The sooner we get started, maybe sooner we can all head home once all questions are answered.  I'll write it down to make sure that we try to do it. I'm Jan Olson, Chair of Planning. And these guys can all start introducing themselves. I'm John McCullough, I'm on planning. He's our math guru, by the way. So we do a lot of, we lie on him for mapping. I'm Melanie Keene, on planning commission, I'm taking notes tonight. I've seen the comments from everybody. I'm Ben Beishor, I'm here just to learn as much as I can. OK. This particular event. I'm Jane English, and I've already said the question that I have. My sense is shoreland should remain into the body of water and not away from it. These wheelers left the chair here to learn. He's got a message. Citizen. I'm here to try to understand why the town has to deal with this, John, and not the state. So I'd expect answers. I remember this came up when we dealt with a Curtis pun. We aligned our zoning regs so they were absolutely in tune with the state. And that went down in flames. They weren't respective enough, at least not for the people at Curtis. So that's why we're here looking at another version. Ah, I'm Larry Bush. I live on Bliss Pond. I'm on the conservation commission and the Calus Lakes and Streams Committee. And I'm sort of here just to report back to my bosses. OK. Bill Davis, much as it pains me, I agree with the staff. Hi, I'm Terrence Reed. And this is, for me, this is sort of just first for me that understanding what's going on there, but we have a specific question here just to soak up as much information as at the end. We'll give you more information. We'll see. I'm Arlen Berkley, Calus resident, interested in knowing what's different from the state regulations and why there need to be differences for the state. I'm Bob Martin, and that's why I'm from Woodbury. Logically. I'm the zoning administrator and this through there. Oh, good. My sister wrote the new zoning regs for Kevin. OK. Most of it. Did she start from round zero? Oh, awesome. I'm trying to get down a little bit. Oh, sure. I'll get it. Yeah, I had it up pretty high because there was only 50 in here when I first walked in. You do know that John and I are listers, too. So I mean, planning and listing goes so well together. And I'm sorry you can't tell me that. You have to go and do enforcement. Yeah, yeah, well, you don't know what we find as we do inspections as listers. I've got a story. OK. That's another thing. I'm Susan Martin, just a better half. And I'm here representing the Woodbury Lake Association. I'm its president. And I just would like some information to take back to the members at our spring meeting in June. Great. Leslie Fitch. And just wanting to know what the changes are and what actual concerns they're intended to address. Randy Fitch, email harassment. Hey, Evo and I'm the DRB board chairman. So I need to know what they're doing. Well, welcome all. And what we thought we'd do is I have a brief PowerPoint presentation to kind of like do the overall. John has the maps. And sometimes what we've learned in doing this work is that a map speaks a thousand words. And sometimes by seeing the visual, it's easier to understand what they're doing. So with that, oh, here, I want this. The purpose that we started out when we started looking at what we have today with Shoreland and what we want to accomplish is basically protect the water habitat around Shoreland and preserve the recreational and scenic resources that we have. So the current wrecks, and we'll be going through that a little bit, do not at all align with what the state has as state Shoreland. So we decided we wanted to have our regulations be more in sync with the state and not be quite so different as they are now. And we have a fair interest in our community to have additional protections to the Shoreland above and beyond what the state wants. So what the current regulations do is it applies to all acres, all lakes and ponds that are of 20 acres. Right now, we have an 800-foot boundary from mean water mark, only a 50-foot buffer. The structures have to be 150 feet back. And it requires conditional use for any increase in the pervious surface above 10%. We have a current regulation show that we have a maximum lot coverage of about 10%. And as we learned, there are many non-compliant structures and non-conforming uses around the lake. And if anything is affected by that, it's going to go to the DRB. Within our current Shoreland regulations, you can have a planned unit development on Shoreland. It's a three-acre minimum lot size on your Shoreland. You can have single, multi-use family dwellings. And with conditional use, you could even build restaurants, bed and breakfast ends, and create impervious surface within 150 feet of the lake. So we have a pretty very, right now, our Shoreland is very broad. And no way complies with what the state envisioned. So we've been many months in reviewing all of this. We've looked and asked for advice from the Conservation Commission. We've had presentations from the Winooski, which friends, friends of Winooski River, A&R. We've solicited information from Shoreland owners. And we are great at copying, not copying, but we do read a lot of our neighbors' regulations. And we did look closely at Greensboro, Elmwood, Middlesex, and Faston, because a lot of them had Elmore. And Elmore. Oh, yeah, Elmore, thank you. We didn't catch that. And I think probably more important for us, we looked at this on a parcel-by-parcel basis when we were reviewing this with the maps. And that's why it became really important for us to have accurate parcel maps. What we learned is that probably 50% of land owners along the lake have parcels that do not comply with the three acre minimum at all. So 50% of the property owners around the lake are in non-conforming lots. Which lake are we at, sir? Pardon? Are we talking Nelson? I'm talking all lakes in general. Checking down. All the lakes in general. And tonight, yeah, we're focusing on number 10 Nelson and Saban or Woodbury. But it was true at Curtis, at Bliss. Well, Bliss, not so much, and Adamant. And we'll kind of talk a little bit about Adamant in that way. So they're not conforming now. And they won't be conforming ever. Well, but they were conforming at one point. No. Right? No. I don't. Before zoning. I mean, they were never really conforming. Well, of course. It makes it sound bad. He didn't have any zoning rights. Yes, you're right. All right. It makes it sound bad. Get your point out, yes. It's a pre-existing condition. Oh, I didn't really want that up. But it kind of shows this was an old map that we used to look at the boundary of Nelson Pond. And all these little, the little tiny lots that are there, those are pretty much all not conforming. Here, Saban Pond. And the purple on that is the shoreland area. And the green is rural residential. So that just gives you an idea. So what we thought we would do in proposing a shoreland overlay district, which we call the charade. Just to, I thought that was a fish. It sounds aquatic. Oh, is that what it is? We're going to call it that. Parsels that are near the lake, it's going to be just this. It's going to be an overlay district. And then what's going to happen is if you live in a parcel that is village district, your underlying district will be village. If you live on a parcel that is rural residential, your underlying district will be rural residential. We have a few that are resource recreational. So they would have two? Everybody, yes. You have two now, Denise. I do.  You don't know it, but you are. I didn't know it. A new rural residential. But you also, for some reason, because of the 800-foot shoreland, you're in that district and shoreland district as well. So the stricter of the two applies, even if it's village, it has to be three acres? No, we're going to cover that. We're going to cover that. I mean, that's one of the issues we want to hear from you. Because, yeah, and we'll cover that. When you see the map, you'll see it better. And the stricter of the two districts would apply. But in terms of it being an overlay, it's just an overlay of what is there. So we want to apply state shoreland protection act standards, which will be the same. We don't really want to duplicate what the shoreland is doing. If there's any development and there is not a shoreland permit, then the owner should comply with the Calis shoreland overlay district. It now applies to 10-acre lakes. Remember when I said our current applies to 20 acres? Now the shoreland overlay district will cover all 10-acre lakes. So we added new lakes. Adam at Pond became added. They never before had been under shoreland. They are now going to have shoreland overlay. Little Mud Pond, Sodom Pond, and Watson Pond have been added. Where's Watson? A little more there. Up on Gowney Road, that area, north of Midford. That's my best student. Jan, the state standards are 10-acres. Now that's part of applying. So getting it from 20 to 10 is in part conforming with the state. We're applying with the state. We're being consistent with the state. I'm trying to catch up with Blueberry because we have so many lakes. This is the standard state diagram that the state uses to show a 100-foot buffer. So we're going to go from a 50-foot buffer in our overlay to a 100-foot buffer, which is state. And then the 150 feet that goes beyond that. So the total shoreland overlay district will be 250 feet from mean water mark. And what is it now? 150? No, 800 feet. Well, it's actually just three pieces for what we have now. There's a managed buffer area of 50 feet. There's a no-build zone of 150 feet than the edge of the shoreland district. And it's a district, not an overlay. The edge of the district is 800 feet. So the two areas where we are going to differ from the state is impervious surface. The state's requirement is 20% impervious surface. We have for years had 10% impervious surface. And we're going to keep the callus 10%. We know that there are some people who would prefer that we stick with the state. But we also have a lot of people in our town that would prefer that we stick with the 10%. So right now, our proposed regulations would be to be an impervious surface of 10%. I'm sorry. I missed what you said the states was. 20. So just to set a quick curiosity about the impervious surface, it seems like a huge amount of impervious surface that actually is nearing in the lakes. And I'm thinking of our public roads and our fishing access. I mean, the roads themselves. Well, that's the next thing that we'll. Our huge. Yeah, that's our next thing. The state and their shoreland at roads, we are not. We are covering our shoreland overlay district will include the roads. So if a property owner has land that's across the road, like there is around, there's a lot of road on number 10. We have a lot of roads that are right up to the lake. The state shoreland ends at the road. We're going to expand if that 250 feet of shoreland overlay goes over the road, then we want best management practice. I'm relying on Melanie to keep my language accurate. We want best vegetative management practices that the state requires to be on that side of the road as well. So we want to instill the idea of best management vegetative management practices for our shoreland overlay that will go on either side of the road. If the shoreland overlay that 250 foot mark is over the road. You want to be careful how you define your roads. I was talking to the attorney from Fort Myers today that went to the Supreme Court. Fort Myers, Florida? Florida. And this is a piece of property where there's heat and the budding owner does not want to happen. It hasn't gone into the environmental court yet, but I think it's going to. And it's going to come down to, well, is this right away a public road used? And the Supreme Court says, yeah, it is. It's not really going to our thinking. It's right away to somebody's camp. But the Supreme Court says, nope, it's public, considered public. So your shoreline stopped. This was 70 feet, 20 foot right away, and a 0.3 acre parcel. They're going to put a big house on it. Well, this is here. Oh, it's here? Yes, last time, we paid taxes to sell the road. It depends on. I think it's interesting because the state has started to instill new road requirements as well. Well, that's actually what I was wondering. And the last state planning meeting that I attended, they had a lot of information about what they were going to have the roads be. And right away, with our Lister mapping, I'm real touchy on what the right of ways are. It's kind of a problem. We have surveys that take out the right of way and reduce the plan because it's based on right away. So I mean, it's a total gray area to me. It's really interesting because usually the parcel that somebody wants to build their year-round on can be adjacent to and attached to the shoreline lot. This one isn't.  