Thank you for this opportunity. I am J.R. Aminathan. I'm the Chief Security and Governance Architect for our Advanced Cluster Management offering. I have with me Yutao. He is the squad lead for our security and governance capabilities within. Both of us work on this project called Advanced Cluster Management for Kubernetes within Red Hat. We also have an upstream community called Open Cluster Management. We're here to talk about just some underlying principles and overall architecture of our security and governance capability. Then we'll delve deep into OPA and Gatekeeper and how that integrates with ACM. This chart basically talks about the various security and compliance challenges that customers face when they adopt Cloud. Specifically, the key thing I wanted to highlight here is customers generally have to meet various enterprise standards as well as industry standards. For example, if they are in regulated industries like financial, healthcare, etc., they have to meet standards like PCI, HIPAA, etc. They also want to adopt open technologies, and they typically have to deal with more than one Cloud provider, and they also need to go through multiple audits. Really what they're looking for is the ability to maintain security and audit readiness on a continuous basis, and they want to do that for an open hybrid Cloud. So our approach to achieve that goal of continuous security and audit readiness is policy-based governance. So what do we mean by that? Typically, if you take a particular Cloud environment, say Red Hat OpenShift Cloud Platform, and you want to secure it, the customer would enable various security capabilities that OpenShift provides out of the box, and they may also want to use some capabilities provided by third-party and some home-grown capabilities as well. And what they would like to do is to ensure that all these security controls are configured to industry best practices or their enterprise standards, and these standards could include standards from NIST, like NIST CSF, NIST 853, and also, like I mentioned, industry segment standards like PCI, HIPAA, etc. So the subject matter expert for a particular control knows very well how to get that control set up, but if you're talking about a SRE or a SecOps person who is responsible for ensuring that the configuration is set up properly, they may not be an expert on all the aspects of security. So how do we make this easy for them? So the way we make this easy for them is by ensuring that these best practices are represented as policies that result in a desired configuration state. So that's the overall approach, and that's what we refer to as policy-based governance. And in order to do this, what we have built out is an extensible policy framework that can be applied across the entire stack. It allows you to incorporate multiple policy languages easily, and so that's what we'll talk about in detail, the Gatekeeper OPA, which is one of the policy languages, and you will also show a demo on how that can be done. And we provide a lot of out-of-the-box content, but we want to make sure that content is customizable, and we need the ability to easily integrate third-party controls, et cetera. So that's kind of the overall approach of policy-based governance. So I want to introduce some terminology here just to level-set what you're talking about here. So if you think about policy-based governance, so there is a policy authoring point where the policy is specified. Now, this authoring point could be either the console or it could be a CLI or it could be GitOps. Our preferred methodology is GitOps. The reason being that allows you to manage policies just like you will manage source code. So you define all the policies in Git, and then within our ACM product, you can define a subscription to pull those policies and deploy them onto the managed clusters. So that is our policy management point. So this distributes the policy. It consolidates policy violations across a fleet of clusters. It also allows you to integrate with enterprise tools from a central point, because that is how customers view the cloud as just an extension of their existing IT infrastructure. So they want the management to integrate with their incident management systems, security operations center, their enterprise GRC tools, et cetera. And then the policy gets distributed to the managed cluster. On the managed cluster, you have policy enforcement points. And these consume the policy and they return the violations. So an example of enforcement point would be the Kubernetes Admission Webhooks and also the runtime controllers, Kubernetes controllers themselves, as well as several controllers that we provide, the configuration policy controller and the certificate management controller, as well as any operator that runs on OpenShift managed cluster can also serve as a policy enforcement point. And one of the examples of the operator is the compliance operator that allows you to implement security profiles on your OpenShift clusters. So, and then the policy enforcement point can optionally invoke a policy decision point to check whether a specified policy matches how a control is configured. Now, in some cases, the policy enforcement point may itself do this check, but in other cases, you could invoke a PDP. And the gatekeeper OPPA integration is one such example and Kubernetes is another example. So based on this terminology, here is the overall architecture. So as you can see here on the management hub, this is where the policies are defined. And as I mentioned, it can come through from gate or it could be through UI or CLI. And then from here, it gets distributed to the managed clusters. And then here you have the various policy consumers. These are essentially the policy enforcement points that we talked about. And then these results are then collated back. And so you have everything available in a central manner. There are a few roadmap items that we are highlighted here where we want the policy framework to associate Ansible Playbooks to trigger automated playbooks for policy violations. And we also want to integrate the policy violations and generate alerts to the observability component, which can then integrate with the enterprise incident management tools. And we also want to route audit logs to SIMS for the security operations center. These are all the orange items in this chart are things that are roadmap items. So now I want to drill down into details of how we have integrated with gatekeeper and OPPA. So let me start with a quick overview of gatekeeper and OPPA. So gatekeeper allows you to evaluate compliance of Kubernetes resources to specify policies. And what it leverages under the covers is OPPA. And OPPA is the policy engine that it uses. Now OPPA itself accepts policies in a language called rego. So think of gatekeeper as providing the bridge from OPPA to Kubernetes, to the Kubernetes world. So it allows you to specify the policies as Kubernetes constraints, which can in turn contain the rego constructs. And gatekeeper can then consume those because it registers itself as a policy enforcement point through the webhook. And so it's now able to pass on those rego constructs to OPPA and use OPPA to do the actual checks of whether the policy is complied to. So two scenarios to consider here. One is the admission scenario. So this is executed whenever a Kubernetes resource is created or operated. And so think of it as once the gatekeeper policy is in place, then any new resources that get created will be governed by this admission control. But what if some resources already exist before you put that policy in place? So that is the second scenario, which is the audit scenario. So the audit scenario allows you to periodically evaluate existing resources against policies to detect any non-compliances. So in order to complete the picture, there were a couple of things we had to do in terms of how we integrated gatekeeper and OPPA into ACM. First of all, we are going to deliver operator that can deploy gatekeeper and OPPA. And so this work is actually progressing in the upstream community. And what we have done is we have focused the community and made it part of our open cluster management downstream. So we will deliver this as part of the ACM product. So one of the cool things about the ACM product is our built-in policy controller, config policy controller can pretty much distribute any Kubernetes CRs. Now the deployment of operators itself is represented as a CR. So by delivering gatekeeper OPPA as an operator, now you can just define an ACM policy that ensures that this operator is deployed on the managed clusters. So we are going to provide that. In addition, you can also use ACM to define policies on what gatekeeper itself is enforcing. So the constraints that I talked about. So those can be also authored within RACM and propagated to the managed clusters. And then as I mentioned, there are two scenarios, admission and audit scenarios. So in both cases, we want to be able to detect policy violations. So in the case of the admission scenario, we just, we have a RACM config policy that can process the events that are generated by the gatekeeper webhook. And in the case of audit scenario, we look for the status field in the gatekeeper constraints. So we are able to pull both this information back as I showed in the architecture into the central ACM hub and display the results there. So this architecture diagram pictorially depicts what I talked about. So you have the RACM hub and then, which is distributing policies to your managed cluster and within the managed cluster, you have the config policy controller. And because we have this built-in config policy controller, the whole integration with gatekeeper OPPA is happening just through the authoring of these policies. So you really don't have to write any code. So we have a policy that we have authored to deploy the gatekeeper operator. So that operator is then watches over this gatekeeper CR. And then it registers this webhook that monitors the audit admission scenarios. And then you will also have a policy to deploy the gatekeeper constraints. So, and then we have a policy, as I mentioned, to detect the violations two policies, one for audit and one for that mission scenarios. So, you is going to give us a demo on these capabilities. But before I hand it over to you, I also want to highlight that we have also, we also have integration in place with ACM for the OpenShift Compliance operator, which is another, an example of an operator that can be deployed on the managed cluster. And through a RACM policy, we can make sure this operator is deployed. And we also have another policy that allows you to specify a profile, security profile that directs the compliance operator to perform the compliance checks and return results back to us. So we'll show a quick demo of that as well. That kind of is the quick short overview. And I have in this chart a link to our OpenFuster management community. And you can connect with us. And ask any questions, et cetera. Before I turn it over to you, I also want to give you a quick demo of our OpenFuster management community. So, as I mentioned, when I provided the overview of policy-based governance, typically you have various controls in place. And