►
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18).
SAFE WG Deep Dive – Ray Colline, Google (Intermediate Skill Level)
About Ray
Ray has a diverse background with over 25 years of experience including 10+ years of system administration and site operations experience and 10+ years in software development. Ray loves to learn and explore new spaces from being an IT admin for the Paul Merage School of Business, to startups in the early 2000s and now 14 years at Google where he has worked on enterprise focused software, android nfc payments, networking and Google Cloud Platform.
Ray is passionate about the operations and administration user experience and wants to make it easy for administrators to say yes to their customers needs without sacrificing the integrity of the systems they are responsible to protect.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
So
we're
not
exactly
sure
where
we're
gonna
end
up,
and
you
know
we're
taking
on
a
pretty
big
problem
which
is
access
control,
and
so
the
question
is:
what
does
that
mean?
What
does
access
control
mean
and
and
there's
various
opinions?
So
for
some
of
us
you
know
myself
included,
it's
can
I,
do
an
action,
so
I'm
a
user
and
I
try
to
do
something.
Can
I
actually
do
it
and
there's
a
lot
of
things
that
go
into
that
right?
A
There's
an
access
control
policy
that
says
I'm
explicitly
allowed
to
do
the
action
I'm
doing,
but
then
maybe,
if
I'm
starting
a
job,
it's
do
I
have
quota
to
do
that
thing
or
is
someone
gonna
pay
for
it,
or
am
I
coming
from
the
right
network,
address
we're
coming
from
the
right,
laptop
or
any
number
of
other
potential
variables
that
affect
whether
I
can
do
something
or
not?
So
is
that
the
definition
of
access
right
or
is
access
more
narrowly
defined
to
things
like
network
policy
or
simply
a
set
an
authorization
policy?
A
So
that's
one
thing
that
would
be
interesting
to
discuss.
Secondly,
we're
thinking
about
personas
right,
which
is
kind
of
related.
Who
are
the
folks
that
care
about
this
stuff?
Who
are
they
you
know,
and
and
and
who
do
we
really
have
to
think
about
in
terms
of
one
we're
evaluating
an
access
control
system?
You
know:
are
we
providing
the
you
know
right
data
to
them?
Are
we
giving
them
the
right
set
of
information,
setting
the
right
expectations
and
so
personas?
A
And
so
we
introduced
that
at
the
working
group
intro
two
days
ago,
and
so
maybe
we
can
talk
a
little
bit
more
about
personas
that
we
haven't
thought
about,
or
maybe
we
can
discuss
that
we
shouldn't
consider
those
people,
that's
right
and
then
the
next
thing
we
want
to
think
about
are
things
like
use
cases
right?
What
are
the
prototypical
use
cases?
What
are
we
trying
to
solve?
So
you
know
we
can
think
of
one
which
is
an
end
user
trying
to
do
something
right.
Do
we
give
them
a
clear
error
right?
A
A
You
know
a
few
weeks
like
tracing
around,
to
find
this
person
who's
actually
in
an
office
in
Bangalore
right
and
they're
there
in
the
US.
So
these
are
the
types
of
things
where
you
know
as
designing
an
access
control
system
building
in
some
level
of
messaging
might
be
an
interesting
case
for
it
for
this.
So
to
do
that,
you
know.
A
Lastly,
here
there's
a
lot
of
prior
art
or
not,
lastly,
but
there's
a
lot
of
prior
art
in
in
what
we're
doing
so,
one
of
the
particular
ones
that
the
Christian
found
or
is
do
at
least
turn
me
on
to
is
the
NIST
and
NIST
is
actually
has
this.
This
document
that
describes
evaluating
admission,
control
or
Lima
sure
access
control
systems
and
it's
huge
it's
like
50
pages,
and
it
talks
a
lot
about
a
lot
of
good
stuff,
and
so
we
can
learn
here.
A
We
can
actually
figure
out
and
try
to
distill
that
into
something
that's
good
for
for
cloud
native
and
then,
lastly,
here
what
are
the
attributes
of
an
access
control
system?
So
you
know,
there's
Express
ability
right
can
I
actually
target
this
policy
to
the
things
that
I
want
to
right,
or
am
I
artificially
limited
by
the
system
things
like
you
know?
A
A
B
And
I
think
one
one
other
dimension
here
is
that
the
policy
working
group
mentioned
that
as
well.
We
tend
to
design
all
of
these
things
in
isolation
right,
there's
a
bunch
of
people
that
care
about
how
we
do
quota
and
they
design
a
quota
system.
