So, welcome everyone. We're going to talk about Kubernetes Policy Management with Kivarno. So, quick introductions. I'm Jim Baguadia, a maintainer of Kivarno. I'm also a co-chair of the Kubernetes Policy Working Group, a track lead in the multi-tenancy working group and a co-founder at Nirmata. So, there's quite a lot of topics I would like to cover. So, just in terms of logistics, I will be answering questions on the Slack and on the message channels. So, we'll try and save time for questions, but if we run out of time, we'll be on the sessions itself. So, we'll start out by describing why we need policy management for Kubernetes. We'll talk about why Kivarno matters. We'll go deeper into the Kivarno architecture as well as what Kivarno policies look like. We'll talk about how you can do some complex processing logic with Kivarno in Kubernetes, how it can interact with external data sources, and go into other features of Kivarno itself, including reporting metrics and some advanced topics. So, let's get started with why policies matter to Kubernetes itself. So, first off, we've all seen the headlines and the security-related incidents where Kubernetes configurations and misconfigurations tend to be the leading cause of incidents that we see in clusters in production. Also, I love this tweet from my actual Kubernetes admin where they have tried to deploy clusters without policies, and very quickly they see, of course, if it's a shared cluster, you have many development workloads, there's dangers, there's issues bound to happen. So, policies serve as a contract between the different roles, between the different personas in Kubernetes. So, you have developers who want to, of course, deploy their applications, manage workloads, you have security folks who are trying to make sure that the right security configurations are specified in every workload, in every namespace, in every pod, and then you have the operations team responsible for managing clusters, managing the shared services. So, policies bring all of these roles together, and really it's an enabler of DevSecOps at scale. So, what policies can do for you is improve the overall security posture, get rid of misconfigurations, give you proper separation of concerns between these DevSecOps roles, reduce the overall configuration complexity, and also help promote best practices. Your developers are perhaps not too familiar with all of the details about Kubernetes workload configurations, policies can help with that too, and lead to more self-service, more automation. All right, so let's talk about why Kiverno and what the motivation for this project was, what some of our goals are. So, with Kiverno, we use the tagline in a Kubernetes native policy management. But does it really matter to be Kubernetes native, and what does that even mean, right? So, a lot of vendors, of course, a lot of products claim to be Kubernetes native. So, it's important to kind of dive in a little bit deeper. So, when you think about it, there's several levels of perhaps being Kubernetes native. So, the first level is just being focused on that as a domain, on, you know, targeting Kubernetes or Kubernetes users as your audience if you're a vendor or if you're developing a tool or a solution. So, that could also be called Kubernetes native, but that's not quite enough. So, the next level up is where you start actually interacting with Kubernetes APIs, and a lot of tools do this as well. Another level up is when you actually operate your solution or tool as an operator in Kubernetes, and you're expanding or you're extending Kubernetes APIs itself using custom resources and custom resource definitions. Another level above that is if your solution really understands Kubernetes patterns, Kubernetes idioms, how pods and pod controllers interact, what an owner reference means. So, you're going much deeper into how Kubernetes works itself, and your solution becomes part of the control plane in Kubernetes. And finally, level five or the highest level of being Kubernetes native here would be if your solution can automatically adapt to new Kubernetes schema, new solutions coming in, and as these things change itself, being able to talk to the API server. So, Kiverno is designed to be completely Kubernetes native. It is only focused on Kubernetes, which is, you know, some of the earlier levels, but it also interacts with the API server and can, you know, read the metadata of the schema for every Kubernetes object, including custom resources to be able to adapt policies to that. So, this provides a lot of flexibility, a lot of benefits, and simplifies writing policies, managing policy definitions. Because if you don't understand what Kubernetes APIs are, what the constructs look like, of course writing policies is going to be a lot harder, and you have to develop a lot of common solutions just to get started with those things. So, one other question that comes up in terms of why Kiverno is, well, what about OPA Gatekeeper? That's a fairly mature project in CNCF. It's also, you know, like Kiverno, it's a CNCF project. And, you know, there's a very good community and focus on it. So, there are several, you know, comparisons out there. So, I encourage everyone to go, you know, do a quick search and you'll see this is from Victor Farik, who's at UpBound. He's done a great video on Kiverno and, you know, OPA Gatekeeper. There's another one from Chip Zahler at Dell. He's written a series of blog posts on comparing the two solutions. And really the difference comes out to what is it that you're trying to achieve? What are you trying to solve with your policy management and focus on Kubernetes, of course, right? So, in terms of feature-wise comparison, both tools stack up well. The major difference to me is in how you manage policies, how you declare policies, and use Kubernetes, you know, policy management in your teams and organization. So, here, you know, we're comparing the same policy written in Rego, which is the language that OPA uses. OPA is Open Policy Agent. And compared to Kiverno, which uses a more declarative style of configuration, which is native to Kubernetes. It's, you know, again, if you understand what a pod spec looks like or what a deployment looks like, Kiverno policies seem fairly natural and understandable, right? So, it's all about simplifying this to be able to, you know, adopt policies at scale and promote these best practices itself. So, certainly, you know, if you're kind of familiar with Rego, if your teams have developed expertise, OPA is a great solution, and Gatekeeper, you know, fits OPA into Kubernetes. And if you also, if you're trying to, you know, manage policies across different systems, not just Kubernetes, but let's say you want to write policies for your microservices app, things like that. OPA is also a good solution for that. But if you're kind of trying to solve security and automation and other concerns just for Kubernetes, trying to evolve from a DevOps team to a DevSecOps team, and your focus is Kubernetes, Kiverno comes out to be a much easier solution to adopt. And that, you know, is across all of these different roles. And it scales also a lot better as your teams grow and as your Kubernetes usage grows itself. So let's talk about some of the use cases and what we're seeing the community solve with Kiverno itself, right? So starting with the basics, of course, pod security, workload security, Kubernetes has some built-in constructs for pod security. The pod security spec has been, you know, our pod security policy has been deprecated in one, two, two. There's a replacement being worked on, which will do, you know, pod security at the namespace level using labels. And that is planned for 1.25. But there's a lot more required to configure security for your workloads. And even in pod security, there's a lot more flexibility, production deployments typically require. So definitely check out, you know, Kiverno or OPA for one of that. But you need to make sure that beyond pods you're also securing your services, your namespaces, other things like your role definitions, even CRD definitions in Kubernetes itself. Then promoting best practices, right? So configuring probes, configuring health checks, making sure that your RBAC is automated and as fine-grained as possible, having multi-tenancies. So sharing clusters always remains a big challenge in Kubernetes. How do you do this securely? How do you make sure you're avoiding the noisy neighbor effect, right? So those type of things can be very well, fairly easily solved and there's some common examples and policies available to do this in Kiverno. Also auto-labeling, proper hygiene in terms of how you're managing these resources, making sure your configurations, you know, are generated and again limited to the scope. And one new use case we have just introduced, which if you have time I'll do a quick demo. Otherwise, you know, there's links in a post I can share of it show this. But even verifying, you know, image signatures for containers at admission controls. So making sure that when a container is deployed, that you have a signed image and you are, you know, using that only if it's been signed and you have the proper attestations for that container image and you can verify it against a bill log. All right, so let's talk about the Kiverno architecture and how it works in Kubernetes itself, right? So I'm going to go back here to some of you may know the exact mole definition for, you know, this is extensible authorization using XML. And, you know, Kiverno, of course, has nothing to do with this, but the reference architecture for policy management that was defined in this OSS standard applies. So here they introduced terms like a PAP, which is the policy administration point and then a policy enforcement point and then also decision points and information points, right? So this is a pretty good, you know, high-level architecture to use for policy management. And, you know, we can now map this to what happens in Kubernetes, right? Because in Kubernetes, every request flows through the API server. It goes through an authentication phase and authorization phase. And then it goes through admission controls which are extensible. So in this admission controls, you have a chance to mutate, validate, generate, and do other sorts of interesting things, which is really where Kiverno will fit in as you'll see. But now mapping these two together, let's say you want to have a policy enforced across your clusters, your fleet of clusters, and your CI CD pipeline that says pods should not be run as root user, right? So now you can declare that in your PAP, in your administration point. And keep in mind this could be a GitOps controller, this could