the controls could be for security, could be for resiliency, could be for software engineering. And you want to ensure that all these controls are configured properly to industry standards and enterprise standards. And in order to do that, our goal is to codify those standards as policies. And so it's very clear that Red Hat on our own cannot produce all the policies needed by all our customers. So that's why we have created this policy collection repo. So it's a spot for us to collaborate to build out these policies. So if you look at this repo, we have two folders. We have a community folder and we have a stable folder. So the stable folder includes all the policies that are delivered as part of the ACM product. They are fully supported by Red Hat. And these policies are organized in terms of the NIST 853 standard. So you have various controls within this security controls within this catalog. And then for each of the controls, you can see we have defined policies. So, and you is going to show us a demo of the compliance operator policy that can deploy the compliance operator. And also this essentially a security profile policy that allows you to scan the managed cluster for this particular security profile. And then for Gatekeeper and OPA, we have policies as well. And then there is the other folder here, which is the community folder. So the community folder is where we invite contributions from the community. And these policies are also organized in terms of the NIST 853 standard. And the Gatekeeper policies currently are in the community. And the reason is because we are currently working on an ACM release where we are productizing this capability. So they right now sit in the community. So you have a Gatekeeper operator policy that allows you to deploy the Gatekeeper operator. And then we also have other policies for Gatekeeper contributed here as well. So you can see here, we also have third party contributing policies here. So you will see here a policy from Cystic. They have contributed a policy for their operator. So the reason I wanted to highlight this is to invite contributions from the community. So we are also working with various customers to have them contribute here as well. Jaya, if people, I think the OCM team group is meeting on a semi-regular basis now. Have they started the community meetings? Yes, we have started the community. The open cluster management has a community meeting that happens weekly. And definitely invite participation in that as well. So I can include that link as well into the chart. Okay, that would be great. And there's one quick question here before we go to the demo. Tobias is asking if the Gatekeeper community would announce mutating admission controller, will you integrate such an option into Rackham? Yes, so we are active participants of the Gatekeeper community. You who is here on the call with me along with a couple of others from Red Hat are active contributors there as well. So we are watching the space there and our goal is to keep up with any enhancements that are made in Gatekeeper and associate policies in Rackham to adopt those, yes. That's our goal. I am so grateful that you finally said that acronym out loud and it's Rackham because that's a wonderful way to pronounce it. So I'm gonna use that going forward. So thank you. Yeah, that's a good point. Let me clarify. Rackham and ACM stand for the same thing. ACM is Advanced Cluster Management and Rackham is Red Hat Advanced Cluster Management, the same product offering. And our upstream community is the open cluster management community, which is this one. And Ginny just shared a link in the chat for the open cluster management community. There's a projects page in the repo that you can find the agenda and things like that for the upcoming meetings. I'm going to stop sharing now and turn it over to you. Perfect. Yeah, welcome for the questions as well. Thank you. All right, let me share my screen first. So, hi everybody. My name is Yu Tao. So I'm the Dev Lee for Rackham Security and Compliance team. So today I'm going to do a quick demo for how you can use Rackham policy to install Gatekeeper and then apply a Gatekeeper constraint on the managed cluster and then report any violations it detects. So, first of all, let me recap a little bit about the governance and risk architecture in Rackham products. So if you go to our product documentation, there's an overall architecture diagram here. So if you click on it, you will see a large diagram. So the governance policy framework we put in place, it really consists of multiple piece, right? So there's a one piece on the hub and there's a few piece on the managed cluster. So on the left, so on the hub, so we have policy propagator, which is responsible for propagating the policy from hub to managed cluster. So how it does is so when you create a policy, you need to also create a placement binding and placement rule. So if you look at the sample here, so we have a policy CRD, which is the CRD that we use to invent your, the real policy. So if you look at the CRD definition here, so we have a field called policy templates. So inside templates, you define the actual policy you want to apply on your managed cluster. So you can create a policy with multiple policy templates using different policy language. And then once this is created, you also create a placement rule. So since Rackham is managing the control plane, they're managing multiple clusters, right? So when you import a cluster, you can label a cluster. So the placement rule simply here is you can select a cluster either using the label selector. So we call cluster selector, but what really does is it's using labels on the cluster so that you can select a subset of cluster of a divine. For example, in this case, it's all your dev clusters. And then create a placement binding that find the policy and placement to basically tell our policy propagator this policy needs to be applied to these cluster. So this is how we propagate policy to manage cluster. So the reason I explain this is, so this is the framework that to distribute policies and the actual policy that is being executed or evaluated on the managed cluster is we call it policy controllers or policy consumers on the managed cluster. So the framework propagates the policy to manage cluster, distribute them to the managed cluster and then hand it over to the actual policy consumer installed on your managed cluster. For example, the gatekeeper policy consumer or compliance operator or the auto box policy controller that we ship, Recom ship, for example, the configuration policy controller. So once it's reached the managed cluster, the actual policy consumer on the managed cluster will apply, evaluates the policy past in and then generate results. And the policy framework will retrieve those results and return it to the hub so that you can view the results through single control plane using Recom console. So that's the governance framework, policy framework we put in place for Recom. So in terms of gatekeeper policy, so from this big picture, so gatekeeper controller is one of the policy consumer from Recom policy framework perspective. Now let's take a look at the actual gatekeeper policy. So we've talked about that we can use the Recom policy to install gatekeeper and we can also use the Recom policy to apply gatekeeper constraints and then collect the results back to the hub. So this is done through defining Recom policy. So as Jay mentioned, in this policy collection repo, you can find the gatekeeper operator policy and also some, a few other gatekeeper policy that actually applies certain constraints on your clusters. So let me take a sample here. Let me go through in details. For example, the first, the gatekeeper operator. Gatekeeper operator is an effort that we will be actually involved in the upstream community. So what gatekeeper operator does is it packs, it packs the gatekeeper as an open-shift operator. The operator responsible for the lifecycle of gatekeeper. So it can install gatekeeper, it can delete gatekeeper. Of course we are also working on upgrading those kinds of stuff. So it controls the whole lifecycle of gatekeeper. It simply makes installing gatekeeper easier. With gatekeeper being delivered as a gatekeeper operator in ORM or in OCP catalog, you can use Recom policy to install gatekeeper across all your managed cluster. So what you need to do here is you define a policy CR here and then it includes multiple templates. So just very similar to how you install an operator from ORM. So you create a namespace. We define the catalog source. Currently the gatekeeper operator is not published yet. So we have to define a custom catalog source. And then you create a operator group to tell operator which namespace to operate on. And then the subscription to subscribe to the catalog to pull down the gatekeeper images. And then you create this gatekeeper CR. This gatekeeper CR is part of gatekeeper operator. So it tells you how to configure gatekeeper. But if you create this CR, the gatekeeper operator will install the gatekeeper based on the spec the configuration provide. If you delete this gatekeeper CR, the gatekeeper operator will delete the gatekeeper instance on your cluster. So here, as you can see, we are pulling an image from upstream gatekeeper as this. And then we enable the admission events flag so that we can, so that when there's a violation January for any new, when there's a violation January for any new resource created on a managed cluster that is blocked by the gatekeeper, it will generate a Kubernetes events. So this is for the purpose for Reckham to be able to collect the result for admission scenario. So then, so once this policy is created, then it will be based on the cluster selected here, right? So it will install the gatekeeper operator on managed cluster. So for this is the Reckham console. So I have a gatekeeper operator policy installed here. So as you can see, this policy currently is being applied to this managed cluster. So if you go to this managed cluster here, it was, so this is currently being, this policy is being enforced and it's compliant. So this means the operator has been installed on your managed cluster.  