And it's a grandfather in Tiggul's lot. I think it could go to our dear. Isn't that? OK, I think that's all I had, actually. So you can go to your hands to minimize that. We just added a bullet. I'd like you to understand. The strict regulation of non-conforming lots and uses and non-conforming structures. We have current regulations, which we're going to keep. If there's a non-compliance structure within the 250-foot shoreline overlay, and you decide that you, if somebody says, I'm going to add a deck, we're going to have to go to the state anyway. And assuming that we get a state permit, I doubt that anything is going to be happening here. But our regs stay, it still has to go to our DRB, because any non-conforming change, whether gritty call, horizontal, or whatever, goes to the DRB for non-compliance buildings and lots. So we're keeping that the same, and that's basically what that last bullet point means. And that's how it is now? And that's how it is now. I wondered, I talked too much. Does if somebody is going to do something on the shoreline, do you require them to get the state shoreline permit before you guys will do anything? The zoning administrator does. They have to. The town can exempt anyone from the state. No, what I mean is they'll come to me for permits, and they haven't gotten their state shoreline yet. We ask them to go. I'm zoning administrator, and if a person needs a state permit and it has to go to the DRB, they get that together before you go to the DRB. Now we're going to turn it over to John, where he's got a series of maps. We'll kind of talk it through. OK, focus right now on the bottom of number 10. These are the existing conditions. The blue is obviously the water. This darker green is the 50-foot vegetative buffer that we currently have in our rapes. This boundary of the green, this is 150 feet from the water, and that's basically the no-build zone. And then from here to the edge, that represents our shoreland district. It's not an overlay district. It's a solid district with its own standards. It has a three-acre minimum. It has a 10%. 10% maximum development area, whether it's clearing or pervious surface. And because it's a real district and not an overlay, a budding district, this yellowish kind of thing, this is rural residential, it stops at exactly the point where the shoreland picks up. The same is true of this crosshatch reddish area. This is a village district. That's North Cal. That's North Cal. It's a village district. And most of the village isn't in it. Yeah. So if we look at that, that's a village which has no minimum acreage requirement. Yeah, no minimum lot size, 68 feet of frontage, 10 foot side setbacks. We move up to the green, which is our shoreland district. We have a three-acre minimum. 300 foot frontage. And then which includes the buffer and the 150 acres. So that's what we have now. So one of the things that's going to happen is we get rid of the entire shoreland district. And we've got a, so there's a village. So what happens to village if we get rid of the shoreland district? And what happens is, bear with me. I'm trying to find my way through this proposal. OK. OK, so there's the new village. So what this is showing is the very dark green is a 100 foot buffer. Then combine that with the light green is your 250 foot shoreland overlay. This district was drawn so that this boundary was 400 feet from the center of the road, North Calis Road. This boundary runs right down the middle of upper road. The two come together at a point here. And so I just took the same 400 feet from North Calis Road. And that's what gave it this ugly shape. But that's village. And everything else reverts to rural residential. So the question? The yellow is rural residential. All the yellow is rural residential. And that it remains at a three acre as rural residential. The question is, do the folks who live in the North Calis village area want to keep this as village with the kind of standards that are in village district so close to the lake? But it doesn't drain into the lake. No, it doesn't. But it drains into the streams. Yeah. Well, everything drains into the stream somewhere. But most of North Calis village is below the outlet. Quite a lot. Quite a lot. It's a village. I think it's important for us to remember there aren't too many villages that are up on the top of hills. Most of our Vermont villages are down. Follow the streams, the brooks. That's where our villages are. And I was under the belief that we wanted to encourage our development in our villages and not out in the we don't want to be encouraging the development and taking up agricultural land and building the houses all over the place. So if we want to encourage the development in our villages, then this is what we need to do.  And done properly. And it's interesting, in North Calis, where there's a lot of that southern part. There's old cellar holes along there. Houses that are falling down. But that was quite the village, I guess, at some point. Right. It has a good history.  And it's got a wealth of history. And I look at it now, and it's like, I don't know. The other problem is a lot of that area has, do we have steep slopes there? It's the topography. I do, I just think I have confidence. So we also have that to kind of consider, but yeah. So this is what we're proposing is that that village district is that for the North Calis area. Everything else that will remain as rural residential based on what it is now. Any people like that? I think it makes sense. I did work with the DRV to do renovation and construction in the North Calis Village. Six years, seven years? How long has it been here? And I found that it worked. Made sense that the DRV was really clear that we want to encourage development in the village and not sprawl as Leslie was saying. And also in terms of thinking about where we were putting in any infrastructure, like figuring out the septic and all that, we complied with the state. And that's with the funny strike right now. It's tough in North Calis Village because everybody's well, it's really close to everybody's well. It's not easy, but there are good regulations in place. I have a question. If somebody's, I noticed on the previous one here where you were showing the light lines, that square that's the Bushway property, a little bit of it's in the village. Does that mean the whole of his property's in the village? Which property are you talking about? The square, go up the square to the left. Oh, to the left. To the left over here? That's right there. That's square, that's Bushways. And a little bit of it's in Shoreland, a little bit of it's in village, what happens to somebody's land that falls into a bunch of different districts? If the development was in village it'd be entitled to village standards. If the developments were all residential it'd be entitled to the entire land. So they can have three different sets of rules going on one piece of property. They could. Okay.  But that doesn't turn everything into Shoreland. You're right, you're right. Yeah. And even that, from this point to this point, development is still allowed, but there are limitations on how much. 10% of it. And there's limitations to how much you can clear. Yeah. And again, this, our rigs have it so that these buffers go across public roads and the public road in this case is great. I see another question in there. There's part of that green that surrounds number 10 pond that does not drain into number 10 pond. The northern section of my land? Yeah. What about it? Yeah. The part that's green, right, right just above that. Yeah. That section there does not drain into the pond. It drains downhill. Right, that line, the new property line that you guys put in, that's where that big line of rocks are. Yeah, right there. And that's the height of land. So I guess I don't think that that part of my land should be considered Shoreland. Well, for what it's worth, the state of the month does. It's in the Shoreland protection area. Right now, the, I don't think the. They don't have anything to do with drainage in the Shoreland. It's not, no, but that's ridiculous. We've got the same thing around Curtis. And at the bottom of that, I mean, all these villages were built at the bottom of the ponds where the dams were. Possessively. It's not the case. That's where you get a line that exists and concentrated growth. Power and the laws. And the part of Shoreland, my understanding of what the state wanted in doing Shoreland had nothing to do with where the water drained. It's a matter of protecting the whole area around all of the lake in terms of keeping the habitat and the vegetative and the flora and the fauna. But it's already just lawn. So there's no vegetation to protect there because it's just lawn. Well, there's some grandfather thing about just lawn. We allow it, but because people have kept been mowing, we don't necessarily like it. Who's we? The state. I mean, that dark green area is considered a no-mo zone. Yeah, well, light green is what I'm talking about. And the light green, there's certain vegetative management practices that would be nice. But we don't need to apply for a permit for the future. Well, I'm considering what the mother and the mommy might do something. And I might see where I could put it. Propose regs to Shoreland on buffer zone. It says you have to mow at least once a year or it goes back to you can't mow it anymore. It's what it says right here in number six. And what happens if somebody just doesn't want to go to camp for a year? And who's going to be the long police for that? I don't think that makes any sense. Oh, trust me, though, we've got long police in Calis. Well. Oh, yeah. Yeah. Can I ask about extending the buffer zone across the road and what happens to keeping the roads clear for the end of the roads? We have some narrow roads in Calis. And they need to be cut along the sides or we're going to have to put them back. They've got the low population density. We'll have more accidents. Right, but how does that impact it? I guess it doesn't because the road standards, as I understand it, has whatever it is they can do on the right of way on each side of the road. OK, so the road standards supersede the stride? Yes. And then if there's a fix, let's say I've got 20 feet beyond the right of way of the road that goes into my personal line. And it's still within the 250 feet of stride. That 20 feet is kind of stride. I mean, just to protect it a little, I guess. I know there's not much we can do about it. I'm just curious about whether or not the state has ever said or has any point about it to manage the roads or remove sections of roads to, I know, I recognize the whole point of all of this, which is to preserve the bodies of water.  