be, you know, other tools that you might use, you know, to manage your fleet of clusters. But once you define that policy, it should be applied in your CI CD pipeline. So you're validating your YAMLs, you're validating that, you're generating the right image signatures. And then that same policy can be auto-generated and also applied, you know, in your, across your fleet of clusters. And since with Kiverno, a policy is a Kubernetes resource, it's easy to deploy, easy to manage that within each cluster, again, using standard tools like kubectl, customize, GitOps, best practices like that. So a little bit more detail. So if you kind of look underneath the covers and how Kiverno works. So there's multiple controllers, which run all as a single, you know, workload. And they register, Kiverno automatically registers itself as a web book. So like we talked about, it can receive both mutating as well as validating a web book, you know, requests. And then there's based on various policies that you write, which Kiverno maintains in memory as a cache of policies. These will be applied dynamically and you can either trigger the mutation of resources, you can trigger the automatic generation of resources, and also validation of resources. So if you want to block or enforce, you know, any policy based on, you know, things which are going on. So if you change any of this in real time, Kiverno will automatically update. It also does a background scan on all existing resources and will show, you know, those results as well. So it's very easy to now fit in these policies as Kubernetes resources, manage its scale, and just like you would with your workloads itself. So another kind of view of Kiverno itself is if you look at the deployment architecture. It looks something like this, right? So each Kiverno install, we can have multiple instances, multiple deployments, which run as a replica set underneath, and that will spin up and manage the pod life cycles.  All right, so in the next section, let's look now at Kiverno policies, right, and how a policy itself works. And we'll start with some simple examples and then also look at some more advanced features for managing complex logic in policies. So each Kiverno policy contains a set of rules. And before those rules are applied, there's a match and exclude block which will get executed with, you know, against an incoming resource. And that resource is contained in an admission request created by the API server.  And each rule can either mutate resources, which happens in that mutating web book, can, you know, do things like verify images. And verify images is interesting because it both mutates as well as, you know, validates and the resource itself because it replaces the image tag with a digest to make sure that your image cannot be changed at runtime itself. And then there's a validation phase. So this happens after the API server validates the object, the resource that's commutated against the schema definition. And then finally, in the background, Kiverno can also generate resources.  You can now easily automate this, you know, using Kiverno itself. So this is what a policy looks like, right? And again, you know, it's fairly, it's designed to match what a Kubernetes pod would also kind of pod definition would look like. And this policy is very simple. All it's doing is looking in the metadata and it's checking for a particular label to be configured on that pod spec itself. Now, one other cool feature in Kiverno is if you define this policy on a pod, Kiverno can automatically generate rules for pod controllers. Again, because it understands Kubernetes, it's designed to work in Kubernetes, it simplifies that and you don't have to manage different policy rules because the structure of pod controllers is different. This will just be handled natively in Kiverno itself. So this is another example of a policy. It's a validation rule and this policy is again extremely simple but very powerful. So what it's checking for is certain resource types and if it matches, you know, if the request, the admission request matches that resource type, Kiverno simply denies the request. Now, why would you want to do this? And the main use case here that we're showing in this policy is API objects get deprecated in Kubernetes and as they're getting deprecated, how do you know, let's say you have production workloads, how do you know where those are running, which ones need to be updated and how do you inform your developers about that? So Kiverno solves this problem because you can now roll out a policy like that as an ops team and your users will get informed with the policy report that Kiverno generates in their namespace, so which tells them these are violations I need to fix before this API construct gets deprecated. Here's an example of a mutate policy, right? So this actually changes an object and there's some simple examples here. We're just looking for a specific name of a port and replacing it with a certain port number in the first example and the parentheses are actually, you know, showing some of the flexibility in Kiverno to do conditional logic. So this is doing an if statement and saying if the name is secure, then I want to set the port to something. And the other example which has a plus sign in front of it is a very simple declaration to show that if it's not specified, then set the default, right? But if it's specified, leave it alone and let, you know, take the value that's specified. Of course you can kind of make this as complex or as, you know, involved as possible. You can even do things like match with operators, other logic that you want to combine here. Here's an example of a, you know, very popular, you know, generate rule, right? So when you create a new namespace, you always want to set a default network policy for the namespace and this rule is helping do that. And again, it's very simple. It's like less than, you know, 10, 15 lines of YAML. It's very powerful because what it does is anytime a new namespace is created, you get a default deny network policy and then your developers can add, open up the ports, open up the routes that they require for their workload, which is a much better security, you know, kind of best practice versus just allowing all communication even within the same cluster or communication to the API server by default. Here's an image verification policy, right? So this is an integration with Cosign and there were some sessions, you know, earlier, I think there was a session yesterday that Dan did from the six-storey team on Cosign, six-storey and a bunch of other tools for supply chain security.  So this, what this rule is doing is it's matching an image pattern and based on that image pattern, it's saying that every container image has to be signed with this public key. So extremely powerful and, again, very simple to kind of, you know, do with Cosign and Kiverno and start, you know, moving towards, you know, there's a framework that Dan covered called Salsa or SLSA, which talks about supply chain security and this, you know, gets you up to, you know, a level in terms of at least being able to make sure that your image is assigned and verified before they're deployed into your clusters. All right, so let's look at some more complex examples, right? So these were fairly simple to start out and the reason why I wanted to show this is one thing that comes up against Kiverno and if folks are comparing it to something like OPA or Gatekeeper, well, OPA is a full-fledged programming language, right? So you can write very complex logic, but Kiverno has a lot of power in a very simple and easy to manage format as well, right? So one, you know, one thing that you would want to do as you're managing policies is you want to externalize data from your logic. So just like in programming, you always have data and logic and it's nice to separate your logic or your algorithms from the data. Similarly, when you're writing policies, you want to make them as data-driven as possible and decouple your data from the processing logic. So Kiverno supports multiple ways of substituting data within policies. One easy way is to use something called reference variables and these are just, you know, follow like a Unix or Linux style path syntax and you can reference other things in your policy or your resource definition itself. So a very simple way in here we are showing how if you want to make sure that your port matches the readiness port or just use that value, you can do that fairly easily. The other example is a little bit, you know, it's slightly different, but it's also very powerful where you can, you know, using something called James Path or JMS Path, which is a way of processing JSON data and it's supported by several command lines, including, you know, like the AWS CLI as well as kubectl and other support. James Path, there's a tool called JP which you can also use to test these. So what this is doing is it's extracting some data from the incoming request object and adding that to your policy definition. So the second box here is an example of how you can add a label into every, again, if you're matching namespaces or you're matching an object, you can now easily check and say, who created this, right? Because Kubernetes doesn't show that by default, this becomes a very simple way of showing who created that particular resource or namespace. So there's more complex, again, you know, expressions and things you can build and there's several samples. I'll quickly show the Kivarno website, our policy library. So like the first one is, again, taking data from the request object, which is sent by the API server to Kivarno and it's extracting the data and adding it to your policy definition itself. The next one is getting user information. So some of this comes from the API server, but other data is what Kivarno is fetching and automatically making available, right? So this is a built-in data type.  