And then if you go to operator here, go to install operator, you'll see gatekeeper operator here. So it is so very simple. So you just need to use this operator. You just need to use Reckham to install this operator for you. And then the gatekeeper is installed on a managed cluster. So now let's take a look at the, how you can apply gatekeeper constraints and then report violation back. So installing gatekeeper is just the first step, right? What really has value is, you want to apply gatekeeper constraint and constraint template and then collect results back. So here we, I create a sample, I create a gatekeeper sample policy here. So I think it's easier to look at in here, in this code. In this code, so gatekeeper. So this is from the gatekeeper, this is from the policy collection repo. You can find it in policy collection repo. So same here, we are using the same policy CR to distribute the gatekeeper constraint template. As you can see, we have three templates here. If you look at the details, right? This is actually leveraging the configuration policy, which is the auto box policy consumership in Reckham. So what it does is, what it does is it can create, update, delete resources on the cluster based on the template object that definition you provide. So if you look at the CR fields here, so you create a configuration policy, it has object templates inside the spec. So in this object templates, anything defining this object template field is the actual CR you want to create in this example. So currently we are using compliance type must have, which means you must have an object with this CR. So look at this. So this is a gatekeeper constraint template, right? So basically how we integrate is, if you have a constraint template and constraint CR already, so you can use configuration policy to create it on the managed cluster. So what you just need to do is, you just need to embed the constraint template inside a configuration policy, and then put it into policy CR, which is responsible for distributed across all the managed cluster. So that's how the constraint template is delivered to manage cluster. So you don't have to write any code, you just need to create this policy and embed your constraint template, same for the constraint here. Then the RACOM policy framework will create these two CRs on the cluster, and then gatekeeper instance, the controllers will take over and evaluate these two CR. So if you look at details of this CR, this is a sample namespace constraint template constraint I took from gatekeeper website. So what it does is it requires any names, and this regular basic defines any input resource, needs to have a field called label, and inside that label field, you need to have a label with name, with name, with certain name. So the name is being exposed as a configurable parameter called labels. And inside the constraint, so you're basically applying this constraint template. I'm here, I'm applying any namespace, and also I restrict the namespace to be these two namespace because I didn't want to apply to ordinary space, but if you remove these, it will be ordinary namespace. And then I want the actual labels to be gatekeeper. So for example, so if we want to test this gatekeeper constraint, basically we can just go ahead and create a namespace without label gatekeeper, then it will be blocked. So let me do that. Here, I believe I've already logged in onto the manage cluster. So let me double check. So here on my manage cluster, for this deployment, I'm actually applying to these two namespace. So if I try to create a namespace, if I do this directly, it will create a namespace without any labels. So you can see here, the gatekeeper actually detect that and block the creation of this namespace. So that means the gatekeeper constraint constraint template that we are applied using Recom policy is actually in place and working. So that's how we distribute and apply a gatekeeper constraint constraint template from Recom console by using a Recom policy. You don't have to log into each manage cluster and apply it, you just need to do it essentially through Recom control plane. Then it's the violation part. We want to be able to collect violations. So if you look at the other two templates that we are embedding in this policy CR, though here, as you can see, we create another configuration policy, right? This is for audit scenario. We name it policy gatekeeper audit. So what it does is it is looking for any CR on a managed cluster called ksrequiredlabel. This is the constraint that we created in previous object template. But additionally, we are adding additional fields to it. So what it means is we are using must have compliance type here. So what it does is we require on your cluster, you need to have a CR called NS must have gatekeeper with this kind and API version. Additionally, we expand the status field with total violation zero. So this is for audit scenario. So the way it works is so once this constraint is being created on a managed cluster, so gatekeeper audit controller will start to scan your entire cluster and then try to figure out if you have any pre-existing, non-compliance exist. So if there is any, it will actually update the status field to tell you, oh, there are some violations pre-exist. So it will increment the number here. So currently we expect the number to be zero. So if it's not zero, then this policy will return non-compliance. That's how we collect the results. So that's how we collect results for audit. And then let's look at the dimension scenario. For dimension scenario, same, we are creating another configuration policy and then we are looking for events for this constraint template, for this constraint. KS require labels and then with name NS must have go gatekeeper. So basically, so as you can see here, we are using constraint type must not have. So we expect there shouldn't be any events with these annotation on a managed cluster, exist on a managed cluster. If it exists, that means there's violations. There's something wrong. So this policy will return non-compliance. So now let's come back to the console here. So as I did, as previously I did this, I tried to create namespace without label. So now as you can see here, it is for this admission template is reporting non-compliance and it tells, oh, there's an event exist in the gatekeeper namespace system. We can click on view details and take a look at what exactly it is. So, oh, this is what is violating this policy. So this event exist, but it should be. And if you click on view YAML, it is going to pull the details of this event. So as you can see, it tells you admission webhook, basically the request is being denied by this constraint from gatekeeper. So this is exactly the same error you've seen here in the command line. So this is how we implement gatekeeper with Reckon. So we integrate gatekeeper not only just installing the gatekeeper and then creating the gatekeeper constraint template, but we also collect the result for both at an audit and admission scenario. Okay, that's my part for the gatekeeper demo. Just to quick mention, thanks to the power of the Out-of-box configuration policy controller shipped with Reckon, so we are able to also, of course, install any operator. So for example, compliance operator here. So compliance operator. So if you look at the YAML here, this policy is also, you can also find an in-policy collection repo. So you can find it here. So a very similar concept. We use configuration policy to create namespace, create operator group, and create subscription. So then the compliance operator is installed on your managed cluster. And then you can trigger a scan. So from using certain profiles. So here, if you look at the EA scan policy here, basically this policy triggers and essential a security profile scan on your managed cluster. And we are also using configuration policy to achieve that. So by just using configuration policy to create scan-set binding, compliance suite, and then collect the result back. So this is all done by doing just creating configuration policy. So you don't have to write any code. You just need to create a YAML of the policy. And then you can integrate with compliance operator and as well as gatekeeper. Okay, that's it for me. That's great. Thanks, Yu. And if I could, this is Kirsten Newcomer. If I could chime in just for a minute at the end of our conversation about the compliance operator. There was in chat a conversation about the difference between the compliance operator and gatekeeper. And I think both Jay and I weighed in and you did a nice job also summarizing that here. So the compliance operator is specifically focused on regulatory controls, technical controls that map to regulatory frameworks. I just wanna share just cause we're really excited. In addition to the E8 profile which is an essential E8 profile from Australia. There are some, the compliance profiles available with the OpenShift compliance operator includes some controls that meet NIST 808 53 regulatory requirements including at rail core OS, not just the Kubernetes layer. And we just shipped a profile for that is inspired by the CIS Kubernetes benchmark. So check that out if when you get a chance. And I don't know if there are other questions. I've kind of been thinking of a few that I wondered if whether they might be helpful to folks. And they kind of tie back to OPA versus gatekeeper versus the compliance operator. Jay, you mentioned kind of three types of policies, policy categories. You mentioned security, resiliency. You also mentioned software engineering. I think we have, I think maybe it would be useful to give some examples of each of them. Does that make sense? Yeah, can I grab the share again? Please do. I think you should be able to see my screen, right? It's coming, there it is. Okay, so this is the policy collection repo and then if you go down to the bottom of this repo, this page, we have a lot of blogs here. And one of the blogs I wanted to highlight here is this blog. And this blog talks about how you can implement policy-based governance using our configuration management capabilities, right? And here we talk about like Kristen, you were asking, there are best practices for three areas that I outlined, which is security, resiliency and software engineering. And this blog goes into the details of how you can, of examples in each of these categories, right? So for example, for security and regulatory compliance, the first one we list obviously is the compliance operator, right? So we talk about how that can be configured using RACM. And then we talk about the HCD encryption. So there's a policy that's available to ensure that the Kubernetes HCD database is encrypted, right? And also you can remove the queue badminton because the best practice obviously is to not use a single administrative account, right? You want to be able to use different accounts for different users to have accountability. And then policies for role-based access control and SEC security cost constraints, et cetera, right? So these are examples of security-oriented policies but you can also have policies for resiliency. So for example, if you want to make sure that the logging operator is installed because you want to be able to collect logs to check the health of clusters, et cetera. So you can do that. And many of the gatekeeper policies that we have as examples here, I have to go back to the community. So there are gatekeeper policies for ensuring liveness check is in place and make sure you're using the latest container image. These kinds of policies, readiness probe is in place. These are all resiliency-related policies, right? So those are examples of that. And then you can also set up policies for software engineering, which is things like making sure that Kafka is in place because that is your standard for streaming, right? So those are the kinds of things you can actually author. And as you was mentioning, the key point of this blog, if I go to the conclusion here is, right? The point is all of these policies can be put in place without programming. And I wanted to really highlight that because our built-in config policy controller, as I mentioned earlier, can distribute any CR. So as long as you are able to represent a capability, say for example, as an operator, an