continued because there's so much value with learning from the Royal Engineers and how they do things and there's such a professional organization that any time we can get our junior Marines to interact with them there's always going to be value. I really enjoy working with the Americans, all of them have got really good characters and it's been fantastic to see them develop themselves over the last two weeks. Hopefully this relationship continues in the future because it's a brilliant opportunity.