So you can match and exclude by this as well. And then the final example is another, you know, the turtle bullet here for built-in data is where you're checking against the images within pods, right? So if you want to check for a particular registry or a particular tag, you can now very easily and simplify this in your policy logic and just use this built-in data types. There's also a couple of ways to get external data and we'll talk about that next, right? So the one pattern Kivarno fully embraces. So just like in Kubernetes, Kubernetes apps typically follow the 12-factor app spec and configuration should be decoupled from your application itself. So either you're putting environment labels or you're using config maps, right? Config maps give you a very powerful and flexible way of managing this type of environment data. So, you know, here, what Kivarno does is it automatically scans and caches config map data and allows you to now use this within your policy definitions itself, right? So in this example, what we're seeing is we're reading from, you know, we're taking a config map, loading it into a context within a rule, and now we're using data from that config map and we can cross-reference this with other data, right? So you can form logic to say now if a pod has a particular image, take that image name, use that as a key in a config map, look up something else and then apply it to your policy. So fairly complex, but nice and easy declarative syntax to deal with that without, again, having to write, you know, code or do other complex things. Here's another example now which gets more into the power of Kivarno, right? So this is actually fetching data from the API server. So if you recall, when we talk about the exact model architecture, we, you know, we went through things like you have the policy enforcement point, the administration point, as well as you have a decision point where that policy is being decided, which is Kivarno, and then you have an information point, right? So the API server acts as a source of information. It becomes like a policy information point where your policies can fetch more data and make processing decisions on whether they should be applied. So in this example, you know, what we're doing is we're actually making an API call, you know, and so this policy is trying to check and make sure that you only configure one service per namespace of type load balancer. Now, why would you want to do this? Well, if you're running in a cloud environment, load balancer services tend to add costs, right? So one way of kind of, you know, one common, you know, enforcement is making sure that each workload only exposes one external load balancer and uses other constructs to do internal routing and traffic management itself. So to do that, now you can very easily define a policy which is saying, okay, do an API server call, check the namespace that the workload is going to get deployed on, and count how many load balancer services are there, and when you have that result, make sure that it's only set to one or if it exceeds one, you're going to deny that rule, right? And you're not going to allow that, you know, whoever is trying to deploy that workload to go ahead and create that new service type with the type load balancer.  So the first line here, which is doing the URL path, is actually doing an API server request. It's fetching the list of load balancers in a particular namespace. And then the second line is filtering that down and narrowing it using James Path. And by the way, there's, you know, interactive tutorials and things on the James Path website on how you can do this, so there's several best practices and patterns available. But what it's doing is it's, you know, filtering it down to match by a particular field and then kind of, you know, passing that into a function to count that. Kivono also has several, you know, James Path extension functions. So you can do things like regular expression matches. You can even do, you know, some computation, like you can do less than, greater than those type of comparisons. So just making it again very simple with a couple of lines of YAML declarations to be able to, you know, process API server data and things like that. It's extremely powerful. And the nice thing is you can test all of this using standard tools. So if you use Kupka, it'll get with the minus minus raw option. And if you use, you know, with JP, which is the command line tool for James Path, you can now test all of this and then make it part of your, even your CI CD pipeline, where you're automating the test for this, going back to that policy as code concept, making sure we're, you know, properly verifying before we deploy into, you know, these type of, into your production clusters itself. So one other pattern which is becoming, you know, in the community, fairly, you know, popular is how you can, you know, extend Kivirno itself, right? Because with any tool to be successful, it's always nice to make it extensible.  So with Kubernetes, you can write, you know, custom, your own custom resource definitions, you can have custom controllers, and there are several projects which do this for everything like CertManager does this for certificate management, of course, like the storage controllers, networking controllers, other things do this as well. But it's very, you know, it's straightforward using tools like KubeBuilder to be able to create your own extensions as well if needed and when needed. So the way to kind of add anything to Kivirno, it's as simple as creating another Kubernetes controller or having a way to even push a config map from your CICD pipeline. So as long as you can do that, Kivirno can now, you know, leverage those constructs, a custom resource definition, because Kivirno can automatically, you know, query the schema through your API server, or it can look up a config map and it's able to also, you know, process the data in the config map itself. So this provides a nice and secure way to make sure that, you know, Kivirno can be extended and you don't have to, you know, kind of change the Kivirno source itself or deal with plugins or any other kind of complex way of dealing with other data providers or other policy extensions that you might want. All right, so let's quickly go through some other features. You know, we talked about how you can start with simple policies, how we can get to complex policies, but there's a lot more. If you're deploying in production, you know, you want to, of course, make sure that your policy engine, which is a critical component of your infrastructure, is properly deployed.  So Kivirno, first off, reports in Kivirno are also full-fledged Kubernetes resources.  In Kivirno, what we have done is we have made reports a first-class, you know, Kubernetes resource itself, which, again, you can use any Kubernetes command line tool or management tool to process and automatically, you know, utilize. The other cool thing about Kivirno reports are these are, you know, follow a CRD definition, which the policy working group in Kubernetes is standardizing and is promoting with a number of other projects itself. So Kivirno reports follow the same, this common CRD, which other tools like Falco, which is a runtime, you know, policy and kind of runtime security tool, as well as things like KubeBench. We're also working with other, you know, projects to start embracing this policy report.  So the nice thing with this is no matter which tool you're running, you can now standardize on the output definitions. So if you're interested in this, go to the policy working group, you know, website in Kubernetes. There is a CRD, there's a definition, there's a list of projects that, you know, either have existing support or a plan for support for this itself. There's also, you know, now that we have the standard definition in the community, one of our community members has built an awesome tool called Policy Reporter, which takes this definition from a graphical view of it and can also now extend, you know, take the, you know, as policy reports are generated, compare for differences and create notifications which can be sent to other upstream tools like whether it's a Slack or other, you know, notification and communication tools you might have, right? So this is another, this is now also part of the Kivorno project. So it started off, you know, outside the Kivorno project, but we have, you know, as a sub-project and Policy Reporter is also released and managed by the Kivorno community itself. And then, you know, there's built-in metrics which Kivorno itself exports, right? So if you're managing policies and if you're using policies for other security, how do you know your policies are working? How do you know, you know, how many times a rule has been executed and how many errors are there in your different clusters? So to do this, Kivorno has native integration or native support for a number of metrics which are very granular but can also be filtered and scoped with labels using Prometheus metric formats. So this makes it very simple and, you know, again easy to manage at scale. Here's an example of a dashboard with, you know, Prometheus metrics which is showing, and this Grafana dashboard is also available in the community to get started with. And of course you can extend and build your own as well if needed. All right, so and then the other thing to talk about is, you know, so as we talk about policy as code, you know, the runtime part, running Kivorno, observing Kivorno, managing Kivorno is important but you also want to integrate policies in your CICD pipeline and you want to, you know, try to, of course, enforce these best practices as early as possible as things are changing in your applications in your workloads. So to do that, most Kubernetes workloads also have now a set of yamls which, you know, kind of manage or specify how that workload should be described or should be deployed in a cluster, right? So when those yamls are updated, you can run CICD, you know, jobs using the Kivorno CLI which can automatically check and make sure those yamls are compliant to your policy. So this, the CLI has two purposes. One is for end-users, the workload owners to be able to verify and make sure their workloads are compliant and if they're not, you can just say if a PR or if there's a, you know, commit, you can flag that right away and make sure that if there's any problem with that workload that gets, you know, the author knows as part of the, you know, their CICD pipeline and they can fix that even before that commit is accepted, right? The other use of the CLI is for the policy authors itself. So for your ops team, you want to make sure you want to test policies and you want to manage policies just like you would with software best practices. So the CLI has a lot of support. There's a test command where you can write different test cases both for, you know, negative execution and successful or sunny day scenarios. So you can test a combination of these results. You can even test against a cluster and produce reports and compare them to what the expected results is. So this makes it very easy to again manage policies as software artifacts within your version control systems follow the best practices like you would for other software and apply that into your policies itself. So certainly the CLI becomes instrumental in that and it doesn't require a connection to a cluster. If you do want to test your policies against a cluster, you can pass that and it will