I think Spare say they're dealing with it right now. They're probably dealing with it now. Did you clean or did we run off from the roads? Because all the attention now is to what is a roadside ditch that we pick some sediment and start when it comes off the roads. Well, sure, in some of these along Nelson, I'm a long member 10. I mean, it just drops in a way. And the cloud blade goes by. Oh, yeah. The state has more regulations on the roads than they ever used to have with regard to making sure that you don't have drainage into the streams, and drainage into the ponds, and drainage into the lakes, and all that stuff. I realize, fully, too, it's really tricky. If you look at someone like that one along Nelson, it really isn't able to put that.  We have the same issue on some of the roads by Bliss Pond. Yeah, sure. And we have a lot of up-road issues like that in California. Yeah, but I don't have any concerns. I'm just curious if this still works. But there's a lot more coming, too, in terms of the state's stormwater permit, right? Right, yeah. Municipal roads, yeah, it's all in the rise. Municipal roads, general permit. We're even just best practice in terms of which additional use permit to use our roads. And state, that's us conditionally use our roads, and we have to pay a fine. Just to clarify, since the roads stand and supersede the trod anyway, how much are you really gaining by extending the overlay district across the road? Our roads are good. And it constitutes a taking of somebody else's rights. So what is the objective, absolutely? What is the objective? Because we really shouldn't be increasing regulations without a specific problem that we're trying to solve. It came up a specific portion of this, came up at Bliss Pond, where we were told that surface water runoff from the Sterilina's property was going right into Bliss Pond. And that surface water runoff could be, in part, intercepted if the vegetative buffer extended across the road and picked up some of that. That was one point I remember. So we beat everybody with the same stick. I wish I could say yes. So the solution isn't to address that one problem. It's instead to like. How can one in running a town say only one person can has to do it one way, and everybody else is free? Well, but if only one person has the problem, they can be worse on the road. But I think there's more problems in that than we know. I think we were told about that. But if I were to drive up the road by number 10 and see how many things are running off that, off the land there, across the road, down into the lake, there's a lot. And I agree with you, because the road's right in the way. Right, but it's going across the road and into the lake. So if there's a stoppage somewhere at the road that will stop it from going from the road into the lake, that's what we're hoping for. But there's no dare change in the road. The water does run down. Well, I know. If the road standards go in and they start doing ditching on that other side, and you start building some kind of ground cover so that that starts absorbing the water going in before it goes into the ditch, then you've stopped the water from going across the road and into the lake. That's my understanding of what they want to try to do. Sounds like a reason to walk in. We have to protect our hummus. It's really important to protect our lakes, and they're already facing enough other problems. If it's a matter of planting some vegetation, I don't see what the big deal is, really. I've been monitoring Woodbury Lake for 40 years with the readings, and it is so interesting to see we get nice, secchi-depth readings of 7, 6 and 1 half, which is deep, it's a good lake. And then there'll be a gully washer, one meter, one meter. Let's just stop the rain. Well, the other problem is the roads are getting higher all the time. Oh, yeah. There's no doubt. I mean, where we are, it has over the last dozen years, the road around Nelson Pond has gone up by about 18 inches, almost two feet higher than it was a dozen years ago. I mean, so it's. And it's a solid six feet higher than it was 50 years ago. Right. Do you live at the town hall? Yeah. Right. We just keep putting surface on it and adding and adding, which increases the problem. The problem, because they're mostly fine.  Right. What lake is this, John? Woodbury? All right, Woodbury. There's not very many places on that shore at all. There's one there that somebody wants to buy a place that's just kind of available for $800,000. Is that all? It's a nice place. In Woodbury or Kalis? It's in Kalis. Really? In Kalis? Yeah. Which side of the pond? John Harding's place. Oh, OK. Oh, yeah. Well, $799. That'll hurt our CLA. Yeah. It's a big place. Have to think of everything, you know? OK, so I'm trying to distill some of the things that I've heard. A lot of questions about why we are extending over the road and not being and following the state and stopping at the road. What other issues? The lawn business. OK, yeah, the lawn and the mull. OK, that item number six, you mentioned. Yeah. OK. Is the state standard essentially the same for that? There's no standard for that. Well, you don't increase the size of it. Well, what about the 100 foot mull? The 100 foot buffer is considered no mull. For the state as well. For the state, yeah. OK. But that's a buffer as a buffer. But I think this is something that relates to something else. OK. That if you have been mulling up there, and we're saying if you don't mull there in a year, then you're going to have to revert to vegetative practices. Sort of in the light green area, right? No, even in the buffer. We've got people that mull, they have a thing in the buffer and they mull up to that state. Right. But you said the state also has the same standard in the buffer. They have a mull buffer. Period. Ours is somewhat grandfathered if you've been mulling it then you can, but if you don't do it for a year, then you can't. No, that's proposed. Right, that's proposed. That's not what's the law now. And I'm saying that for proposed, that is crazy. That's what I'm saying. I don't agree with that. People don't come to camp for a year. And all of a sudden they can't mull their lawn anymore? That doesn't make any sense to me. I'm sorry. People go away. People have deaths in the family. You might be interested to know that in Maine, the realtors did some numbers on shorelines. And the people that were mulling down to the shore, 20% less than the people that were doing the shorewise like the state used to. 100% less than what? Some price. They sold for less. You had something to do with all the keeps on the lawn. Say that again. If you were mulling, your property was less. Your property sold for less. Less. Stay to me. And they haven't just ranked for a long time. They paid it for 40 years. I'd say we do not mow to the edge. We don't do it. We don't have grass to the edge. But I think if somebody has that, they should be able to keep doing it. Whether they're gone for a year or gone for two years, why should they lose their rights because they're not there at their own property? That's all I have to say about it. I just don't think it's right. Jay, if you were to ask anybody about your state a couple of months ago, have them tell us that they're not going to be able to do it. I'm sorry. I've never asked anybody about that. I mean, I got a feeling that when they were starting to look at the shoreline protection act as it affects properties around the lake and the plain in that area, that's probably when they ran into the road then they were going nuts. I think it's a concession to the worst in that part of the state. So I don't know why they did it. All I know is that since then, they have started adding stricter standards to the roads in order to affect the runoff that's going in. So they're slowly trying to correct what they didn't do the right first time. So I have a question. Going back to the North Calus village, there's two things that have been said that are conflicting. You told me that the state standards mean that it has to be the light green has to be shoreline. But the state standards stop at the road. So that's not true. Public roads. Public roads. Yeah. Well, the AR road is a class 4 road. It's a public road. That's actually a big question. Well, whatever. But there were some parts of it. So that needs to get sorted out. Well, ownership of the AR road, I agree with you. Right now, we've found no evidence that it's a town road. The listers have found no evidence. And I know that the people strongly feel it is a town road. And the listers looked, and we finally stopped at a point where we couldn't find any evidence that had belonged to the town. We did find evidence that it was meant to access Memorial Hall for the purposes of people visiting that hall that are in some such people who remember in the Civil War. But that was the whole reason we were open to access to Memorial Hall. Well, you do have road on there that's town road. It's now in the overlay that wouldn't be, right? Because that's no pretend on there. Here's a public road right here. So you can see that the state stops right at the edge of this road and basically right at the water's edge here. And this is North Calis Road. So it would stop right along North Calis Road. So how far up Foster Hill is that? Sorry. But you're saying under the new chain at that point there? It would no longer stop. Right, if we. No, it's not any more than that. Do you have one that showed what the state was? Yeah, I was looking for it on this. I don't know if I have the state on this. But it would stop at those public roads. And so that's a question is whether people feel pro or con on that. Whether it should track the state then stop at the public roads or. OK, here, I'll turn on the state. That's where the state is. Here's the state. That's the state shoreland. And then not on the other side and on the time because it's a public road. So you have no protection at all? Up in the state. Same thing in Nelson. And there's Nelson on it. So that's the state shoreland regulation as it is stated today. Unless the state comes down and you were saying they're looking at someone's right of way treating that as a public road. They come out with something definite. I'm sorry, I can't hear you John because he's got you in. OK, I'm sorry, John, could you say that again? Well, I'm sorry, I forgot your name. Bob Martin. Yeah, you said that the state Supreme Court is looking at a private road and federal Supreme Court decision to take the attorney to the courier's dock. So if they decide that a private road is a public road, then that changes this whole thing as far as the shoreland protection act goes. But actually, the shoreland covers private roads on the state. What we're showing here, these are class 4 and class 