operator can be deployed using a CR, right? And then you can configure the operator as long as it takes configuration, as given it is a resource, you can configure it. And if it returns the results back as CRs, we can process those as well. That's really like you were showing in this demo. We were able to integrate with Gatekeeper because it met all those characteristics, right? So we didn't have to really write code. We just had to author policies. So I think that's the beauty of this approach is it's very easy to put these best practices in place for your data operations without writing a lot of code. In fact, without writing any code. Yep, Jaya, are there out-of-the-box policies that are available that in the Gatekeeper community, I know you showed us the community for RACOM, the community branch. What does Gatekeeper provide out of the box? I think many of the policies that we have put here in our community were contributed by our community of practitioners. So they have their own community where based on customer requirements, they're building out policies. And then once they feel that those policies are stable enough, they then contribute into this community. And then the next progression is if we find that there are enough customers asking us for a fully supported version of that policy, then we promote that policy to stable and it becomes part of our RACOM product. So that's kind of the three-step progression of how we are building our policies and moving them into fully supported versions. Great, that sounds good. Let's see, so you answered those example and another thing you mentioned early on in the conversation, you kind of mentioned, well, you used three different words and I just wanted to see if there was clarity. You said that there are, of course, admission controllers, runtime controllers, and then later you talked about admission and audit. So I wondered, I think the admission controllers were fairly clear. Could you give us an idea of what some of the runtime controllers are? Yeah, let's see. Or is that the audit? Yeah. Yeah, let me go back to my, to sharing my deck. Jaya, we lost your voice again. Can you hear me now? Yep, perfect. It's just going and getting my deck. Okay, you can see my deck. So I think if you look here, let me go into present mode. Okay, so the policy enforcement points, right? These are the entities that consume the policy and return violations. So this is where you have the admission webhook. So anything that is plugged in into the admission webhook. Now Gatekeeper is one example of that, right? That is plugged into that. Now somebody could write another webhook that is processing policies, for example, right? As long as that entity that is configured as a webhook is able to accept its configuration or policy as a Kubernetes CR, then you can use our built-in config policy controller to distribute that to that, right? So that is one example, right? And then there are, Kubernetes obviously has its own runtime controller. So for example, when we propagate a policy for its CD encryption, that is actually being enforced by Kubernetes itself, right? We don't have to do an external controller to enforce that, right? But then we have certain other controllers, like the certificate management controller is something that we provide. And that allows you to detect whether certificates are expiring, whether certificates have wildcard, certificates are being used, et cetera, right? Those are policies that you can define and that can be detected using that specific controller. And compliance operate is another example, right? So... Okay, I had thought of things like Falco. So it helps me to understand that you mean it more broadly. So... Right, yeah, Falco is here as well. So that's another example of a runtime controller, right? Thank you. Also just really quickly, because I know you and I responded to Carolyn in chat, but maybe we'll just verbalize for everybody else as well. Carolyn had asked whether OpenShift is required on all clusters in order to use policy-based governance. And no, as Jya said in chat, ACM itself runs on an OpenShift cluster, but ACM can manage other Kubernetes distributions besides OpenShift. Today, the compliance operator is only running on OpenShift. It is designed to the content that's available, which is written in SCAP, Secure Content Automation Protocol. This is a standard that's required by a number of our customers, which is why the compliance operator is written in SCAP. It today, we only have content for OpenShift and the operator mostly works on OpenShift. We want to extend it to other CUBE clusters in the future, likely or at least share it upstream to make it easy for others to extend it. Although, of course, the project is open-source, so you can do that today. But again, ACM itself can manage both OpenShift and other Kubernetes clusters with other Kubernetes distros. Okay, just two compliments. So the policy framework, the governance policy framework, so the hub piece does require OCP cluster, but the piece on the managed cluster, we do support other Kubernetes flavor, but also, so, but the OuterBox controllers, for example, the configuration policy controller, it also support other Kubernetes flavors. So that means, if you want to integrate something that it's not running on Kubernetes cluster, but it can be integrated using configuration policy, it is, you can still do that. And also, to add the gatekeeper operator also works on non-Cubernetes environment, a non-OCP Kubernetes environment. So of course, if you want to use OLM way to install it, you need to install OIM, but you can also install it without OIM. So the upstream version actually supports multiple way to install gatekeeper. Yeah, those are all excellent points, you. I think, yeah, I wanted to add here, like if you go to this open cluster management policy collection report at the very bottom, that's where we have listed all our blogs. So you can take a look at it. Also, this is the open cluster management community. So if you're interested in trying out this capability, that's a good place to start. And we have community meetings, so you can definitely get engaged there. And like you said, you know, for example, if you want to try this out on a non-open shift cluster, at least on the managed cluster side, definitely you're welcome to do that. I have one question. This is Shana. I have a customer who is running currently right now, 311. I noticed ACM Rackham supports 3.11.200 and above. And some of the policies when I install it, it actually require like let's say image vulnerabilities and it will require container security operator on the managed cluster. And I was just wondering like what all the policies will install operator for the managed cluster if there isn't or it is kind of a pre-rex depends on what policies that you're applying to the cluster you want. That makes sense? Like, because there are times that I would not know what my managed cluster has. As an admin, I will want policy, A, B, and C. And then when I create those policy and I figure out, oh, those clusters doesn't have it would like for a gatekeeper you will deploy the gatekeeper for the cluster, but gatekeeper is actually only support 1.14 and above. And so there isn't, it's that mean that I cannot have gatekeeper policies on the 3.11 cluster. So yeah, I can take that. So yeah, so as I mentioned previously, there's two pieces, the framework itself and also the policy consumer. So the framework does work on OCP 3.11, but the policy controller or consumer on managed cluster it might not support OCP 3.11. So it's really case by case. So if you try to create a gatekeeper on 3.11, then since it's using configuration policy, it will try to apply those CRs, but since those CRs don't even exist on 3.11, it will return non-compliant. Okay, so I have to figure out which one is useful and which one is not. And I think this is where I think the placement rule applies, right? So when you are applying a policy to a managed cluster, you do that by using this concept called placement. And one of the things that you can use is you can assign labels to your clusters. And you can say that apply this policy to a cluster that matches this label, right? So what you could do is you could assign labels to your clusters depending upon what version they are, et cetera, right? And that will kind of determine, you know, which policies get applied where. Okay, that's a good idea. Thank you. Just thinking aloud is there's real customer questions. They are on 3.11. I just want to kind of pick your brain taking the three last three minutes opportunities. And so they want to follow the needs standard, right? And so they are moving to four, but they're not yet, they're still on 3.11. What are the policies that you would recommend them to start on doing with ACM? If there is any documentation, I can just tick the link and read about it. Yeah, I think the blog that I was sharing could be a good place to start. I'll put that link in the chat. So nice. I really want to go read. I read them over the weekend. They are super, yes. So Jay, we know the compliance operator is not supported on OpenShift 3.11. There is a hardening guide for OpenShift 3.11, but there's not automation that I'm aware of. Does ACM have checks for OpenShift 3.11 like that mapped to NIST 853 or some other NIST framework? I think the encryption policy at CD encryption should work on 3.11, right? Did you support OpenShift 4 support? Sorry. Yeah, both OpenShift 3.11. And you can encrypt at CD in both OpenShift 3.11 and OpenShift 4. How you do it is slightly different, however. There are differences in implementation. I just didn't know whether any of your other checks. Yeah, I mean, the other check is the certificate expiration. That definitely should work, I think. That's another area that you could look at. Yeah. So, Shauna, if it's for 3.11, this is Kirsten Newcomer. Feel free to shoot me a note. KNewcomer at redhat.com. I'll see what I can do to help you out. Thank you so much. Appreciate it. Rachel, thank you. And there's one question from Tobias in the chat right now, a question regarding the roadmap item in terms of audit, et cetera. Does this include having a result that could state deny but not denying the actual resource creation and rather just firing a violation alert to SIEM? Meaning, yeah. Okay. You read that. Yeah. I think the gatekeeper audit scenario, obviously we support, right? Meaning, when I say support, that should work. The roadmap item related to audit was more on the hub being able to generate audit logs for policy lifecycle events and have them routed to SIEMS. So that is something we'll work on in the future. But if you're talking specifically about the gatekeeper audit scenario, that'll be fine. You should be able to use that. This was really, really good. And we definitely sounds like we're gonna have to have you back as the OCM community grows and more of these policies are out there. This is just a deep dive here and very good. You, thanks very much for the demo. It was quite, quite good. So thanks again. And thank you everybody for taking the time and asking great questions so that I didn't have to. This was good. And thanks, Kirsten, for jumping in there. Hey, Carol. Thank you, everyone. Bye-bye.