actually verify, you know, a set of policies or changes in policies against a live cluster to show the results itself. So let's talk a little bit about the roadmap and what, you know, what's coming up, right, and in Kivarno. So Kivarno is at release 1.4 and the community is working on we're, you know, about to release 1.5. The goal is to have a release candidate before KubeCon. So in a few weeks, we will have RC for 1.5. And there's a couple of very interesting and powerful features coming in here. So right now, if you are configuring WebBooks, so remember we talked about the API server sending requests to the WebBooks like Kivarno and you could have mutating as well as validating WebBooks. But if, so today that WebBook configuration is manual in Kivarno and you have to write the filters, write what you want to pass to Kivarno. So with 1.5 that becomes completely automated and dynamic. And of course today you can say send everything to Kivarno and Kivarno enforces a very short deadline to be able to deal with that load and is optimized for that. But it's better, you know, with this change, Kivarno will only configure the WebBook filters for the specific requests that are required and this will, you know, kind of help its scalability as well with processing. There's also a new construct being introduced for more powerful processing logic in Kivarno. So a lot of Kubernetes resources have sub-resources or sub-elements in them, like a pod may have volumes, right, or a pod may have container definitions and a lot of times you want to kind of loop across these and apply some logic within these rules. So the for each construct just simplifies that. Today it's possible but it's quite verbose. So this will just simplify it and make it easy to write these type of, you know, more powerful constructs itself. There's also more features coming on supply chain security where Kivarno will be able to, you know, have support for attestations, other things which are being developed in the cosine and six store communities. So we're collaborating with these projects to make sure that Kivarno policies can apply some of this added mission control itself. There's also a time-based, you know, request in the community, which was very interesting, right? So this is talking more about time-based policies. So to be able to apply policies, you know, only in a certain threshold of time. And you may want to do this like one use case was, well, what if you have certain users on pager duty rotation or, you know, they are kind of responsible. So only some users should be able to update clusters or do certain operations at some given time. These policies can do those checks and can alert and audit if, you know, some other users are taking actions at that time. And there's also other requests for more powerful, you know, processing logic. And, you know, one consideration is also to support things using languages like JavaScript, which allow, you know, writing some custom logic if and when needed, right? So just to quickly summarize, you know, and we'll, you know, I think we have a little bit of time for demos, so I do want to show some, you know, a quick demo of what Kivono looks like in action. So actually let's switch to that and then I'll come back and we'll summarize on this.  And here if I look at, you know, what's running, I have a local cluster and if I just check the namespaces on it, you can see I have Kivono installed a few other namespaces and things running in here, right? So now if I check and see what's in the Kivono, you know, so let's do minus and Kivono. Spell that right. So in this case, I've just done the default installation of Kivono and you know, that brings up a single deployment with a single pod.  And if I do, you know, let's say if you just check the logs of this and, you know, I don't really need to follow the logs. I'll just do, we'll check for the deployment. What we'll see is, you know, Kivono is up and running and it's showing us that, you know, everything is healthy. There's some TLS handshakes, but this is because I'm running in Minikube and there's, you know, my firewall port here is not open on this. So Kivono is already running. The other thing I want to check and see is which policies I have, right? So I'll just do a get C-Pol, which is cluster policy. It's a short name. And if I look at it, I have two policies. One is running in audit mode and the other is running in enforce. So the first policy is saying that if I have a pod, I want to require probes for that pod.  I can also check over here if I check for policy reports. Again through, you know, policy report, the short form is PolR or P-O-L-R. So I can check and see that I have one policy report and it's showing me that everything's passing right now. There's no violations in my cluster. So pretty easy, pretty straightforward to do. So let's actually now I'll demonstrate the supply chain security example, right? So what I'm going to do is the check images policy we looked at before is this policy which is verifying that any image deployed in your cluster has to be signed with this particular signature. And this, you know, I have a test image in the Kivarno repo which we used for automation test as well and we're just going to test against that, right? So the first thing I'm going to do is I'm going to apply, this policy is already applied so I don't need to do that actually and I'm going to run a signed image which I know has been signed with this signature. So when I do that, Kivarno will, you know, of course the pod gets created so if I do let's check for the deployment. So we have now signed the deployment is running and as you can see it has one pod running and everything's ready, right? So now how do we know anything happened here? So let's check, let's speak at the YAML and if you look at this and if I want to grep for image what I'm going to see is there's, let me move this to the top of the screen. What I'll see is that signature actually got changed to insert a hash. So when I deployed the pod, if I look at the pod declaration or the deployment itself that hash did not, you know, the digest did not exist but now this got inserted by Kivarno because it was verifying that it actually pulled that information using cosine against your image registry, checked the signature, mutated the pod in the deployment itself. So any instance of that pod that gets created now has the proper hash or the digest within your cluster. So the next thing we'll do is we'll try and run a pod which is not signed, right? So I'm going to pull this deployment will create the unsigned with this image which we all have in the Kivarno repo which is unsigned. So at this point as you would expect the admission of that book itself says it checked the signature and is saying this image is not really signed so, you know, it's going to deny and it's going to block that from executing. Another test would be if I have let's say I have another deployment which is signed by some other signature. Now in your rule you can specify as many signatures as you want. So if you want to make sure that each pod is signed by, you know, there's an attestation let's say for your commit and other things you can combine the signatures but in this case it's some foreign signature so Kivarno again, you know, uses cosine does that check and will immediately block that pod and say this is not allowed in this particular cluster. So just a simple demo but a quick example of showing, you know, how you can now use these policies to start enforcing things.    The thing that if you're not running PSPs today or not using some other tool for pod security, I definitely recommend checking this out. In fact, you know, I can show a quick demo of this as well.  We'll just use this one command line to apply all of the pod security policies available, right? And there's about 15 of them defined in Kubernetes. This is, there's a spec called the pod security standards which defines three levels of pod security. And what this is going to do is it's going to put the highest level of pod security in my cluster. So it's a number of policies and we're applying a customization to them to switch these to audit mode. So if I do now a kubectl getSeapol, which is cluster policy again, I see I have a bunch more, a lot more policies, right? Now let's try and, you know, take an insecure pod. And I like this one. There's a website, you know, maintained by Bishop Fox called Bad Pods, which is interesting for testing. So this is, the reason why is this bad, right? Because it allows privilege mode, it allows, you know, running it in the host namespace, using, you know, host bid, host path, the host network itself, and also host IPC constructs, right? So definitely not a good thing to run in your cluster, because of course if an attacker gets access to this pod, from there they can also, you know, kind of leverage other things. So I'm going to go get YAML for this. And so let's go with this first one and we'll just go to the raw definition and we'll grab the command line. Let's see if we're able to run this in our cluster. So this is pulling down that, you know, demon set YAML and immediately, of course you see a bunch of errors which are saying that, hey, you can't run this workload because it's not configured for security and it doesn't comply with the policies we just installed, right? So quick examples, there's lots of other more powerful demos in the community on the Kverno website itself. So certainly take a look. But just to summarize and wrap things up, yes, so Kverno is designed to be a fully Kubernetes native policy engine. It runs inside Kubernetes clusters as an admission controller. Also understands Kubernetes constructs, which makes it very easy and simplifies managing, defining and enforcing complex rules within your production clusters. So what Kverno helps with is securing and automating your configurations at scale and doing this, you know, again, so across your DevSecOps roles so you have proper separation of concerns as well as you're promoting best practices. And Kverno is like we saw is extremely simple to get started with and certainly with the, you know, like use cases like pod security, best practices for your workload, it gives you a lot of benefits right away. So certainly check out the community site so you can just go to Kverno I.O. for all the information. We are on the Kubernetes Slack, so if you go to Slack.ka. So Kubernetes.io there's a Kverno channel and we have, you know, monthly community meetings for end users. We also have weekly contributor meetings and growing set of contributors who are also helping extend and manage Kverno. So that's what I had to cover. So thank you very much and pleasure presenting Kverno to everyone.