3 roads, which are public roads. Yeah, I know. But if the court says that those class 4 roads and private roads are called public roads, that changes the whole shape of the state. John, I don't think he's going to get away with it. I hope not. Can you zoom out on North Calus from the North Calus Village with the current state? Down here? Yeah. Why is that? Why is that so different? Because I clicked on someone's parcel. Oh. Click on someone else there. I would say with a small representation of the town that we have here and at any meeting, what needs to happen is, I know it's an expense, but an informational handout be sent to every taxpayer with concerns for our lakes, with the state guidelines outline, and the proposed town guidelines. And to discuss getting the vegetation that's needed, we would need natural plants to this area, to the lakeshore. That would be beneficial to wildlife and to even the landowners. There could be berries or something picked. And make a fund and provide this. I mean, not everyone is going to be able to afford this vegetation. I think it's a matter of having people understand that it's not about taking property rights away. And I don't think the town needs to take possession of a certain amount of land in front of someone's property. But it's a matter of getting this vegetation, getting the information out that this is what we're trying to do and showing the advantages of having this vegetation and the advantages of not mowing, encouraged not mowing. I think you've already done that. But to make it very clear that no one is trying to take anyone's property, the town is not trying to advance on anyone's property. We're all very sensitive about our property. It's our property. We're already encroached on so much. But it is very important what you're talking about here. So I would think that that would be a good way to approach it is to get the natural vegetation. I have talked to Doug Guy, who's a fantastic gardener. We probably all know him. And he has talked about many plants that could be placed on the shoreline. I saw in that huge rainstorm last year, I saw a lot of stuff going into Lake because of a landowner near in the camps over there decided that he would go down there and weed whack the whole shoreline. Well, before that, I saw that grass and all holding back the rain. I witnessed it personally. That grass was holding back the rain from going over the edge. Once he weed whacked that, right down it went. Right down, made a nice little river, right down into the water. And I saw the erosion out in the water as well. And it went quite a ways out. I wasn't happy to see that. So the weed whacking really made a big difference. The vegetation, just let the natural vegetation grow along the shoreline, plant some more if necessary, that would be a benefit to the wildlife, to the birds, and all the pollinators that we have, the bats. If I could echo what Tammy said, I would prefer to have encouragement than more wills and loss. I think a vast majority of people who own property around the lakes care about it. I don't think anyone is intentionally being malicious. There may be a little bit of ignorance out there, but I think that's changing. So I kind of, in a party, says, why burden people who already care about the lakes? If education is first practice. And furthermore, I think at some point, you've got to think about tax revenue. I need to put it in those terms. You know, the more we restrict the rights of lakefront owners, the less they're going to want to own that lakefront. So you're saying that with our mowing, in effect, that mowing thing, is you're sticking to the mowing? No, I'm not really referring to the mowing. I think that, as a general nod, most of the mowing that I don't think are intentionally trying to do anything malicious. And I actually think if the amount of lawn that is around those, at least I think some of them are really using a whole lot. So I'd rather see education than the legislation. It is education. We understand that. And I'm a great proponent of the word encourage. But I am told that we can't use the word encourage in regulations. So in other words, regulations are a shell or a bay. But going out to 250 feet from the waters, it really does swallow them up a lot. Maybe that's the point. Well, remember, the no mows on is the 100 feet. And we're just, the 150 feet, you can do a lot there. You can clear up to 40%. You can have other things going on. Where the biggest concern is, is the 100 foot buffer area. That's where we have seen where people have been mowing in that buffer. Like Tammy said, the guy that killed off everything and then went. So it's the buffer area that's our main concern. That's the dark green. The dark green. Yes. I'm a big fan of encouraging folks to do that. And on the Lakes and Streams committee, I hope some of you are all seeing, in prior years, twice a year, would send a newsletter to folks about things involving the quality of the lakes in the streams. And with specific regard to Nelson Pond and number 10 pond, and I think Curtis Pond, we had prepared a best practice this flyer. And the hope was that the landowners themselves would take it on board. And if they rented the property, that they would post it so that renters would understand what is a bad thing to do on the property. I hope that had some positive impact. But you know, these places, better than I do, certainly up in this part of the town, I don't know whether it's changed from the bodies mowing practices. No, I think some of this guy that's weed-wacked, I think that he is like, there's the ignorance. But there's also the willfulness, despite anybody, he would weed-wack it.  It seems like the road issue, which is a big one that I'm just looking at again, says the town already has the rights to do ditching along the side of the road, which you're worried about in front of, and already has the rights to do things with management of vegetation. I just don't see what you're really gaining other than limiting people's property rights by extending across the road. Because the town has the right already to do something on the other side on both sides of the road. So to manage the drainage. To manage the drainage, yeah, thank you. I appreciate that. And I also want to say, I appreciate it. Look, it's clear you guys have put so much time and research into this, which I appreciate, because clearly what you're interested in doing is trying to protect our late sisters. And I really do thank you. I do think your charge on the front, your first list of bullets, is tricky, because I think you have contradictory bullets. And so if your charge has conflict in it, I think that makes your job really hard. So to say that you're going to bring us in line with the state and then have another bullet that says we're going to extend beyond the state, those are contradictory. And so that's tricky. I'm bringing it in line with the state from what we have, with the exception that we were adding to other things. It's really the flow. Forgive my ignorance. I don't understand the process. So this proposal that you're making, is it go to the select board? Well, OK. This is just an information session right now. No rent, sure. And we are working on other things, which are equally as problematic in some ways, which will happen is then there will be a public hearing for all of the changes that we want to propose. This is simply one aspect of it, but we realized that it affected a lot of people that live by the lake. So we're just providing this information as a start. And if we hear something that we think we want to change, we can still make changes, because it's still in a draft. Let's drive it down the road. Is it approved by the voters of Calisford? Yes. We're working on some of the other things. Public hearing from planning, it goes to the select board. They get to do whatever it is they want to do within 180 days. If they approve it, then it goes to the public for voting. We mainly try to do that at town meeting, so that it's all everything at the same time. And we've been working on this so long, some of us are really getting sick entirely. So we'd like to, you know, we're hoping that we can get some. We want to work on river corridor. That's the one thing we're working on, because we need to add river corridor protection. We have some thought about store management and erosion control. We're not sure whether we're going to go through. We're still evaluating it. And then there's some general stream buffer. The whole issue of the streams. We kind of have to rewrite it a little bit. So I would like to have this voted on by next year, which means we need to have public hearings closer to the end of the year. But if we don't, we don't. I mean, my issue is we would rather have quality than push for time. Yeah, I would encourage that. And this is a really important part of that process to hear from people and see what the town works. Isn't we lacking the shoreline at Mirror Lake that's been being done? Isn't that in the zone that needs to not be we've lacked already? You're right. It shouldn't have been the state. So if they were to apply for a permit, that permit would probably say you can't do that anymore. Was it that John was just saying, though? The state has a clause in it about a grand father to be lacking in personal security. So they're saying he can keep doing it. And I just want to say, too, that the State Shoreline Protection Act has been in place for about five years. And anyone who owns land on the pond should have a copy of those standards. They're easy to get. There's a lot of supplementary information about what makes a good community. There's lots of stuff mitigation strategies to control surface water run up into the pond. There are tons of resources. So as far as the town informing citizens, we'll do our best to get this stuff out. But it's up to the property owners to have a handle on what the standards of the Shoreline Protection Act are. And to add to that, we are looking at when we format our regulations, if in fact there is something that the state has out there that gives guidance, like what kind of plants and vegetation to have, we would put it in there as a hook so that you could hook on it and click on it. And it would go to that form. And so we want to be able to have an interactive document as much as possible. Have you heard of the Federation of Lakes and Monuments? Very powerful, big organization. Federation of Lakes and Monuments? Yeah, Cultivation Commission gave us the lead today. Yeah, they've got it all, homeowners are going to say, well, actually, because they're closing the species, the plant. Well, the state of Vermont does too. If you look on there, I have looked and there's like a list of 20 documents that spell out everything and every which way from streams and wetlands and lakes and what kind of vegetable, vegetables. Vegetative management, my husband planted his tomato seeds. I guess that's exactly what he did. Another question on the village thing, that 400 feet. I think traditionally, I mean, number 10 pond is number 10 pond because the number 10 schoolhouse was, I guess, somewhere out near where Fred's house is now. So that would have traditionally been part of the village. So the 400 feet from North Calus Road seems like it truncates part of what probably used to be considered village. I can't find any written documentation that told me how big the village district was, but it's clear from measuring. And what I'm