are you saying good morning today is friday and it's currently the junior doctor strikes so i'm striking that's why i have had these few days off which to be honest not only do i morally agree with because if you guys don't know why the junior doctors are striking then look it up on the bma website but essentially they've taken we've taken like a 20 pay cut over the past 20 years so we should be on strike but also i have so much work to do from my harvard course that i have been grateful to have the time to catch up on and also just like life admin stuff it's 9 50 in the morning i'm going to go to the gym i have my rucksack with me and it has my laptop so that i can do my harvard course work but first i'm going to make myself a coffee tell me there's a doctor in your house without telling me there's a doctor in your house we always buy these from the pharmacy and use it to wipe down surfaces because they are the best guys how cute my secret santa at work got me this mug thanks kenny with all honestly like the worst picture of me ever that she got off google but thanks anyway so as dear as ever you are spectacular um xoxo santa and this is a speculum which is why the pun was spectacular um but it's like chris was decorated sorry the milk buffer is so loud but yeah let me put the lid on oh that shut it up so the speculum is like what we use in gynecology to do our examinations like we insert this inside the vagina so that we can have a look at the cervix so as a gynecologist i obviously fully fully fully appreciate this and it is spectacular uh but i'm not gonna have my morning coffee in this because i want to drive to the gym and save time so i'm gonna put it in a travel mug this is a chile's travel mug and it's my favorite that any problem is it doesn't fit in the cup holder in my car but i don't care like i i want to use this today another fun fact about me and my morning coffee i bet you guys like why is she talking so much about coffee but i always when i buy a coffee which is most mornings on my way to work take some sweeteners uh with me and use these at home because i feel like it's the perfect portion amount of a sweetener guys i've just done all this and i've realized we don't have any more coffee pods i feel like that ticked up where it's like it was in that moment she realized she booked it okay well i'm just gonna leave that in there and then buy more coffee pods today and i'll use that tomorrow screw it i'm just buying my coffee from the gym also i had foundation on my lips this whole time i've got that dry winter lip thing going on too which is not hot guys but we move i just got back from the gym and i went to waitress i thought i'd show you guys some of the things that i got because i really want to make a breakfast burrito i'm so hungry and i need to leave the house in 35 minutes and 35 minutes i need to make a breakfast burrito shower dry my head do my makeup and get dressed and leave let's get started so dog treats i just gave banksy one and let him go outside with it so that's why it's open but i love these ones they're really good avocado corn sausages those are needed for my breakfast burrito tender stem is what's clean chicken thigh fillets i prefer this to chicken breast fillets i think it tastes so much better and so much juicier when you put it in the oven we have some fajita flatbread i need for tortilla bread um i use this for my breakfast burrito but also you can make sandwiches with them you can do so much feta cheese was for my mom she requested Philadelphia cheese light i use this so much for everything like i star into sauces or i use it for breakfast we needed some squeezy honey we didn't have any at home so i grabbed some of that got some more dog food my parents give banksy usually home cooked food but i feel like he's something's upsetting his stomach recently because there's been a few episodes where he's been sick so i don't know what it is but when he was eating these dog foods he was fine so i'm gonna see if he eats this and he's still okay then it would have been what he's eaten and if he eats this and he's still being sick then i need to take him to the vet salmon king prawn cream of tomato soup love this like just a light lunch let's say you're like between meals and you are hungry you want something that's heavy ish but like not too heavy and again this is for my mom this reminds me of my childhood she always used to have this jam it's blueberry jam from saint dalfour that is everything and my dad was just telling me off because he's like you always buy these bags every time you go why don't you just put some in your car i forget like even if i put it in my car i won't remember to take out my car so yeah i'm gonna make my breakfast burrito and go shower well actually i'm gonna put the sausages in the oven go shower come back and assemble the breakfast burrito you'll see it i'll be good hey hi i got him a um what do you call it what's it called a baguette yeah so he's just come to nab the baguette and he's like don't show me haha i just want to say that there's a whole match going on outside watching from jake fielish except who do you like who would you like given that i don't know anything about football it's a bit fucked doesn't it a football club oh no oh yeah that would be good that's a nice one boys are fighting oh oh oh oh no boys behave we're gonna meet in zara okay today is saturday i went to a pilates class this morning which i feel so good about it was a reforma pilates i did a pilates class on thursday i believe that was not reforma it was just um floor pilates mat pilates that was also really good but i feel like reforma because it essentially works with resistance it's a strength training resistance workout i feel like the more i go the better i get like the more consistent i am i first started doing reforma back in university my one of my closest friends anabelle she introduced me to it and celia they both introduced me to it and there was a place in hamster called heart core and that was really like the closest place you could do reforma um but it really got trendy and gyms have like picked it up so now my gym has a reforma class the only thing is because the branch of my gym is so busy like it has a high demand they charge you an extra 10 pounds for the reforma classes even though we literally pay so much for the gym membership each month like i think it's 180 pounds a person or am i even mistaken maybe even more than that so paying 10 pounds extra class is quite crazy because the other branches the reforma is free but anyway that's so besides the point i'm awfully i did the reforma this morning and i felt really good i try and do it at least like once a week but this is when i'm like in into my workout i think when i moved jobs i had to restart my workouts and stuff and i traveled a bit in between so it got quite chaotic so i would say it's maybe a month that i'm really back into working out and um just eating healthier not because i've changed anything but just gone back to cooking more at home eating more at home and doing intermittent fasting because i feel like that works so well for my body and my mind and just my physical and mental health as well um but yeah i've been hitting the gym working on my mental health and i feel like i haven't sat down and had a chat with you guys in ages today i'm going to the nobu brunch with my mum for lunch i'm so excited i've seen it all over tiktok and i really wanted to go so i will show you guys when i get there but it's like all you can eat and i think it's like 100 pounds each i'm not mistaken i'll let you know when i'm there and i'll show you some of the menu but i'm just gonna do my makeup curl my hair i would just have tinted moisturizer on right now it's the it cosmetics cc cream and i think i'm in like a medium color i don't know because they annoyingly don't like your shade on the bottle so yeah let me do my makeup do my hair get dressed and we'll catch up my final hair and outfit my jacket is moncler my skirt is zara i'm wearing a kind of gilet top underneath you guys will see i added this pink momie bag for a pop of color and some boots this is the hair and makeup i'm really late so let's run so this is my second day i've got some truffle rice and salad some ceviche my mum got a black pot really full i went three rounds i think i showed you guys all the food that i ate any time that it was a lot and i'm waiting for my mom so we can have dessert together my mom and i went three rounds as well but she got more rolls you got more rolls than me i got just like all new styles sashimi i think i had like 10 pieces of sashimi i had more i had yeah those ones i think i had like maybe they i had more than that of the sashimi yeah and then i had like four rolls and then we had a miso black pod rice and popcorn shrimp the loose it's so nice and they've got like a few desserts and this is mine because i am allergic to berries so i'm asking if they can make me a cheesecake that doesn't have strawberry in it because this one has a strawberry like on top oh is that let me have a bite before i like switch to dessert it's weird it's like ice cream bread it was very weird it was like that tasted like yeah ice cream bread with like sushi in the middle and like it's called the monocoque and i've never had that in monocoque okay this was insane it was called cappuccino now it's empty it's like one of my favorite desserts now they brought me cheesecake without strawberry which i thought was really sweet like as in really nice of them really sweet um this is a miso brownie i'm not obsessed it's okay um yeah my mom's loving all the desserts too she said that the pudding was really good very nice for this man yeah just want to say that this one never usually eats dessert are you okay hun? yeah genuinely this is my favorite cappuccino it's the bernice of all of this is my favorite and i don't know what they must do eat here we are feeling sick and still these foods down on vlogging this for you guys delicious i love it i couldn't have stopped you know what i'm saying we just like the variety because so many times when you go out you get like three dishes four dishes because like i don't want to waste the food whereas here you get variety without wasting because like you'll have a couple of bits of this one a couple of bits of that one so the problem is the variety you want anything you like more you want to try more yeah and as long as you try more and you love it you found something else is really delicious and you won't have that and that's why we feel a bit sick i'm really really full probably put one because she didn't eat me too i have to go in you're joking especially i did the not because level of sugar just i'm talking not the it's not that no the sushi we didn't eat much we just had variety yes no sugar i said a bit of sugar in dessert because dessert is really nice all of it which i'm asking honestly i'm embarrassed about this round show you how many back the next