Hello friends and how are you all doing today? The question sees find the probability distribution of The number of doublets in three throws of a pair of dice Now let us solve this together Let X denote The number of doublets now the possible doublets known to us are one comma one two comma two three comma three four comma four five comma five and Six comma six when a pair of dice is thrown now clearly X can take the values of Zero one two and three right So probability of getting a doublet Will be equal to six out of 36 times That is equal to one by six so clearly probability of getting sorry probability of Not getting a doublet Will be equal to one minus probability of getting a doublet that is equal to five five six Now let us find out first of all probability when X is equal to zero That is probability of getting no doublet that is equal to Five by six into five by six into five by six as the pair of dice is thrown three times So after simplifying we have the value as one twenty five upon two one six Similarly, we will be finding out probability when X is equal to one that is probability of getting one doublet and two non-doublet that is equal to one by six into five by six into five by six or Five by six into one by six into five by six Or we can have five by six into five by six into one by six That is getting a doublet a non-doublet a non-doublet or a non-doublet first then a doublet and then a non-doublet or Non-doublet non-doublet or and then we get one doublet Then after simplifying it we have the value as three times One by six into five by six into five by six That is further equal to twenty five upon seventy two Now we need to find our probability of two doublet and one non-doublet that is one by six into one by six into five by six or five by six into one by six into one by six or We can have one by six into five by six into one by six That is three times the value one by six into one by six into five by six That we have as five by seventy two Lastly we need to find out probability when x is equal to three that is probability of all doublets That is equal to One by six into one by six into one by six that is one by two one six therefore Hence or therefore the required probability distribution is when the value of x was zero The probability is one twenty five upon two one six and the probability Sorry when x values one the probability is twenty five by seventy two Two then it's five upon seventy two and when the value of x is three then the probability is one upon two one six So this is the required answer to the given question. Hope you understood whole concept Well, do take care of your calculations and have a very nice day ahead


Hi, my name is Andrea with Food and Mentory Adventures in Food.  On our channel, you'll find simple and tasty recipes using everyday ingredients. Hey guys, so for dinner tonight, we are having this garlicky pasta that I picked up from Trader Joe's a while ago on a haul and here it is really quick and easy to make. You just add a little bit of water to the skillet and the pasta and then you just kind of let it steam. Very garlicky and we're also having some leftover green beans that I had in the fridge that I needed to use up and a garlic knot. So this is what we are having for dinner tonight and we will see y'all next time. Hey guys, so Howard and I are out for lunch today. We're trying out a new Chinese restaurant. So let me show you what we got. We both got hot and sour soup with our lunch special and rice. This is mine. It is sesame chicken. We ordered some veggie egg rolls. Howard got general sauce chicken. For an appetizer, we got some garlic pork ribs and don't they look delicious? Only thing we're waiting on is Howard's soup dumplings. So I will show them to you once they come to the table and the soup dumplings just arrived at the table. Hey guys, so for dinner tonight we are having Mississippi pot roast. I used to make this all the time on our channel and I haven't made it in a while. So in my crock pot I have a two pound roast. It's actually a little bit more than two pounds. I have some brown gravy sprinkled on top. Some ranch mix as well. And then the original recipe calls for pepperoncini. I thought I had some in my fridge but I didn't. So I am using, I had like a half a jar of these banana pepper rings. So I have sprinkled those on top. I did look online to see if it's similar in flavor to the pepperoncini and it said that it is. But banana peppers are actually a little bit more spicy. And then instead of adding, excuse me, a whole stick of butter unsalted, I used half a stick. I've always used half a stick and I've never had any problems. But this recipe is good for boneless skinless chicken thighs. I've used that before. Pork, you name it, it's just a really flavorful recipe. So I'm going to cover this, cook it on low for probably about 10 to 12 hours. Okay, so here is dinner. It's been about, probably about 11 hours. And I am serving the roast with some rice. And then I made some mixed greens with smoked ham hawks. And we're also having some yeast rolls. I am using these Kroger ready to bake original yeast rolls. I just let them kind of proof. And then I put them in the oven, of course. Oh, and here is the rest of the roast right here in the crock pot. And it made a lot of juice. If you'll remember, I did not add any water to it at all. So this is what we are having for dinner tonight. And we will see y'all next time. Hey guys, so I'm trying out a new recipe for dinner tonight. It is a ravioli fettuccine. And in this pot, I am boiling two packages of this five cheese ravioli. I picked it up from Aldi, nine ounces each. And then this skillet right over here, I've got some butter, garlic, and some freeze dried parsley. And once my pasta is done, I'm going to drain it, add it to the skillet, and then add my heavy whipping cream and Parmesan cheese. Okay, so here is dinner all plated up. And it is very tasty. As you can see, it was very easy to throw together. I did not add any additional salt to it because we're trying to watch our salt. And I felt like there was going to be plenty of salt in that Parmesan cheese, but it is very good. Serving it with a garlic knot and a side salad with olive garden dressing. So this is what we are having for dinner tonight. And we will see y'all next time. And I will make sure to leave the recipe in the description box. Hey guys, so for dinner tonight, we are eating these ribs that I had in my freezer. They were 724. And then I got them for 50% off, which is a great deal. So this was like three bucks and some change for this half a rack of St. Louis style ribs and they're already seasoned. Then we're also going to have some fresh corn on the cob. And then I am going to doctor up this dox of macaroni by adding some extra cheese and sour cream and baking it. I have done this on our channel several times. I will try to remember to link the video with instructions on how I do it. But quick and easy dinner tonight. Okay, so here are the ribs. They just came off the grill. There are seven bones on here and they're really thick and meaty. And here's the mac and cheese just came out of the oven. So I'm going to plate everything up and show you what it looks like. Okay, so here is dinner all plated up. Got the grilled corn on the cob, macaroni and cheese and those ribs. So this is what we are having for dinner tonight and we will see y'all next time.


This is a UK investigation that Viva did Sickening this one here was pecked to death by other turkeys. You're a meat eater, right? Yeah Yeah, so there's an animal being decapitated horrible no turkey crown roasts We're gonna give these out for free and give people different options other than eating the bodies of slaughtered animals So let's do it This is a this is a turkey investigation look at this bird here They're pecking a bit in confinement You know trying to plead with people not to pay for this because This place exists because you pay for animal products basically Give your money to these people who do this to the animals and they feed you the animals So we want people to try something different. So I like this brand here But they're but it tastes like meat. It's wheat's meat Yeah, give it a crack Bit of gravy on there. It's amazing.   Yeah, well Yeah, what what you having trouble with eggs, huh? Well in this little guide here. Have you tried scramble tofu?  There's no cholesterol and tofu. It's got more calcium iron. It's really good for you But here you go. Here's a little guide. You can take a little vegan turkey. Thank you.  Yeah There's an animal being decapitated horrible Wait a second.   But we want people to go vegan because the eggs and dairy harm the animals Bless you There you go But yeah, so there's a bunch of information on how to change your lifestyle on there If you are interested in not being paying for this stuff But these places only exist because good people like you put your money there mindlessly and don't think of the other end of it But we're good people like you to help us help the animals without you. We really don't have a chance. So Thank you Do you eat animals trying to come away from it trying to come away from it? Yeah, cuz of because of the Yeah, fish feel pain to a That's good, I'm glad you're making those changes Yeah Yeah Yeah, what yeah, what did you see see spiritsy? Yeah Is she vegan yeah, good honor. She's a little activist That's good enjoy it. No worries. Take care. He's in the good books with this vegan girlfriend He's got a little vegan turkey to take home for Christmas.  