seeing here is what's been in our zoning regulations since they established these districts. I was able to measure it and it was consistently 400 feet from North Calus Road. So I just extended that. You're suggesting that maybe it should also be. Actually, that works below south of the junction with number 10 pond road. But you're saying maybe. When you get up into the village itself, I would suggest a little more. Which way over here? No. Well, maybe over there. Yeah, but certainly there's some houses up in there that are part of the village. OK, now that's interesting. Anyone else feel strongly about expanding the village? Traditionally, village, some of the houses up on the right-hand side there and over at Fred Bushway. That's Fred Bushway. So you're talking about to the east? Both. East and west, sort of, including a little more, make the village, because it kind of gets skinny at that end. Yeah, it's very skinny. And that was really the center of the village. So it's kind of counterintuitive that the village is narrowest where the actual village was. Well, Christmas definitely's house used to be the store. Yeah, and that's not encouraging the village. Their barn is, but not their barn. Yeah, so I think it should be included some on the right and some on the left to make North County's village a little fatter. So it's almost straight up behind their house, too. So you're saying to expand it? Yeah, expand the North County's village a little bit. To how far? You want it to go to the other road? Do you like to see it go to the other road? Like Chris and Stephanie, this part should probably village their houses in there and maybe a little bit in here, because the old school house was somewhere in this area. But it's just a liner cosmetic addition. Yeah, just to make it kind of fit. But having the building used to be the store and the post office not in the village is really kind of ridiculous. Yeah. Could you show the whole pond? So go to the top of the pond. Where is your house from there, Ben? This piece has the stream going through it. Oh, OK. Yeah, up on the side of the pond. The property is up further. Up further? Much further. Yeah. Go back. It's way up. Is there a school we talked about? Ben's place. Oh, Ben. I said we're on the way. Ben and Karen. What, you're up here? No, show the whole pond.  See the little stream that comes in here? No. That works. Yeah. That's right here. That stream is to the right of where the house is facing. And behind there, there's a little beaver pond that arises and disintegrates every five or 10 years. According to the view, it was in the weather. It's a caravan. It's a caravan. Caravan. A caravan. Yeah. I don't have all this stuff on this one, particular map, but I have a strong suspicion that when there's a stream that goes along and stops and then starts again, you've got a feeling there's like a little wetland kind of thing. Well, it probably goes under the road. The road's right here. There's a wetland in there. Yeah, there's a wetland right there. It's a beaver pond. Turn the wetlands on. I don't have a wetland. Oh, we don't have one on this one? OK. Then it gives them all the ideas of what we have to go through when we look at wetlands. Ah. That's cool. I've probably got it on another map. OK. There's an interesting delta in that stream. It illustrates in some ways what happens when there's uncontrolled water going into a lake. It spreads out quite a lot. And it's all mostly the same. Yeah, it's quite at that. The stream is quite a delta that goes out into the pond. Yeah. Oh, yeah. There it is. Yeah. I'm almost at the point. Yeah, it's soaked. Can you go right by it? To go on the stream? Yeah. Yeah. When I look at the beaver dam breaks, everything's always out. Beaver dam breaks. Right. There's blue errands. There's ducks. That's curious. Yeah. Yeah. Breakdown shows the delta. Yeah. Huh? Yeah. OK. Is that extended for a line out? Good question. No more shoreline then. You do all of you have an on-colour crystal. Did you have something else to say later? Oh, you were also. Any other concerns? We've written down the mowing, the road issues. Extending the North Calus Village. Yeah. And extending the North Calus Village to make it prettier. More village. More village. More village. Yeah. How do you propose to enforce this? The way we do it now. Just by through education and angry neighbors. Angry neighbors? That's pretty much it. People come in and ask for a permit, and I'll talk to them about it, and we'll see what the regulations allow. Otherwise, there are people who don't understand that there are limitations to what they can do in Charlene property, and they get found out when someone wraps them out. I just said it's just the way the system goes. Right. Unfortunately, that's the way it works. There's no one out riding around. Right. There's no zone in the place. No. People. And so, yes. We just had a permit where the people cut down. This is a 1.3 acre parcel for a new place. In the 250-foot zone, they cut down almost every single tree. Okay. Then, Lindsay Miller showed up. Looking from the state. Looking from the state. And they got permission to cut the rest down. The big loophole is called a hazardous tree. Every tree is hazardous. Oh, my goodness. Okay. Now, if you want to give me your e-mail address and you want to see the draft of the language, I can mail it to you. That's what we have. If you'd like to do that. And I can e-mail you. Can you just put a link on Fort Ford or something? There you go. Put it on their website. We can put it on their website, too. We can put it on their website. Yeah, actually. That would be better. Right. Yeah, because I noticed that Eastmont Piliar does that. They put a few drafts on their account website. And I'm going, oh, that's a pretty good idea. I was looking for, and I had to call John. He e-mailed it to me. But it'd be nice if it was on the town site. Okay. We will put up a place that says what we're working on so that you can look at what were the maps. Yeah, I was going to say, can you link all the maps? All the maps? It's complicated. The maps are a link to the maps. Or a screen. On the website. These maps are different than what we have on the interactive map on the website. The interactive map. I mean, the interactive map actually on the website does have a lot of this. But what John has used is, you know, we play a lot of what if. Well, but if you just, like, a screen shot, it wouldn't have to be interactive for the user. Yeah, I could do a screen shot. Take the most probable things, do a screen shot, and then just say, hey, this is what we're looking at. The contrast of the old and the new. Yeah. The old and the current. And we know we'll have to do that for public hearings. Yeah. Yeah, you're right. We should go out and put it out on the website. This is amazing work you guys have done. Yeah, it is. It's a completely different crowd. And we've done this now pretty much. Yeah. We're the third group. Yeah. We've curbed upon people at attended meetings. And then we went to Adam's. And we did Adam's. I missed the curbs. Well, they came at one of our meetings. Yeah. And tied with conservation and links and streams. And a lot of. A lot. So Curbs Pond was represented of that. And a lot of landowners are out of state. Right. Right. They're not even here. Right. That's right. It's not possible for them to here. Here. So are you saying we need to do this in the summer time? Right. Are we all here? It would probably be a good thing just because. Yeah. Especially for Nelson Pond. Yeah. They do pay taxes. They still can initiate the town hall. Right. There you go. They don't get to vote, but they do pay taxes here. That's true. Is there any other thing? I think this is. I'm just going to say something from my gut here. And that is, you know, our family owns most of the eastern side. Number 10 pond. It has for seven generations. And you kept it the way it is. Because you wanted it that way. And the public reached the benefit. But what goes up my, you know what sideways. So people tell me what I can do, even though I'm already doing it. So that, you know, it just bothers me. Maybe that's the old Republican ending, but that's where I start to get a little upset. Our family is cut ice out of that lake. Fence posts out of the cedar. You know, we've made our living around it. You don't do that anymore because we're not dairy anymore. But it's property rights and it's how people feel. And I think you need to take that into account. Changing buffers and changing, changing rules. Just because you think you need to. The state already has rules and I've been through them to change a camp. And I found it not too onerous. But to have to go to the, to the state and then to the town. In the DRB, kiss the ring. It gets to be a little bit much. That's where I have a problem. It wouldn't affect anything on Nelson. Foster Homestead at Nelson. That's ours and the state. I'm speaking for me and I'm speaking for people who are on the other side of that road. Yeah. You know, and my cousin, Peter, who also is going to get affected enough that you're going to cross the road there. And I'm not saying this to be argumentative. I'm trying to understand. And you gotta remember 75 years ago there was no trees here. Right. None of them. Right. A lot of sheep. Yeah. Right. I mean, you could walk all the way from Kent's corner to Nelson Pond. No tree. Like that. It was open. And these ponds are beautiful and they're healthy. And we've been treasuring them and caring for them. We're not saying you have it. We're just saying that we're just making our buffer and they equal the states. That's all. Well, then you don't need to do it. If the state has it, then you don't need to do it. It's redundant. But we have to find a way when somebody says they want to build something. We want to know that it's within our guidelines as well. But you're extending them beyond the state. I think that's probably how we feel. I think that's what Bill is saying. In the two areas relative to the road and in curbs of service. Those are the two areas that we differ. So I'm hearing you object to that. Okay. We've got a 50 foot NOMO buffer right now in our current rigs. And that already crosses public roads at where the road is closest. So we already in effect have zoning that crosses the roads. And technically should we tell a person you can't cut. I don't know how big the swath would be. And mine would be 5BY. But we've got that stuff already. There's a loophole so no one can stop someone from weed whacking to the shoreline near a lake. No, it's a grandfather's boat. I don't know if you call it a loophole. He just said it. It's a loophole in the state. Law of the beat. You can't quantify the definition of the public road to the... We can't do that. No, but I forgot what the state really means. A public road by this, we have. A public road is class 1 through 4. Anything that's listed as private is private. Okay. So along Curtis Pond, those are private roads. I guess I was confused by what he was talking about. That Florida thing. I guess that confused me. The road out at Woodbury Lake. Yeah, Wood City. You also have to consider safety and property. For some way, for somebody to get permission to remove or potentially fall into the fall. That's that language. It is. Yeah, yeah. You should read the state guidelines. They're pretty easy to read. Yeah, I read them. Thank you. Thank you very much. Thank you very much, guys. Send us emails. Good. Thanks a lot.