What are the most important parts of a telephone? What combination of electrical circuits and mechanical devices allow two people who are miles apart to talk as if they were in the same room? You will see in this film how three fundamental systems use six basic components in the creation and regulation of the vital currents in the telephone line. You will see how the sound powered system, the local battery system, and the common battery system utilize generators, ringers, transmitters, receivers, induction coils, and capacitors to carry the sound of our voice over two simple wires. Actually, our line forms a closed circuit through terminating points connecting two stations on a point-to-point line before station one can talk to station two. He must signal for his attention. The telephone generator is used for this purpose. Let's see how the generator employs the principle of magnetic induction in the creation of voltage to operate a suitable signaling device. This represents a piece of wire which we will move through the lines of force created by a permanent magnet. When a wire is moved through lines of force, a potential is induced in the wire which alternates as the wire is moved in or out. We can increase this potential by speeding the motion of the wire through the flux field created by the magnet. Rotational movement of the wire in the field of flux will also increase the potential in the wire. As the rotational speed is increased, the potential in the wire is increased still further. If we also concentrate the magnetic field by bringing the north and south poles of a magnet closer and either increase the speed of breaking the magnetic field or increase the number of wires rotating across the lines of force, we will have a generator. Some generator magnets are located within a coil. Each time the magnetic lines of force of the magnet rotate across the wires in the coil, a potential is induced. Because of the difference in polarity of the magnetic poles, the induced voltage is alternately negative and positive. When we connect this generator to our line, it will create a signaling current alternating at approximately 20 cycles per second. Let's take a closer look at the electron flow in one of the lines. It shows that we have created a signaling current which will operate a visual or audible device to attract attention to the telephone. The audible device is the telephone ringer or buzzer. The telephone ringer works on the principle of electromagnetic attraction and repulsion. When two soft iron cores are wound oppositely with wire, they become electromagnets whose polarity will change as the current in our line alternates. If we introduce a soft iron armature near the base of an electromagnet and then introduce a permanent magnet to polarize the ends of the armature, an unstable condition will exist when current flows. When a signal is sent over our line, the polarity of our electromagnet will alternately attract and repel the ends of the armature operating the clapper rod, which alternately strikes each gong. Here we see an actual telephone ringer in operation. Another audible signaling device is the telephone buzzer. This device uses a bar magnet, an electromagnet, an armature, a non-magnetic separator, a stabilizing spring, a clapper rod, a diaphragm, and a single wire coil. As the current changes in the wire, the polarity of the electromagnet changes. As the polarity of the electromagnet changes, it attracts or repels the armature to the core. Here is an actual telephone buzzer in operation. A complete ringing circuit allows each station to call the other and provides a switch for disconnecting the ringer. As the generator is turned, the switch connected to the ringer is open. This places the generator across the line. The same thing happens in the opposite direction. How does the generator switch operate? A rotor reaction exerts a centrifugal force on the counterweights in the generator. As the counterweights are spread apart, a movable button drops down and makes contact with and closes the generator circuit. As the counterweights come together, the button raises and makes contact with and places the ringer on the line. This is how the generator switch works in the circuit. The miracle of the telephone is that when once signaled, two stations can talk to each other in normal tones over virtually limitless distances. To accomplish this, the telephone transmitter converts the sound waves of the sender's voice into electrical waves for transmission over wires. At the other end of the line, a receiver reconverts the electrical waves into audible sound. The secret of the telephone lies in this ability to interchange sound and electrical waves without changing their forms. For the initial transformation of sound waves into electrical waves, the sound-powered transmitter employs the same principle of magnetic induction used in the generator. In the transmitter, a permanent magnetic field is set up across two pairs of poles. To provide the lines of force with an easier path than through air, a soft iron armature is used to shunt the magnetic field across the poles. When the armature pivots, the direction of the field through the armature reverses itself, flowing always from north to south. The armature is surrounded by a coil. As the polarity of the armature changes, it induces an alternating potential in the wire. By attaching a connecting rod from the armature to a diaphragm, similar to that found in a telephone transmitter, a direct linkage is affected. The energy of sound waves moves the diaphragm. Because of the direct linkage, any movement of the diaphragm is transferred to the armature. This means that an alternating potential will be induced in our coil, which exactly corresponds to the wave pattern of the sound waves. This is the way we transform sound waves into an alternating current capable of carrying speech several miles over a line. At the other end of the line, a device similar to the transmitter reconverts the electrical current into audible sound. The telephone receiver, however, employs the principle of electromagnetic attraction and repulsion used in the operation of the ringer. As the voice current in the coil alternates, the polarity of the armature reverses, causing each end to be alternately attracted or repelled by the permanent field magnet. Consequently, the diaphragm pushes out audible sound waves, exactly mirroring the waves of the original sound. Since the transmitter and the receiver are virtually the same in design, they can each do the other's job. Say, Bud, did you take a shower this morning? A shower? No. Is one missing? Funny, funny! For convenience, a second unit is placed in parallel across the line, giving us the simplest of all telephone systems, the sound-powered system, so-called because it draws its energy directly from the transmitted sound. The chief advantage of the sound-powered system is also its biggest limitation. If, for instance, our line is extended beyond a certain range, the received signal will fade out and become unintelligible. The resistance in our line becomes too great to be overcome by the weak energy of the sound-powered transmitter. If we wish to talk over longer distances, we must use another telephone system, one which draws its power, not from the weak energy of sound waves, but from the powerful charge of a battery, the local battery system. Now, instead of using a sound-powered device to generate an alternating current, we will use a carbon transmitter to vary the release of direct current from a battery. Sound waves striking the diaphragm compress loose carbon granules in the carbon transmitter. This lessens their resistance and allows more electrons to flow in the circuit. Our voice is therefore carried by a pulsating direct current pushed by the strength of our battery. At the receiving end, if the line resistance is increased, it will reduce our signal strength and thus limit our acceptable transmission range. The solution is to insert an induction coil, which is simply a soft iron core around which are wrapped two wires, a primary and secondary winding. This removes both transmitter and battery from our circuit, and at the same time induces a higher AC voltage in the secondary winding connected to the line. Sound waves varying the electron flow in the transmitter circuit cause the field of both the primary and secondary windings to expand or collapse. As the magnetic field of the primary cuts the windings of the secondary, an alternating voltage is induced into the secondary winding. Because this winding contains more turns than the primary, an increase in voltage occurs, represented by the larger polarity signs. This will permit transmission over longer distances. Since our power will continue to drain even when we are not talking, our battery life can be prolonged by inserting a press-to-talk switch in the transmitter circuit. By adding a receiver, we are ready to talk, alternately receiving or sending. We can hear ourselves in our own receiver through an effect known as side tone. If we listen with our press-to-talk switch closed, the incoming voice will be interfered with by background noises coming from our own transmitter. Our ringing circuit allows station 2 to signal station 1, and vice versa. And our talking circuit allows station 1 to talk to station 2, and vice versa. But there is something missing in this circuit. Because when station 2 rings station 1, the current in our receiver circuit overloads the receiver. Same thing occurs when station 1 signals station 2. To correct this, we must make use of our sixth basic component, a capacitor. Certain capacitors impede low-frequency ringing currents that could enter the receiver circuit, yet pass high-frequency voice currents. Our local battery system is ready for traffic in either direction. The local battery telephone has a much greater transmission range than the sound-powered telephone. In a field telephone, the transmitter, receiver, and press-to-talk switch are combined into a convenient handset. The induction coil, capacitor, generator, battery, and buzzer are contained in a waterproof housing. Not only two, but many stations can be interconnected, one way or another. By use of a switchboard. First, let's consider the local battery switchboard. We can simplify our wire stringing by bringing only one line from a telephone to a central location and terminating it on a switchboard. Here, plugs and jacks are provided, allowing an operator to connect each station with any other station. A visual indicator allows a station-desiring service to attract the operator's attention. The operator's pack contains a headset consisting of a transmitter, receiver, cord, and plug for talking and listening to stations. The operator also has a generator for ringing. Here's what happens when one station calls another through this switchboard. Dagger switchboard, dagger three, dagger three. And the conversation proceeds. Note that with this local battery switchboard, dagger five had to call the operator with his own hand generator. When the conversation is finished, he must again signal the operator to disconnect. We can facilitate the handling of calls even further by using a common battery switchboard. This system provides for automatic, rather than manual signaling, eliminates local batteries and provides faster service through more efficient operation. Generators and batteries are eliminated at the local stations, and the switchboard provides all power for both signaling and talking. Each station, terminating on the common battery switchboard, has its own jack and line lamp. The operator's key shelf is provided with a battery source and contains a generator, an answering cord, a supervisory lamp, a calling cord, and a supervisory lamp which signals when the receiver is replaced on the hook. The operator is provided with a key which in one position allows him to talk on the line, and in the other position allows him to mechanically ring any station on his board. Now, we will see how much easier it is to place a call over this system. The operator is automatically signaled the moment a station takes the receiver off the hook. At the same time, the hook switch puts the battery in the transmitter circuit, making it ready for talking. Number please, Dagger 3. Since the supervisory lights go on when the receiver is down on any connected line, the operator is automatically informed when the call station answers. Dagger 3. Notice that when each station hangs up at the end of the call, the operator is automatically signaled to disconnect. Let's review the three basic telephone systems. The sound-powered system uses generators, ringers, capacitors, receivers, and sound-powered transmitters. If necessary, a switchboard can be used to handle many stations. The local battery system uses generators, ringers, capacitors, and receivers, but uses carbon transmitters instead of sound-powered transmitters. In addition, it uses induction coils and draws its energy from batteries at the individual stations. This system too may or may not use a switchboard. The common battery system, however, must use a switchboard, providing power for both signaling and talking. Ringers, capacitors, receivers, carbon transmitters, and induction coils are again used at each station. Beyond these three simple systems lie the ever more complicated wonders of modern telephony. Yet all these systems rely on the six basic components found in the telephone. They are generators, ringers, transmitters, receivers, induction coils, and capacitors. All of the three basic telephone systems depend upon our line, which must be properly engineered for the telephone system to be used.