Are you a vegan Okay, well then you need this you need you need some info. This is a little vegan Christmas supermarket guide and What animals do you eat?  Someone said to me how I eat them three times a day I eat a little bit with every meal a bit of their body a bit of their eggs It's a subjective thing you do in your mind We're like if you eat animal products you eat them at every meal nearly like bit of dairy bit of eggs bit of meat bit of this bit of that but Just this investigations that have been done in the UK.  It's it makes I've been in farms all across the UK sickening places They give me trauma being in there. So it's horrible. So Have a good Christmas, but This is an easy guide free help going vegan I mean if it's something that you're morally against only makes sense that you stop donating your money to animal abusers You know what I mean? Have a good one. Have a good Christmas mate. Take care.  They definitely do see what I talk about mostly is animal rights Yeah, from the animals perspective like this is a England chicken farms so Yeah, free range farms are disgusting Yeah, they they market them very well, but they get exposed all the time It is it is a good start Tarion from our team put together this little Christmas guide, right and you just scan it with your phone No one wants anything from you by the way, this is all just donation base We just yeah, so you just you scan that and it will show you all the Christmas stuff Supermarkets, but um We'll give you this as well to take with you to Cook you can tab one each and take you know because you've got to have a bigger family don't you so yeah This is my friend donated these for us to give away just to help the animals because you guys you meet eat meet eat Is that you don't like this? Yeah, but you support it.  Cheese You still on the eggs Yeah, they do all the studies on them for the healthy diets and that in there Before Adam and Eve fell in the garden of Eden. Yeah, the animals weren't eating one another Garden of Eden was vegan. Yeah It's only when sin came in So you basically live in the back and it live in alignment with Eden in a way try to yeah, man I don't drink or smoke. That's a good issue on health grounds. Yeah health grounds I know at 7th Advent is a really big on health, but I'm a I'm really big on animal rights We're giving these out these aren't these are these are healthy earthen meat But these are for people who love eating that texture of flavour of meat But without the violence of the to the towards the turkeys We're also giving people these are these little cards here You scan it with your phone and it will show you what all the Christmas stuff is all the Christmas stuff You can you can get from all the different supermarkets at your shop and this is a little little guide on how to be vegan Well, even if they're the welfare is good at the farm They send them to the slaughterhouse to be executed heads chopped off and this isn't a godly place This is a demonic place Yeah, hey, but listen bless you my friend I will do thank you so much peace Hey guys, how are you? Last year at this exact same spot Had the police come here and tell me I had to turn this off turn the screens off because it was offending people Seeing showing people how their food was made offends people apparently but these police are cool As long as I don't get a complaint.  I've been a vegetarian now Okay, chicken anymore, but I still get cravings. I wouldn't lie to you and I had one last week for chicken You come to the right place So we're giving these out. This is our no turkey roast crown from Wicked kitchen Stop. I don't like people eating turkeys. This is my friend Tinsel from last year. I rescued her I don't want people eating the birds and killing the animals So I just we're giving people options instead of the slaughtered bodies of animals And this is like the same take texture taste and you I think you really like this particular one I still eat eggs though, yeah, so you do that. Do you still do ghee and yoghurt? Yeah, the dairy industry. I mean I talk a lot about it It's one of the most horrific industries in the world in India as well Like a lot of Indians don't know how bad the dairy industry is because they think of a hymsa dairy Yeah, and they think of a but it's not like that India is one of the biggest exporters of leather and beef because of the dairy cows All those animals dairy cows egg-laying hence they all get cold. They either get gas chamber to have their throat slit Yeah, you know that's me.  Yeah, of course. Yeah, the best way to live in alignment with Caring for animals is to be vegan and all these other animal products. They harm the animals Exploit the animals. Thank you so much for enlightening me and that image is definitely will stuck to me And yeah, well, if you want to be vegan challenge 22 is free help Really help they help you for free on Facebook Joey. Nice to meet you my friend. Thank you.  I do eat meat meat I crave I can't just eat like Me neither. No, no me neither. Like I think this is a really good Can I ask you another question do you hate crawl tea to animals? Yeah, because this is a Some people are really evil. They are I can't even look at that. I don't want to look at that Okay, okay, but where I live there's loads of cats and I feed them as much as I can Yeah, so you look after animals, but when you buy animal products, you pay for the most horrible cruelty on earth Do you know what I mean?  Yeah, but like a lot of just normal people just eat eggs Like you know eat dairy Be vegan here's some vegan information vegan means not harming animals The Mrs. Doors book wait you eat meat dear. Yeah, have you seen come around this side? I want to show something This is my friend tinsel rescued her last year from a Turkey farm she was gonna be have a head cut off. She's so intelligent.  They have You don't not even at Christmas This is a dairy cows It's what happens to the dairy cows when they stop producing milk all dairy cows go to a slaughterhouse all of them without Bolt gun slash cross the throat chopped up into minced up into burgers After they take their their calves off them year after year exploit them for their milk And when there's nothing left of them they kill them so Don't take one mother This is vegan. Hello vegan. It's hello and vegan. Yeah, no animals No meat. No meat Sorry, what's inside? This is wheat wheat meat tastes like meat, but no animals were killed Yeah, it's good. It's tasty. It's really good. Yeah Take one. So what do you think about that mate? Yeah Yeah, but yeah, I know I know I mean I ain't meat for 26 years steak. I'm not some new Vegan like I'll come up in the world like everyone else Yeah, I mean being vegan is like pretty easy in this country especially like hey, mate Take this as well take this it's got some information on how to be vegan. All right, please have a good Christmas There's no meat in this It's a wheat No, no, no, well, no, no everything here you can pronounce. This is a wheat Gluten wheat starch wheat flour nice in these vitamins protein a pea protein Now there's not many Preservatives or anything in this who isn't on it But the main thing is the turkey hasn't had the head cut off for Christmas Which is what we're trying to do trying to stop people from supporting this suffering Happens in terms of turkey farms all across the UK. This is a UK investigation that Viva did Sickening this one here was pecked to death by other turkeys This is a no turkeys so yeah Yeah, mate and that's all we're trying to do Basically we're showing people turkey because most people each turkeys on Christmas here in this country, but we also show the other animals here sheep lamb So yeah, we're teaching people the animals are they like us in the way they experience the world and they don't want to die Stop eating animals stop This is an animal having their throat slashed off slashed open For the meat industry this animal didn't want to die Shouldn't be doing this yeah, but when you go to the shop right and you say hey Can I have some meat you just paid them to do that you paid for this? And you good heart you this is affecting you so you're doing something that is against your belief. Yeah Alternative is a vegan so this is a challenge 22 free help going vegan when you see the word vegan You know, there's no animal products in there Any product any products from an animal no no eggs no milk from a cow and no meat and no wool No fur no feathers So basically like they do make meat out of a this is made of wheat protein It looks like me, but it's not me. Yeah, it tastes like me, but it's not me. That's me in those farms.  Are you a vegan? We're handing out vegan turkeys Do you have any meat? Do you have a meat-eating husband? Why don't you why don't you roast them up this and see if he knows the difference. Okay. Yeah This is a little vegan Christmas guide and we're giving these out so people know where all the the vegan Christmasy stuff Is from all the supermarkets Yeah, so it's actually been cool to like give Vegans these as well as meat-eaters so they can take it home to their meat-eating Partners or meat-eating family and share it with them. So we're kind of a Getting then to go home and cook it up for them basically so it's been a double whammy today Which I'm really happy about Yeah, but the kids eat them eat the animals don't they so we're trying to show parents and that that they shouldn't be feeding their kids a cruelty place. There's two types of conversations to have one is about Hello, and how it's not really hello here in the UK. Have you seen this before me? This is a this is dairy Idea yeah, really. Oh really so you don't do you think it's wrong?