Hi everyone, my name's Gerald Nunn. I am the GitOps Technical Marketing Manager at Red Hat. And today we're going to be talking about managing multi-tenancy, hopefully somewhat efficiently, and walking through some of the ways to do it, the pros and cons and challenges that we have rather encountered and what we tend to recommend to our customers internally. So let's get through it. So from an agenda point of view, we'll do a quick overview of multi-tenancy, what it means. I'm not going through a canonical description of it, but just some things I want to highlight. And then we're going to just go through some challenges and recommendations in terms of doing multi-tenancy with Argo CD, how it works, some of the things that people run into and how we look at handling it. And then a little bit about the future, particularly about things that I'm excited about in terms of addressing multi-tenancy, some of the gaps that are in Argo CD right now for that particular feature set. So let's start with the overview. So from a multi-tenancy perspective, there's a variety of different ways of looking at it. I mean, in a pure definition, anything is multi-tenant that's more than one user on it even if you have no security, no safety measures around it, right? And that's really kind of the nun layer and it's typically what people don't want to do from multi-tenancy perspective. But then the next two sections, I really see kind of different use cases for them depending on how your organization, how your structure and the level of trust that you have amongst your users and between your users, right? So from a safety perspective, you might just be looking at not so much from a security perspective in multi-tenancy. I don't want to stop that fingering. I don't want team A to overwrite a deployment or a resource that team B deployed, right? That's really more of a safety question than it is I need to protect my resources and make sure I don't have a nefarious actor go in and do bad things and that's more the secure. And I'm highlighting this because when I talk through the challenges of recommendations, a lot of it is going to be that kind of context because there are certain things you might want to do if you're only looking for safety that you don't want to do if you're looking for security. From a building block perspective, there's really three key components from my perspective in Argos CD for doing multi-tenancy. There's role-based access controls, managing who can do what within an Argos CD. There's projects in terms of managing the organization of the applications and application sets that you're delivering. And there's scopes, cluster scope and namespace scope that it allows you to manage in terms of the privileges that Argos CD itself has within that cluster. And just a very brief overview of each one in turn. So from role-based access control, Argos CD really has two levels of RBAC involved. There is the RBAC that's at the Argo level which is what the user sees when they interact with Argos CD through the UI, the API or the CLI. And then there is the underlying Kubernetes RBAC that the Kubernetes or the RBAC or the Argo controller interacts with in terms of doing things on the cluster when it wants to deploy things. And those are two very important things. The Argos CD RBAC is defined on the global level in a config map. And also important to note, if you define the default policy and you give users permissions on a default policy, you allow them to do things, you cannot later revoke those permissions. So you need that to keep that in mind. But you can deny and then allow, that is allowed. So from a project perspective, projects, aka app projects in Argos CD are really just a logical grouping of applications and allow you to organize things within an Argos CD environment for your tenants. They really restrict what your applications can do. You can blacklist resources. You can manage what things can be deployed, not deployed by that particular, those applications that belong to that particular project. You can also assign project-specific roles, which becomes very important from a multi-tenancy point of view, as we'll see later on. Now, app projects in my experience are typically aligned along team boundaries. So team A might have their own app project or application, A might have its own app project. And similarly, team B would have a completely different app project with different sets of permissions and roles in each one. Argos CD scopes, I think this is kind of an underappreciated thing with Argos CD that maybe is not as well known as it should be. There are actually two scopes in Argos CD, cluster scope and namespace scope. When you deploy Argos CD with a cluster scope, essentially Argo can see everything in that cluster. It has complete cluster-wide permissions, at least from a view perspective. I get watch list type permissions, it can see everything. When you deploy a namespace scope, it can only see everything in that namespace or those namespaces that you give a permission to. It cannot see things cluster-wide. So the downside of cluster scope is you've got a lot of privileges potentially when Argo is running in that mode. The downside of namespace scope is because of the way Argo is currently architected. It sets up watches per namespaces when you deploy in that mode. It doesn't really scale particularly effectively. You can get the tens of namespaces managed by namespace scope, but you can't get beyond that. You start getting into hundreds, you're gonna start having a lot of grief when you start trying to do that in that mode. All right, so challenges and recommendations. So the first challenge is really around privilege escalation. So in Argo CD, as we see in this diagram, I've got, say, three different users they're all interacting with Argo CD, and there's three different clusters bound to that Argo CD that it's interacting with. And each of those clusters essentially has a bear token linked to a service account that gives it a particular set of permissions on that cluster to do what it wants. And the problem you went into with the privilege escalation is essentially the privilege you have to give Argo CD is the same privilege at the highest level or the highest tenant requires, right? So that potentially means that the other tenants can do privilege escalation in terms of doing things in that cluster that you don't want them to do because they're all sharing that same underlying role, Kubernetes role in this case. So recommendations for this. I'm a big fan of separating my use cases. I do not like to have my cluster configuration Argo CD shared with my tenants. Because essentially the cluster configuration Argo CD is essentially gonna be close to if not cluster admin type privileges. And while you can certainly mitigate that out and we'll talk about that in a bit, from a safety point of view, an isolation point of view, I like to keep those two things completely separate. So I like to at least have those two separate Argo instances on that basis. Similarly, going along those lines, I like to separate my Argo instances. So the one on the left is where you've got no isolation. I've got one Argo, it does everything. It does cluster configuration, it manages all the teams. It's one instance that does it all. There's no isolation or safety with that. I'm not a big fan of this approach. But again, if you're going for a safety model more than a security model, it might be acceptable, right? Depending on what you're looking for. Partial isolation is really where, as I mentioned earlier, you separate those use cases out. I have my cluster configuration Argo CD that does what it needs to do from a cluster config. Then I have a separate instance that's for the teams and has much more restricted rights than that cluster configuration. All the teams can potentially use one instance, if again, that meets your particular needs as an organization in terms of what you're looking for between safety and security. And you can go farther in that and have more granularity and start sharding out more, I say sharder, that's probably a bad term, it's overload in Argo terms. Have different instances of Argo CD that the different teams use and get much more isolation that way. The downside of that, of course, though, is that your level of management required to do that is much more increased, right? As a platform team, now I'm managing a lot more Argos and trying to keep track of them all. So another recommendation is to mitigate the underlying Kubernetes privileges that you're having to grant, i.e. the highest level that meets whatever the highest tenant needs, is you can mitigate that to some extent in configuration. So in app projects, you can blacklist resources, so you can essentially say I want to blacklist all the cluster scope resources, right? Let's say you have to have a shared instance for your tenants, it has to be cluster scope because it has a lot of different namespaces and things that's managing, namespace scope won't scale enough, you can blacklist all that stuff out and essentially mitigate the privilege escalation issue that way. The other option you have, if you have to use cluster scope, is to do resource inclusions or exclusions. This is global to Argo CD, so you can't do that on a per tenant basis. But what you can essentially tell Argo is, you know what, I've got these resources that I want you to completely ignore. Don't put any watches on them, don't do anything with them, you're not allowed to touch them. So even though the underlying service account Kubernetes still has that privilege, you're telling Argo to completely ignore anything so that if a tenant tries to use that resource, Argo will completely ignore it and thereby mitigate that problem. But it is just mitigation at the end of the day, right? The other challenge that comes up for me a lot is declarative management of applications and application sets in Argo CD when you're trying to do multi-tenancy. So a big issue, and sometimes people don't realize this, is that you cannot have a multi-tenant and traditional Argo where the applications and app projects and application set all live in the Argo CD installation namespace, you cannot allow users to manage that YAML directly, either directly on cluster or through Git. Because as soon as you do, they combine that application to any app project they want and inherit whatever security is in that particular app project, right? So that is a problem for me because hey, we're doing GitOps. Why do I wanna do things imperatively? Like creating things through the UI or the CLI just has a bad smell to me versus doing things declaratively and that's what I wanna do. So in terms of ways to meet this challenge, first of all, don't ignore it. We should be doing applications and application sets declaratively. You can potentially use a policy engine. I've played around with Kyverno to do this to essentially enforce applications getting particular projects. The problem with this, it doesn't really scale very well because you have to know a lot about the user in order to actually do this. So it really wasn't something that worked out well for me and I don't recommend it. But if somebody's done this successfully, love to hear from you. In the question mark, consider category. I've got application and application set in any namespace. If you're not familiar with this feature, I'll be talking about it in the future section. It allows you to have applications in namespaces not in Argo CD. Then they can declaratively manage that stuff. However, this is in beta right now. So for some organizations that have a, I can't use beta software, this might be a no-go for you. At Red Hat, for example, we consider these feature tech preview so we don't support them in production right now. But we do have an issue open upstream in Argo CD to potentially promote application in any namespace to stable. And hopefully that will happen. Application set to stable will be a while yet. And then the last two in terms of recommended options are really you can manage declarative creation of applications and application sets by using standard Git workflow, having pull requests, right? Essentially, your application teams create new applications, modify applications in Git, create a PR, the platform team reviews the PR and says, yeah, that looks good to me. Nobody's changing anything behind my back on this front. You can also do, as I mentioned earlier, the per team instances of Argo CD. So that works out really, can work out really well. There is a model I like to affectionately refer to. I see Michael Crenshaw's in the audience, the Intuit model, yeah, Michael. Michael's the great maintainer, one of the great maintainers at Argo CD. The Intuit model where essentially, if you've got application teams, you wanna give them different instances. You can give that instance access to the clusters that only that team needs specifically.  