From theCUBE Studios in Palo Alto in Boston, bringing you data-driven insights from theCUBE and ETR. This is Breaking Analysis with Dave Vellante. The last 10 months have forced upon us a new digital reality. If you weren't a digital business, you were basically out of business. Hello everybody, this is Dave Vellante and welcome to this week's Wikibon Cube Insights powered by ETR. In this breaking analysis, we're going to share with you some fresh data from ETR on CIO spending, which is giving us a lot of optimism for 2021. We'll also set forth our thinking on the new digital economy and really talk a little bit about where we see some of the opportunities and some of the spending and how those shifts are going to occur in the near term and midterm and even long term. Let's bring up sort of the first set of talking points that I want to share with you. 2020 has been a year of instant pivots, as we all know, and it's forced us to march toward a new digital reality, digital transformation, as everybody talks about, has been compressed by two to three years. But it's really been a Petri dish for everybody. Now, earlier this year, and we've been consistent since we first came out with this forecast of minus four to 5% in IT spending this year. The survey data suggests that even though Q3 saw a big bounce back in spending in GDP, we've still really maintained that minus four to minus 5%. We're seeing a comeback in the lockdown and the virus and as such, we maintain that conservative forecast. Our current 2% growth for 2021 appears to be conservative based on the latest data we have. It could be as high as four to 5% growth in 2021. And we'll update that formally in January, but hold that thought. As part of that, as I said, we've seen accelerated digital business initiatives led to really strong pockets in many sectors. We've seen that in video conferencing, in laptops, obviously we've seen that in certain security sectors that we've detailed like identity access management, like endpoint, like cloud security, cloud itself. And we've seen a big trend toward application modernization. So those sectors of the business, including those other data sectors, we certainly see the ascendancy of Snowflake. Snowflake closed the day on Friday. The valuation of Snowflake on Friday was now above that of ServiceNow. Snowflake's valuation is currently around the same, just slightly under that of IBMs. Think about that. A company that was formed in 2015 is now as valuable almost as IBM, 100 plus year old company. That's quite amazing to think about. Why is that? It's because data now is at the center of the universe and that's obviously what Snowflake's transformation is all about. The pace of the vaccine distribution appears to be accelerated, but as I said earlier, winter is coming in the Northern Hemisphere and that's causing some concern. But overall, ETR survey data suggests that there's really positive signs in recovery and we'll get into that. Companies are learning to leverage the cloud. Cloud migration was a big priority in the last 10 months. That including security and people are realizing that, wow, we can actually change the operating model with cloud and it's helping with our agility and we're going to show you some data that really supports that. As I kind of alluded to earlier, COVID created this massive digital business proof of concept and the learnings from that experiment are going to get operationalized in 2021 and it's going to be a rapid year of invention and reinvention. And so that's why we think IT spending could snap back dramatically in 2021. Now, ETR when it does its surveys will oftentimes do drill downs and I want to share now with you the next slide shows some drill downs from the COVID study. ETR since early this year, since March has been doing COVID studies. We've been reporting on that extensively. ETR was really the first to report that whole work from home pivot really, really early on in the cycle. So we use that as sort of a harbinger of things to come. This slide asked organizations in the past 12 months, what is your thinking on when spending is going to bounce back to 2019 levels? And that's really what's shown in this chart. So, you know, pre COVID levels really was the question. When does your organization expect the IT budgets to return to pre COVID levels? You could see here on the left-hand side, 11% have said they increased budgets since the start of COVID. And those are the ones that are really in the best position, e-commerce, certain e-commerce companies, those where COVID was actually a tailwind. 24% said we're already back to those 2019 pre COVID levels. And then you can see as well, approximately 30% say that within 12 months, they'll be back, 22% say within 24 months. And I know that's a big chunk of the economy in the CIO spend base, but only 4% that it's going to be more than two years. So, a very large portion of the survey base, which is over 1400, suggests that there's optimism in the near term. Now, what we want to show you in the next chart is the factors that really enabled organizations to be agile and resilient during COVID-19. Now, it's no surprise that 84% said that being prepared for a remote workforce. Now, were it not for technology, we really would not have been able to respond to COVID in the way in which we have. And I think everybody really understands that. 44% said business continuity plans, as we've reported in the past, many people told us their business continuity was far too DR focused. They've shifted that focus in the last 10 months really toward being able to pivot their businesses and identify new opportunities. And so that's something that we feel is going to carry through into 2021 and beyond. 39% said C-suite flexibility. I think this is a really important point where the C-suite recognized the importance of investing in technology and really understanding that it's now a strategic enabler, of course always has been it, but now more than ever. You can see also that 30% said budget flexibility enabled them and that is as a function of we got low interest rates, many, many corporations if not most corporations improve their balance sheets by tapping corporate debt. And only 27% said emerging technologies. I shouldn't say only 27% cited emerging technologies as a primary factor that enabled their business resiliency. And I would argue that many of the emerging technologies probably falls into that 84% on that left-hand bar. So overall, you can see that the priorities of CIOs have shifted in the last 10 months and it's not just going to snap back to where we were pre-COVID. As we've said many times and many believe these are permanent changes. Now, you may be asking, okay, where is the action going? Where are people spending? What are they adopting as new technologies? And that's really what we want to show you here in this next slide. So what this slide does, you may recall the net score methodology that ETR uses. Net score is a measure of spending momentum. Basically what it does is it breaks down those companies that are spending more versus or a company that breaks down the percentage of that company that's spending more versus spending less on a particular technology. So it's really, there's several components to it. One is new adoptions, the other is spending more, the other is split flat, spending less or retiring. So what we're isolating here in this chart is the new adoptions. And you can see here that we've highlighted a few areas, container orchestration and container platforms. You can see those high. And we're showing three survey bases, October 19, July 20, which is the blue and October 20, which is the yellow. And yes, while the spending is down from some of the previous highs, you can see the elevated levels of container orchestration, container platforms, machine learning, and AI, and robotic process automation. What is that telling you? It says that people are modernizing their applications portfolios. They're applying machine learning and machine intelligence to get more value from data, AI plus data plus cloud is that new innovation cocktail that we've talked about a lot. And then we've also talked about the automation mandate that we haven't seen the productivity improvements in the US and Europe over the last two decades that we would have liked to seen. So there really is an automation mandate. That's what the RPA adoption is all about. So really trying to drive those productivity gains. Now, interestingly, you may look at this slide and say, wow, look at how low cloud is. We hear all the time that cloud migration is a big priority. Why is cloud so low? But let's bring up the next chart and address that. This chart takes that increased spend portion of the net score. Remember I said it's broken down. Adoptions, spend more, spend less, et cetera. This is the increased spend, the spend more. Now look at cloud computing. It's up in the 46% range. That's 46% of the customers that responded in the cloud computing sector said they're increasing spending on cloud. So how do you interpret that from the previous slide? They were already in the cloud. That's why the new adoptions was low because everybody's doing some form of cloud but this is a real tell sign. People are dramatically increasing their spending in cloud relative to some of these other areas. Of course, same with container orchestration, container platforms. It's all about developer productivity, right once, run anywhere type of thing. It hedges for a multi-cloud, bringing on-prem infrastructure into the cloud or on-prem apps into the cloud. That's what you're seeing there with container. So this is the sort of 40% club. Cloud computing, containers, machine learning and AI up at 40% spending more and then again, robotic process automation. So that sort of explains the cloud component and you can see the container, the container orchestration and the automation piece also at very elevated levels. Let me wrap here by talking about some factors to watch and I'll highlight them on this slide. Look, the propensity toward a lockdown definitely creates uncertainty and caution. You've got a new administration, there seems to be more of a willingness to lockdown, to slow down the economy. There's still uncertainty around fiscal stimulus although it looks like that's going to be addressed hopefully in the near term but there's still uncertainty around that. While that does potentially dampen spend for Q4 because of that uncertainty, it also creates further pent up demand. As I said before, there's been 10 months of learnings from this forced march to digital transformations and that is informing 2021 tactical plans and then even longer term plans. Long term planning has changed. When you talk to the C suite and the conversations going on at boards of directors, speed and the ability to turn on a dime. They're now fundamental principles that are being designed into businesses. This is a mainstay of the digital economy. We are entering a new era of digital business and there's going to be the haves and the have nots and the have nots are going to disappear and the haves are going to do better. As I say, boards and CEOs, they got a glimpse of the future in 2021 but it was forced on them, it really wasn't planned but it was an awesome Petri dish and experiment to understand what works, what doesn't and they're now doing a double down on those things that are sure bets and those that don't act, as they say, they're going to be out of business. At the macro, yes, you've got again, haves and have nots and the have nots are going to potentially dampen, you're going to see companies that really got hurt are going to constrict spending, no question and that could dampen spending at the macro but in our view, the survivor is going to prop up spending in 2021, it could be significantly above our initial estimates of 2%, could be as high as double that, maybe even four to 5% in 2021. We're going to continue to watch that, we'll continue to check out the survey data, we'll have a complete update in the January survey and in the meantime, we'll continue to report on the latest trends, both from the CUBE community and also from ETR, so that's it for now, thanks for watching, don't forget, all these episodes are available on podcasts, wherever you listen. I publish weekly on siliconangle.com and wikibon.com, check out ETR plus for all the survey action and please do comment on my LinkedIn posts, you can also reach me at dvolante on Twitter or you can email me at david.volante at siliconangle.com, this is Dave Volante for theCUBE Insights powered by ETR. Thanks for watching everybody, see you next time.