Good afternoon. I'm Gaylord Jones, and welcome to Dimension, a weekly look at the issues behind the issues which saved the quality of our life here in Waldenville. Now, as you know, the city has recently negotiated a contract with its employees. For a while it appeared almost certain that there would be no agreement and that there would be a strike. However, good sense has prevailed and through the use of a mediator, the strike was averted and the contract, which is satisfactory to both sides, was signed just a few days ago. Now, today in our studio we have with us some of the principal participants in that negotiations. And since the issues of that negotiation are a vital concern to all of us here in Waldenville, and since the collective bargaining process is apparently becoming critical to the well-being of our city, I thought today we would explore that process. I have asked our guests to be candid. I have asked them to share with us thoughts they might usually keep for themselves. Because it's important that the citizens of this community understand the delicacy and the dynamics of a labor negotiation, they have agreed to be open. They have the greed to let us come inside the process with them and see for ourselves what really goes on in negotiation. Our guests today are Mr. Thomas Callaway, Director of Personnel and Labor Relations. Mr. Callaway was the Chief Negotiator for the City. And Ms. Patricia Martin, the Chief Budget Officer for the City, who with the others was a member of the Management Negotiating Committee. From the other side of the table we have Mr. Joel Murphy, who was Chief Negotiator for the Employees. And Mr. Ted Daniels, President of the Local Union and a member of the Union Negotiating Committee. Now gentlemen and Ms. Martin, let me pose your question here. Collective bargaining seems to me to be an adversary process and this suggests to me that someone wins and someone loses. Yet after disagreeing violently on several issues, in fact nearly going out on strike, now you claim an agreement is satisfactory. Who lost? Who won? Mr. Callaway. Mr. Jones, let me correct some things you said. First, the process is not an adversary process. We were not fighting each other. We were strongly advocating our different positions. It might have looked adversary but it was not. We were trying to establish how we shall share in the decisions about the terms and conditions under which our employees work. You see, the process is not as simple as you've indicated Mr. Jones. We discussed dozens of issues, many interwoven and quite complex. There were some issues about which I personally would have preferred a different outcome. And I'm sure there are some issues that Mr. Murphy would have preferred a different resolution. It's not a question of winning or losing. It's a little bit like a marriage. You have to give and take a little here and there to keep the total relationship healthy. You accommodate because in a relationship like ours, unlike a marriage, there is no divorce. It's very rare that a collective bargaining relationship is ever dissolved. I have this image of you people sitting around the table behind closed doors, essentially horse trading. Not at all. In fact, if my membership thought that, I wouldn't be president of our local for very long. Going back to your image, when we think about negotiation, we almost always think about two groups sitting across the table from each other arguing for or against some point. What most people don't realize is that only a small portion of the process takes place at the table. If you think there's disagreement at the table, you should see the disagreement that goes on within each team when away from the table and how much negotiation takes place within each team. For example, before we could present a proposal to the union, our committee had to attempt to reach a consensus and being human beings that's sometimes not so easy. Remember when we were discussing our money proposal? We just haven't got the money. Look Pat, if we're going to get a three-year contract, we're going to have to pay for it somehow. It's that simple. You gave them their uniforms. You're giving them that $10,000 increase in major medical insurance. And you're thinking of giving them that educational incentive. Now that's new money. Where do you think it's coming from? Mayor Hobson, please. Jim, this is Tom. Things look fairly good. We've got a number of issues settled, like, well, like overtime traded off predictably for temporary transfers. Pretty soon, Jim, we get a feeling that a long-term agreement is possible. But it's tied to cola, you know. I think we can get a multi-year agreement, but I just, I've got to know if we can bend that far. Yes, Mr. Mayor. I still expect that revenues for the next three years will increase at about 2% per year. We can spend no more than 4 million per year for the next two or three years. Now that includes wages and fringes. If my projections are correct and there are no unexpected changes, that means 13% the first year, something less the second and third year. Now, Mr. Mayor, wages are only a part of the cost of their demands. We've got insurance, educational incentives. These cost money, too. Yes, Jim. 5% a year for the time being and no cost of living. And remember, Tom, then you better be ready for a fight on residency. So, what's the deal? The mayor says no cola. Good. They're not going to buy it. Crying out loud, Tom. We're not running a supermarket here. We're supposed to be negotiating a contract. And anyway, we're the buyers in this thing. We're buying their labor, and that is all.   Each of us have our individual feelings and knowledge of the issues. It takes a while to reach an accord even within your own team. Well, is it necessary in the process that there be a complete agreement within the bargaining committee? Well, it's necessary that we appear to agree. We had a member of our committee who felt especially strong on the residency issue. When we were in caucus, we went round and round on that issue. If you could have seen those caucuses, you probably would have thought it was a miracle we could be united at the bargaining table. We had just recessed the negotiations and, uh, well, it looks like the employee appeals board and the no strike will trade out. But we're going to have to drop our cost of living proposal. We simply can't get cola. I'm convinced they'll take a strike over it. But what about the three years? And we can't take three years without a cost of living increase? Well, I think, uh, I think they'll come down to two-year contract. We can live with that. So that really just leaves the, uh, educational incentive, contracting out wages and residency is the key issues. Uh, what about the additional holiday? Yeah, that too. Now, uh, I feel we're going to have to make some compromises on residency. I'm not sure I like the sound of that. How's that, Ed? Well, Ted, I've lived on a farm outside of town for 20 years. I put a lot of my life into that place. And there ain't no way, as long as I'm on this committee, that I'll let you sign away my home or my job. Because that's what it'll boil down to if you agree to a residency clause. Now, you either hold ground on this thing or you're going to have to carry me physically from the table. It seems then that the bargaining that goes on at the table is just the tip of the iceberg. When we were negotiating our contract, we weren't negotiating in a vacuum. The whole community was involved. After all, the issues that affect the lives of people throughout Waldenville. Not only did we negotiate within our own committees internally, but there were external pressures, which became a basic part of the negotiation. What pressures? I don't mean this critically, but I think the best example was you. Me? You remember before the negotiations began, you made a radio broadcast. If a rumored walkout of city employees becomes a reality, there may be a lot of people going to the polls to vote against Mayor Hobson, perhaps for the first time in their lives. Last year's strike at General Transistor was long and bitter. Many of our neighbors were financially hurt. But the scars left by the General Transistor strike would be nothing compared to a walkout of city employees. And so the question we must ask ourselves is this. Who owns Waldenville? Is it Jim Hobson and the city council? Is it Joe Murphy and Ted Daniels and the union? Is it those who feel compelled to negotiate our welfare behind closed doors behind our backs? My feeling is that we own Waldenville, you and me, your family and mine. Those who this very night are arming themselves with the issues of confrontation better quiet for a moment the rattling of their sabers and listen to the voice of the people. When you made that comment about a rumored walkout, it directly affected the negotiation. A walkout was the farthest thing from my mind. Of course, our membership had voted us the authority in case we couldn't reach a settlement. But I was told it would be a walkout. Who told you? I hadn't heard about it and I'm president of the local. No matter. It's entirely possible the city included its no strike clause in its proposal as a direct result of your broadcast. No, not really, but it conceivably changed the intensity of our attitude about the issue. In any event, the media represents an important dimension of the collective bargaining process. Undoubtedly, it influences what happens at the table. Should that be? Of course. After all, we are negotiating in public even if we are behind closed doors. We're employed by the people. We're paid by the people. And you have to be responsive to community attitudes and feelings. You said it in your broadcast when you asked who owns Waldenville. What are some other external pressures? I think both sides felt some pressure from the city council, especially about the residency issue. As a matter of fact, it took Sam Stone, the mediator, to figure out a way to help us relieve that pressure. What was Sam Stone's role in the negotiation? A mediator is precisely what the name implies. As an interested yet impartial third party, he helps us to discover areas of agreement we might not be able to find by ourselves. He's a communicator, a sort of diplomatic courier who moves freely from side to side with what we'll call supposals. Suppose you would do this, suppose you try that. Sometimes we're too close to the forest to see the trees. Now the mediator helps us step back a little and take a fresh look at the issues that divide us. You're going to tell us about external pressure. The city council? Now tell me about residency. This thing is one hell of a mess. We've all got a problem on this one. They're asking for a provision in their contract that would assure them the freedom to live anywhere they choose. I'm not so sure that I disagree with them. But the city council is proposing a residency requirement that would make anyone living outside the city either move back in or face the possibility of dismissal. I'll tell you Mr. Stone, I worked most of my life to get a home out there in the suburbs and I wouldn't like coming back. I can't blame these guys but what can we do? The whole thing is a mess. Right now about 30 percent of our employees live outside of the city. If this bill is passed, we're going to have terrible problems throughout our departments all through the city. Sure and I could write the best damn residency clause in the world but then along come the city fathers and legislate away my good faith. How could we ever face them across the table again? The city council being an elected body is simply an extension of the people and the people are and always will