So it's quite useful for that. All right, so from an RBAC recommendations point of view, do separate your global roles and your team roles, right? So if you start down the Argo CD route and you start putting all your roles in the Argo RBAC CM, you probably find at some point this gets really unwieldy pretty quickly, depending on the number of tenants you're dealing with, like if you have hundreds or thousands, that's a lot of RBAC in there and trying to keep it all straight. And what's going on, it can be very cumbersome. So I like using and isolating all of the RBAC for the teams into app projects, right? And that's really where, from my perspective, it belongs.  I'm a big fan of global projects. That's another kind of feature that's not maybe as well used in Argo CD as it should be. So what a global project allows you to do, and I've got more on it in the next slide, but essentially allows you to have an inheritance model among our real app projects. So you can declare, for example, a blacklist once and have all of your tenant projects inherit from that. And then if, for example, you deploy a new operator or a new custom resource definition and you want to blacklist that, you only have to change it once, right? You don't need to go through 30 different app projects and change it everywhere. This is what I'm kind of interested in getting feedback on, configuring your default access to deny versus an empty role. So typically what you see in Argo CD for the default policy is like quote, quote, right? An empty quote, no role, you don't get anything. It's great, it works, but it's not very explicit in terms of intention or intent. And again, if you have auditing requirements, sometimes auditors kind of balk at that and go, well, that's not really being very prescriptive in terms of what you're trying to do here, right? So I like to set up a deny all role just to kind of be very explicit about what I'm doing and if I get somebody new on the team that doesn't know Argo well, he doesn't get confused by what's this quote, quote thing and tries to change it or do something funny with it, right? And as I mentioned earlier, while the default role, if you give it permissions, I mean, if you give the default policy like a read-only, you can't take those permissions away, you can do the opposite. You can give it a deny role and you can add allow permissions and that works just fine. And then the last one is another one I'm kind of interested in hearing from folks is about using the existing Kubernetes aggregated namespace roles. So in Kubernetes with RBAC, there's these default kind of roles out of the box admin edit view. I like using those for my Argo CD service account for the application controller. The reason being, and this is maybe something that's very specific to OpenShift, but in OpenShift when we deploy new operators, those roles automatically get updated, right? So leveraging that role really allows me to reduce my maintenance burden in terms of new things get on board in the cluster. Do I got to go and hand bomb in updates to my cluster role bindings or my namespace role bindings in order to support those new things that I've hand bombed in. So again, very interesting hearing from folks in that in terms of, is that something you're interested in doing or are you doing or is it a bad idea because you found X, Y or Z? All right, so here's an example of a global app project. As I mentioned earlier, so typically across all of your tenant app projects, there are some commonalities that you're going to want to have, right? You can, for example, say I want a blacklist all cluster resources, I want a blacklist certain namespace resources or scoped resources in this case, I've got namespace resource quality limit range and some OpenShift specific stuff in there as well. Obviously your use case will vary from that perspective. But essentially the global project, as I mentioned, you can inherit this in your other app projects and pick up this information. So for example, another one that's quite useful is sync windows. You can specify a sync window in your global one. So if you're taking your cluster down or you're doing something with Argo CD that affects everybody, you can just do the one sync window there and everybody will get it automatically. And it's configured versus the standard Kubernetes match expression, so it's a pretty straightforward feature to use. But like I said, it's an underappreciated feature in my opinion in Argo CD. So here I've got an app project example that I'm using in one of my things. So I've got the global app project. You can see the label there, it's essentially selecting it. I don't have the example of the match expression, but it's pretty straightforward. Destinations, the normal thing for an app project, i.e. where can tenants deploy this application? In this case, it's just a local cluster in a particular namespace. I actually have a much longer list, but I shortened it to fit on the slide. And then after that, I like to define a standard set of roles for those tenants. So I typically do admin user pipeline roles as kind of my out of the box tenant roles. But again, you can customize this on a tenant by tenant basis depending on what your particular needs and use cases are, right? So the admin role, for example, that guy's allowed to do anything in this project with applications. He can create new applications, he can delete applications, whatever he needs to do. The user role on the other hand, I'm specifically only allowing them to get applications so they can see the list of applications and to sync them. That's it. That's all they can do. So that user, for example, if he notices there is an application that's out of sync or degraded and he fixed it and he wants to sync it, he can go ahead and do that. But he has limited rights in terms of doing anything else from that scope. And then the pipeline role, really where that comes into play is that, and I'm gonna talk about this actually in my keynote a little bit, is you're always gonna have CI continuous integration interacting with Argo CD. And you're gonna need to have an account for that CI to interact with and give it a set of permissions, right? So again, for the pipeline role, I've given it the same permissions that the user get in sync. But I do separate those roles because sometimes you do wanna differentiate them and give them different permissions, depending on the use case that you're trying to address. All right, so the future. The future is glorious. So I'm a really big fan of this feature, applications and application sets in any namespace because for me, it solves a lot of the challenges that are out of the box with Argo CD right now in terms of multi-tenancy. And I cannot wait for this thing to become stable. I think again, as Michael knows. So essentially, as I mentioned earlier, it allows you to deploy applications in any namespace and that allows those users then to declaratively manage those applications without having to have the platform team essentially kind of oversee it as if you had to get repo with PRs. And essentially the way it works is that you define an app project and in that project, you say you're managing these namespaces. And as soon as an application gets dropped into that namespace, it automatically inherits that app project. That app project stays in the Argo CD namespace and the platform team is managing that app project. So users do not have the opportunity to change that project because it's an automatic binding. There's nothing to change. And they can't actually monkey around with any of the Argo namespace because they don't have any access to it. They only have access to the namespace that you've designated for those particular applications. The one downside of this feature, and I haven't really dug into too much why that is, is it does require a cluster-scoped instance. You can't use this with a namescay-scoped instance.  You don't want your teams doing things in the Argo CD namespace. That's a bad idea. For privilege escalation, this is the other component from my perspective in terms of dealing and solving some of the challenges around Argo CD. I don't think there's really been much concrete work on this. And again, Michael can keep me honest on this. Afterwards, but I'm very interested in impersonation which is the Kubernetes feature for the service accounts that the application controller uses. And what that allows you to do is essentially set things up so that you have multiple service accounts and then Argo CD could automatically impersonate for a particular user or team and select the right service account with the right privileges for that particular team. So that that user cannot then do privilege escalation to get a broader set of features out of that. In line with that, another thing I found quite interesting when I was researching this is that it comes up once in a while, well, you could just declare multiple clusters in Argo CD with different tokens and then have them kind of do it that way, right? The problem with that is it doesn't actually work. I think under the hood, Argo CD is actually referencing things by the server API endpoint which is the same for all of them. And you get kind of a round robin effect from my understand which means you're never quite sure where you're gonna end up in any particular application. And then the other one that's quite interesting to me is respecting RBAC for resource exclusion. So if for example that in the Kubernetes RBAC you've given the controller a certain set of permissions and the controller tries to go out and watch that resource anyways and it fails, if you just respect that as a resource exclusion and stop trying, right? It shouldn't cause any problems, stop things from deploying. It should just work happily in that way. And that for me too is another interesting feature that I'd like to see happen. The last one here is not one I'm super familiar with. I'll be upfront with you folks but from a multiple team instance is quite interesting to me which is there's a thing called Argo CD Core which actually didn't know too much about until about a month or two ago when one of our lead developers, Yann Fisher, Fisher mentioned it to me. And essentially what it is is it's much more focused on just using Kubernetes RBAC versus Argo RBAC. It's a very stripped down version of Argo CD and I think it has a lot of potential from the point of view of addressing more of the proliferation of instances, particularly if you can somehow manage them more broadly, right? And provide a single pane of glass on top of that. And at Red Hat we have certain products for that. I'm not here to do a sales pitch though but there's all the other products out there that will manage Argo as a single pane of glass that could maybe work with this as well and be quite interesting. But the idea of a stripped down Argo consuming less resources but being able to have more of them for your tenants I think is quite interesting is another way to manage that privilege escalation. All right, so that brings me to the end with three minutes and 50 seconds left. So any questions? Being the applications in any namespace? Oh, that project is not beta, that's there now. You should be using that now if you're doing multi-tenancy in my opinion. It's an important feature. There's also another session that's doing a deep dive in app projects from the New York Times folks and they're very smart people and I've seen them present before and they do a great job. I'd highly recommend checking that out if you wanna see more about app projects. Yeah, in my opinion it allows you to manage it effectively if you only have like two tenants, hey, do what you want type of thing, right? But in the real world, you've got hundreds or thousands of tenants, you need to have some organization around it and app projects is really what's providing that capability. Oh, thank you. Yeah, that's what gonna be my keynote. Yeah, so wait 15 minutes and I'll be talking about it. But yes, definitely there's a few challenges I've run into from an app management perspective. That's one of them but really for me the challenge is really about being able to look at things more holistically and test holistically when you're doing this stuff, which in turn is driving maybe a need for a higher level of primitive than applications. I'm kinda previewing my keynote a bit but we'll talk about it in the keynote. It's only five minutes but I'm happy to talk about it after. No problem. Pardon me? Oh, the slides should be available through the website I believe, I've uploaded them so they should be there if there's a spot to download them. If not, let me know and I'll figure out where you get them from or if they get sent out after the fact. Yeah, I haven't done too much with the repo credentials because we're all open source and I just put everything up on get in public repos and never need to worry about the credentials to be honest. There is a feature in app projects where you can essentially allow teams to self service the repository credentials. Oh, okay, yeah. Yeah, I'm not too familiar with that but yeah. It might be a good question to you for that New York time session as well as doing a deep dive on that stuff. Okay, that's it for me. Thanks very much, everyone. Have a great rest of Arvacron.