1. A small face. 2. A V-shaped jawline. 3. Pale, fair skin. 4. Big eyes. 5. Double eyelids. 6. Aegyosal. Or protruding lower eye bags. 7. A medium-sized nose bridge. Not too small, but definitely not too strong or big. 8. Small but plump lips. And of course, 9. A slim, slim, slim figure. The end result would give you something like this. Or this. Or this. Or this. We see it in K-pop, we see it in K-drama on advertisements in billboards in high school and college. The Korean beauty standard is the most infamous beauty standard in the world. And not only is it the most strict, it is the most specific beauty standard in the world. If you walk through any Korean grocery store, you'll see the shelves stocked with facial masks, lotions, moisturizers, BB cream, care products. All for the purpose of making yourself look beautiful. Creamy concealer. Why don't you try it? Perfect show. Especially dark circles. Makeup is my town. There are thousands of channels dedicated to K-beauty and K-makeup. Even the act of simply just washing your face is a 10-step process. The importance of K-beauty is such that the K-beauty industry is estimated to be worth more than 13 billion dollars with an annual 11.3% growth rate. By 2026, it's estimated to be worth 21 billion dollars, which would make it four times bigger than the entire K-pop industry. Game over. Wow. I mean, why stand BTS or BLACKPINK when you can stand Innisfree? In fact, Amore Pacific K-beauty conglomerate earns 5 trillion won a year or 4.4 billion dollars. Nine times of what Big Hit earned in 2019. While it's nice to want to look good, this creates the idea that there is only one type of beautiful and everything else is ugly. Obviously, most of the girls in the world aren't born with the exact features that match up perfectly with a Korean beauty standard. So in order to hit those standards, many girls turn to plastic surgery. Now it's no secret plastic surgery is extremely prevalent in South Korea. In fact, per capita, Korea has the most plastic surgery procedures in the world with 14% of women having some sort of plastic surgery done. U.S. only has 7%. And for women in their 20s, that number jumps to 30%. The most unnerving and extreme example is the story of Hang Mi-ok-gu. She was a Korean model. She had a beautiful, young face. Big eyes and great features. At the age of 28, she had her first procedure. From then on, she became addicted to the chase. The thought of becoming more beautiful. For skin that was more smooth and useful, it drove her to have more and more procedures. It eventually came to the point where the doctor refused to do any more surgery because of how enlarged her face had become. So because she couldn't get what she was looking for from the doctors, she took measures into her own hands. She obtained a bottle of silicone from the black market and started injecting it into her face. Eventually, she ran out and resorted to using cooking oil. The attempt on her face had left her scarred and deformed. In an attempt to reverse the damage, she had 10 procedures done. The doctors removed 260 grams, about 0.6 pounds of silicone, oil, and other foreign substances from her face and neck. The doctors did the best they could, but she was still left disfigured. Just a disclaimer, this is not an attack on plastic surgery. I personally have no problem with it. I think it's perfectly fine in moderation. Of course, there's nothing wrong with wanting to look beautiful. Everybody, and I mean everybody, wants to look beautiful. Who are we to judge and say shame on this person for wanting to look prettier? Shame on this person for not being born with the perfect nose. Why should a person be judged for doing something that makes them feel happy? And beautiful. But sometimes when a person fails to achieve that standard of beauty, this creates feelings of being unworthy or insecure about their looks. And sometimes, they take it to the extreme. Another extreme example is one by Hirae Momo of the K-pop girl group twice. She revealed in a V-live that she was instructed as a trainee to lose 15 pounds or 7 kilograms in one week. So for one whole week, she ate nothing but an ice-keep. But even that made her scared, thinking she was going to gain weight. During the blood, sweat and tears era, Jimin of BTS said he had to go through a diet that made him feel extremely ill. He also had to lose 15 pounds. This caused him to pass out often during practices. Sistar's Taesom once ate nothing but cucumbers for three straight weeks in order to lose 22 pounds or 10 kilograms. Now this is just three of many, many examples of idols, celebrities or even just normal people trying to keep up with the beauty standards enforced on them. Because this so-called beauty is so sought after and desired, many people will go to extreme unhealthy methods to achieve their goal. I wanted to find someone that had first-hand experience of this in the Korean entertainment industry. So I was able to speak with soloist Grazy Grace, an artist in the Korean music industry. So how strict are the beauty standards in Korea?  I think that a lot of people think that the Korean or Asian beauty standards are pretty strict because it's not something that the Western country is used to. I do feel like there is less inclusion of different sizes and colors compared to the Western countries. So it definitely may seem strict. But I guess to Koreans or to Asians, it doesn't seem as strict because that's kind of like what we grew up with.  But I do feel like the beauty standards are changing a lot. Like we're focusing more on talent rather than just appearances. In Korean, we call it like, which is like uniqueness, like your own personal talent that you have about yourself. So that is definitely being more focused nowadays. And I hope it changes like that because we shouldn't be focusing too much on appearances. We should be balanced. So I guess what are some of the first-hand experiences that you've seen of people trying to fit into these standards? Well, I've seen girls take laxatives because we were having like a weight day, which they check your weight like every, I think it was once a week. Sometimes they did it every day if they didn't really like us or something. But during weight check-in days, girls literally taking laxatives in order to flush out their system so it doesn't seem like they've gained weight. And that's kind of, it's not good for you if you're forcefully taking drugs. If it's not something that you're supposed to be taking because of health reasons. There would also be a time when girls would eat yogurt instead of meals and then there was like company people who would see us buy yogurt and they were yelling. Well, not yelling, but they were kind of criticizing the girl who got the yogurt containing too much sugar, too much less than that. Why are you eating that? And instead of like educating us and instead of educating us about food and what we should be eating instead of this or like literally providing us with something that we could actually afford, they just kind of, they just criticize you. They just say something about you and that's like the mental stress that just makes it worse. So my last question, I guess, is how do you think that Koreans, especially women, can learn to feel more confident about themselves and their own beauty? I think to feel confident anywhere around the world we need to have more inclusion. We need to include more sizes. We need to include more beauty standards such as if you don't have double eyelids. It doesn't mean you're ugly. It means you're unique. That's beautiful. You know having whatever it might be having a square jaw instead of V-line which V-line is very popular in Asia. I have a freaking square jaw and they didn't think this was okay. I almost even thought about going to surgery like having my bone shade because it wasn't inclusive in the beauty standards. If we include so many more things to this pot of beauty standards I think it would make a lot of people more confident and I think everyone is fine the way they are but it is also okay to not be fine I want to tweak some little things because we all have our own beauty standards and we all have our own happiness and what we want to do to our own bodies and our own confidence so we should be just okay and be more open minded with everything whether you want this or you don't you should also be very open minded. So what do you guys think? Is the Korean beauty standard too strict? Especially on idols? Let me know down below in the comments. Hey guys special thanks to Grazy Grace You should check out her channel and her new single called Planet Hey guys if you liked this video remember to hit subscribe that will really help out this channel and otherwise until next time