be an important dimension of bargaining in the public sector. Well what about the mayor? I understand that he played an important role in the negotiation. Now I think we come to a slightly different dimension. I'd call it the vertical dimension or vertical accountability. I was chairperson of the city committee and I was selected by the mayor. Therefore I was accountable to the mayor and as personnel director of the city I also was responsible for all the people who worked for the city union and management. You have to remember the contract negotiations were going on at the same time the mayor was campaigning for reelection. If the negotiations went badly or there was no settlement it might have affected the election. So I can imagine he put a little pressure on Callaway here. The mayor and I had several discussions prior to and during the negotiations and he had some pretty strong feelings to say the least. Where do you get that walkout thing Tom? Beats me. You know there's been no rumored walkout and even if there were it doesn't necessarily mean it would hurt you at the polls. It might even help show the people you're interested in their welfare. An electorate is an unpredictable thing Tom. A walkout or a walkout rumor is a risk and I don't like to take risks. I don't like surprises. Believe me Jones is just chasing ghosts. Well how does he get away with bull like that? We've got a good contract right now. It's been pretty fair to everyone concerned. I just want to make it better. Do you think they'll go for the three years? Yeah it'll be tough to sell. We've got to have it. I can't run this city if I can't project costs. And now that Gaylor Jones has brought up the issue I want to know strike clause. I don't think that would really be wise. We've never had any trouble. I want it. I want a guarantee of labor peace over the next three years. The people want labor peace and I want it and the city council wants it. And it's your job as head of the negotiating team to get it. I know what we want to get Mr. Mayor. Right now I am more concerned about what we must reasonably expect to give. You're looking for a bottom line Callaway. There's just one line as far as you're concerned Callaway and that's what's best for the people of this city. Now you talk about reasonable expectations. Do you think Daniels and Murphy are going to be reasonable down at the union hall? Well I can see how the city committees must have felt this pressure from above and below. But how about you Mr. Daniels? Did the unions feel the pressure? Sure. The mayor isn't the only elected official in the city. I'm an elected official. I was elected president of the local on the basis of my views on certain issues. Issues that our members feel very strongly about. The membership wouldn't think kindly of me if I were to fail to advocate those views at the bargaining table. Well what about pressure from above? Here it sits. Mr. Joe Murphy regional representative. There are times when the national and the local have differing views on specific issues. In the negotiations just passed we had a difference on how to handle the residency issue. Now to the local membership this was an extremely personal issue and I felt and I think the mediator Mr. Stone felt that personal involvement was leading them where it wasn't wise to go. And as local president I'll catch it from both ends. Top and bottom. I know how you feel Ed and I'll stand by you but I don't think we can win. Murphy doesn't even live here.  I'm sorry Ted. Can't help how I feel. Look Ed, first of all you wouldn't be affected. It's a gamble any way you look at it. Suppose the union goes your way. Suppose you strike.  They're human beings just like the rest of us and human nature being what it is I think a strike would pretty much guarantee an ordinance. It might make a few of them just mad enough to push through an ordinance to turn your strike sour. Do you think about working together we got a chance? A hell of a lot better chance than if you strike. It would be a strike you just can't win. You guys elected me Ed. I'm not going to go against you no matter what kind of pressure I get from Murphy but I'm asking you give me a chance to work it out. This brings up what is probably a very touchy subject that strikes or the threat of strikes. Now the impression we got here in Waldenville during the negotiation was that the union was going to take its members out on strike if it couldn't get its way. Then your impression was wrong Mr. Jones. Let's get this one thing straight. Most union leaders are not strike happy. Strikes are serious business and no responsible union leader takes them lightly. Most of us have to be pushed into a strike by our members. We resisted. That's right. It's easy to lead people out on strike but it's harder to keep them out and it's not easy to lead them back especially as a united group. You never get everything. How do you explain that after a long hard strike where members have lost maybe a thousand dollars on their paychecks. From the other side of the so-called table let me add this. I've been representing management for a long time in both public and private collective bargaining. There were times when I found it necessary to push unions to the wall to confront them with a hard decision to take less or take a walk. When we reached that point both sides talked pretty tough at the table and we mean what we say but when push comes to shove neither of us wants to put the other into a box we can't get out of. I'm just learning this business but I think I know one thing most negotiations are settled without strikes. Less than five percent of all negotiations involve strikes and even in many of those cases the strike is a way of bringing about an agreement. Every once in a while it seems necessary just to keep everybody honest with each other. It helps clear the air. So the strike or the fed of strike is really just another means balancing the pressure that each side can exert on the other. This whole pressure thing is pretty interesting. Aside from strikes let's see if I understand these various pressures or dimensions. We have an internal dimension that is the negotiation within each team to resolve the differences within each committee. Then we have the external dimension that's the politics press public and then we've got this vertical dimension the responsibility of each committee person to his constituency and to the chain of command above it. Then my question to all of you has to be this with all these conflicting pressures how can the system possibly work how can you avoid chaos. Well you've answered the question with your question. All those conflicting forces are the very things that make bargaining work because the net effect is to create checks and balances and flexibility leverages moving in every direction at the same time. The result is almost always in one way or another an agreement. If collective bargaining were simply two adversaries coming together with fixed inflexible positions no contract would ever be signed but because each negotiator has responsibilities to so many people his constituencies the community at large we must bend accommodate we become advocates not adversaries because we know we're going to be facing each other across the table again. Once the contract is signed there's a long time to live with it and make it work two years. At the beginning of this program you asked who won and who lost well I think collective bargaining is one of those rare processes where no one really loses or wins totally one day one side may come out better but that doesn't last there's always another negotiation down the pike and of course there are those occasions when both sides may misunderstand each other or when anger or ego went out over good sense but and in those cases both sides are losers. But the contract we signed is essentially what each of us came to the table to get. Oh they'd like to have had the three years I know but they did get two which is better than the old one year term and we'd like to have gotten a little more money for our members but we did get a substantial increase over the old contract. Well what was it like at the table what would our viewers have seen if they'd been able to attend the actual sessions. It's not hard to describe for the most part they would have seen Joe and me discussing and arguing back and forth occasionally Pat or Ted or one of the others would come in with a position to explain or interpret and observer probably would have been bored to death most of the time. Now this horizontal bargaining back and forth across the table is essentially two groups of people attempting to persuade each other that their positions are reasonable and just and that the position of the other is unreasonable and unjust and because each side wants to convince the other side its proposal is more reasonable and more just sometimes emotions rise to the surface rather dramatically. Now what's the problem with the no strike proposal. You know the law in this state prohibits strikes your proposals irrelevant. You know what I'm talking about the slowdown we had last winter. Well did the union cause it or did your management cause it. We had a contract. But did the union sanction this alleged slowdown. Did the union disavow it. I don't believe you were living up to your responsibilities.  We haven't heard any rumors that you're in trouble. Do you intend to apply for the job Mr. Murphy. We can approach this thing two ways Tom we can we can approach the issues directly or we can sit here and trade insults with each other. Now we've been responsible on this matter and we're still responsible. Let me ask you a rather subjective question. Now this contract negotiations you've just completed seem to be fairly volatile and passions ran high. It could have it could have toppled the city administration. Hundreds of employees could have lost their jobs and yet you seem to be in control. Now wasn't it really just a kind of a charade. Isn't there some alternative. Isn't there some better way to solve your differences. I don't know. I've thought about that. Well we could return to the law of the jungle. And I suppose there might be other ways. The old ways didn't seem to work out very well. One side could impose its will on the other you know like like management did in the old days. But I see collective bargaining as a as a movement away from the despotism the chaos and the violence that wants characterized labor relations. It's the best way we know of coming to some kind of temporary agreements about the circumstances under which people work. What's true it is highly stylized. It's almost a choreography. Yeah I think I think we could describe what we just went through is the choreography of negotiations. It's also a peaceful way of resolving conflict. It's a process of continuing communications and dialogue. This was our fourth negotiation with each other. And I'm sure the next one will be much easier on everyone concerned. Well now I don't know about that. Not unless you have a cost of living increase in your next wage proposal. There will be no cola while I'm with the city. I keep telling you people not to keep getting yourselves in the box you can't get out of. Now look. On this note of harmony we conclude our examination of the dimensions of collective bargaining. I might just add it's a process which seems at once terribly primitive and immensely sophisticated. It's a strange hybrid of argument and eloquence. A verbal brawl, a verbal ballet, passion, reason. It is in fact an example of democracy in action and most important of all it almost always works. Well that's our dimension for today. Have a good week.