There are three types of data distribution, normal distribution, binomial distribution and third one is Poisson distribution. So first of all, what is normal distribution? The data which is normally distributed or the data which follow normal bell shape curve is known as normal data and such type of distribution is known as normal distribution. In normal distribution, if the data has any values, if we take out the mean and take out the difference from the means of each individual value, then it is less. In contrast, a data that has asymmetric data or skewed data, the difference between the mean value and the individual values is more. The mean, median and mode of normal data are almost the same. In normal data, extreme values are very low. The mean deviation of normal data and standard error of mean values are less. So the data which follows the normal bell shape curve is called normal data and the distribution of this type is called normal distribution. The second type of data distribution is binomial distribution. Binomial data is such a data which has two possible outcomes. For example, if we play a series of five matches, then the outcome of every match is either a team match wins or the match loses. So this means that every event has two possible outcomes. The number of events here is already decided. For example, we said that the series of five matches is already decided that five matches will be played. But in this, the outcome of every match will be different. Either it will be a loss or it will be a win. Similarly, if we toss a coin, then the head and tail can also come. So the event here has two possible outcomes. One is head or tail. So this type of distribution in which we can see the two possible outcomes of data. It is called binomial distribution and the number of events in the binomial distribution is already predetermined. The third type of data distribution is Poisson distribution. In Poisson distribution, the number of events are not predetermined before. And these events are sometimes extremely high, that is, their number can be very high. In normal situations, the number of events in Poisson distribution is very low. For example, if we note the number of individuals who die within an hour in Lahore, then it is low. But sometimes their number can be very high. If someone dies due to which a lot of people die, then the number of events can be very high. So this type of data, this type of distribution, in which the events are not predetermined before, but sometimes they can be extremely high. Poisson distribution is called this type of distribution. So there are three types of data distribution. The first type is normal distribution, which follows a normal bell shape curve. This type of data has very few extreme values in it and the difference between the mean values of individual values is very few. The second type is binomial distribution. In binomial distribution, the number of events are already predetermined, but the outcome of every event is independent. And the third type is Poisson distribution. The number of events are not predetermined before, but sometimes their number increases. And in these, the number of events can be converted into an unlimited number.


Hey, what's up guys, it's Josh here. Today I want to do a little re-review on this war games enhanced gaming mix. Now I've reviewed a couple of these gaming mixes on my channel before. And essentially gaming mixes are like a medium dose of caffeine, a bunch of new tropics, and then a couple of ingredients to help eye health. So it's essentially a very strong, new tropic base type supplements. To me, it kind of lacks the X factor of having something like a DMHA, an amp citrate, a area, gerinosis, a Roscaline. All those have an extra level of excitement to them that I really wish was in this product, but it has so many great products that I've loved. I've always loved and it just gives you a really, really good new tropic base. I really wish they actually tuned up some of the ingredients to make the taste a little better because the taste is challenging, but it's doable for me. B12 cyanocobalin.  It turns into cyanide in your body. Go ahead and Google that. And normally they use it at a pretty reasonable dose, but they have 20,000% of it in here. Kohlene bitartrate. You got 400 milligrams in here. A very decent dose, modest dose. I've always liked Kohlene bitartrates and I've never had an issue with it. Enosidol tyrosine at 500 milligrams. I love Enosidol tyrosine. I love tyrosine. If there's some sort of energy mix or stimulation mix or workout mix or any awakening blend, I always want either tyrosine or Enosidol tyrosine. Enosidol tyrosine is the stronger one. Usually it tastes a little bit worse. So people will opt for tyrosine and these type of blends, but we have 500 milligrams here, which is really good. I'm pretty sure if you were to buy this in capsule form, it comes in 350 milligrams. So it's higher than the average dose for it, which I love. Rodeola rosea. Again, this is probably why this supplement does not taste good because Enosidol tyrosine doesn't really taste very good. Rodeola rosea definitely doesn't taste very good. And you've got 250 milligrams in here. Besides the taste, though, Rodeola rosea is one of my favorite supplements. I'm actually remembering it a little bit now as I'm talking about it. But there was a time where I would just love Rodeola. I would push it on all my friends and just be like, I take it all the time. It's fantastic. I've since like taken a break from it. I don't know if I still have any, but I've used Rodeola on its own so much and I love it. It's kind of like an adaptogen found high up in the mountains and Yerba mate. So I'm just going to go ahead and describe the caffeine right now. I think it has like between like 60 and 80 milligrams of caffeine. If I see it on the box somewhere, I'll let you know. But it has a very low amount of caffeine. So you have this Yerba mate, which provides 25 percent caffeine. Then you also have green tea, which should have some caffeine in it. Then you have green tea here. It does not list the caffeine content. So I don't know if there's any caffeine in that green tea. And then you got Dynamine, aka methyl liberine. So Dynamine and Tiacrine are used very interchangeably. They're very, very similar to caffeine. But I, after a lot of testing, don't really like Dynamine that much. I don't really get this extra level of stimulation or focus from it. It does feel a little bit caffeine like, but it's also very short acting. You know, it's something to where if I was making a mix with no caffeine in it, I would probably want it in there just because it's going to feel a little bit like caffeine, but at the same time, it's not the exact same molecule. But I don't really like it in high stem blends. Thankfully, this is a low stem blend, so it kind of works well here. But I am just turning into not the biggest fan of Dynamine. Now, Tiacrine, on the other hand, I really, really, really like Tiacrine. Very smooth. Like if you're somebody who likes coffee and you want a superior version of coffee, Tiacrine is 100% perfect in every single way, except for the fact that it tastes really bad, the same as Dynamine. It tastes horrible. So even this blend, they don't put like a huge dose of it in here. They only have 50 milligrams of active Tiacrine. So to be honest, for how bad Tiacrine tastes, they've done a pretty good job of blending it. But I love Tiacrine. It's an anti-inflammatory, which caffeine is not, has much, much less chance of crash and it lasts a little bit longer than caffeine. It's just perfect. You got Grawana in here. Now that's that's supplying more of the caffeine. Theobromine. Now, that's another thing that every time they add theobromine to a mix, it does seem to help a little bit. Again, it's not next level kind of a feeling like I would say you get from DMA, DMHA, Ampsitrate, area gerinosis, Roscaline. All those provide that extra level of excitement and stimulation. I've always liked theobromine. I always recommend it in any mood slash energy mix. OK, you got Bacopa, Morian, Moriani or something like that. Now that is used in so, so many new tropic style blends. I know it's great for the brain. I'll try to put it on screen. You got Grape Seed Extract. Again, I love Grape Seed Extract. It's fantastic. It does so many things for me. Helps get rid of really bad cysts, clears up my skin. This is fantastic, but it tastes horrible. So they only have 30 milligrams in here, which that's probably supposed to be for eye health. But I don't really know if 30 milligrams is going to do too much because I've taken several grams at a time, which is thousands of milligrams. So and then you got this Mary Gold at 15.5 milligrams right there. Don't really know what that is. I think it is for your eye health, though, because this is a gaming mix.  And then the last thing we got here is this HyperXine A. HyperXine A is essentially a back door to get more choline in the body. I think it stops your body from turning the choline into something else or destroying the choline. I just did a review on vintage muscle pre-workout. Absolutely love that stuff. That has HyperXine A and it does not have choline, but I think it's more balanced if you have HyperXine and choline. So anyway, it's really quick. The effects on this stuff, I think this is a really, really good baseline new tropic blend.  You know, if you're taking a really, really strong stimulants and you want, you know, just a little bit of backbone of for like extra balance for your brain, all these other new tropics to help you alongside the stimulation, this is perfect. It was really cheap. I don't know if it is now. I think it was like $21 for 30 servings. But anyways, guys, let me know what you think of War Games. It's been fun to re-review it. We're on the road of 50,000 subscribers and I couldn't do without any of you guys to help you guys are the best. Having a great day out here. Hopefully having a great day at home. See you all in the next video. Peace.