That
is
for
their
use
case.
They
may
not
even
have
the
administrator
take
that
into
account
right
there.
They
have
a
very
narrow
focus
and
then
what
we?
B
What
we
get
is
that
all
these
policy
systems
have
these
slides
incompatibilities
in
some
horizontal,
so
that
that-
and
we
want
to
make
sure
that
at
least
as
a
first
level,
we
understand
what
that
is
right,
so
that
we
can
then
make
suggestions
on
how
to
improve
on
that.
So
our
goal
is
not
to
write
something
to
write
code
right.
How
our
code
is
to
help
us
understand
what
these
different
problems
are
and
that
we
can
then
educate
all
of
these
other
policy
services
on
how
to
get
better
right.
So,
but
one
of
the.
B
B
You
know
they
are
afraid
to
make
these
changes
because
they
don't
know
what
what
will
happen
right,
and
so
one
of
the
things
that
we
like
to
do
in
the
administrator
Bill
of
Rights
is
that
we
basically
say
we
want
to
make
sure
that
you
can
delegate
these
policy
decisions
to
the
people
that
have
more
knowledge,
but
that
has
to
be
done
in
a
secure
manner
right.
You
cannot
simply
allow
anybody
to
make
any
policies,
because
then
you
know
the
whole
wheels
come
off
pretty
soon.
A
A
A
As
a
policy
that
says
allowed,
you
know
allowed
container
registries
and
they
want
to
be
able
to
define
a
document
that
says
this
and
then
that
needs
to
get
somehow
converted
into
you
know
something
that
gets
written
into
into
OPA
and
it's
that
for
me,
at
least
from
an
admin
point
of
view,
an
explained
ability
point
of
view
being
able
to
generalize
that
to
say
this
is
the
format
that
we
choose
and
that
you
know
those
things
are
maybe
implemented
as
open
underneath
the
curtains.
But
then
we
could
actually
do
something
to
make
it.
A
You
know
more
Universal
write
more
something
with
documentation
and
explain
and
explain,
and
then
these
become
first-class
citizens.
They
become
things
we
can
talk
about
right,
and
so
you
know
in
this
discussion.
It's
like
surfacing
those
so
when,
when,
when
companies
right
or
you
know,
when
we
put
out
you
know,
policies
that
are
very
general
purpose,
how
do
we
have
a
framework
so
that
they've
hit
the
admin
Bill
of
Rights
so
that
they
are
explainable?
That
they
are?
You
know
something
that
can
be
composed.
This
is
something
that
that
Christian
was
thinking
about.
A
Yeah
yeah
I
love,
I,
love,
explaining
Bill,
it's
one
of
my
favorite
subjects,
so
I'm
happy
to
and
yes
to
explain
what
I
mean
by
explain
ability.
So
you
know
in
you
know,
in
a
lot
of
systems
you'll,
you
know
you'll
grant.
Let's
say
you
grants
a
role
right
and
so
in
GCP
in
particular.
There's
this
idea
that
you
can
you
make
someone
a
you
know.
Virtual
machine
happen
right.
A
vm
admin,
ok
cool!
So
what's
not
clear
in
GCP.
Is
what
that
really
means
right.
A
So
I
grant
that
to
myself
and
I
grant
it
at
this
at
this
folder
level.
So
I
need
to
understand
one
everything.
That's
in
that
folder,
so
all
of
its
children
will
get
that
same
role
right
so
I
want
to
say.
Ok,
if
I
give
you
that
what
does
that
really
mean
well,
it
means
everything
in
this
folder
you'll
have
that
on.
But
the
second
thing
is:
is
what
permissions
does
that
really
grant
right?
Someone
could
have
tucked
in
like
storage
bucket
reader
into
VM
admin
right
and
now,
not
even
thinking
about
it.
A
I
just
gave
that
person
access
to
read
buckets
well.
Why
did
that
happen?
Well,
it's
because
GCP
has
this
composition
model
of
this
idea
of
a
role
which
is
a
list
of
permissions
right,
but
we
don't
put
in
our
UI
those
lists
of
permissions
when
you're
granting
you
just
say:
oh
that's
V
mm
and
then
you
think
naturally
you're,
like
oh
yeah.
That
should
be
people
who
mess
with
VMs,
not
people
who
mess
with
buckets,
but
there's
some
side
effect
and
there's
something
that
someone
did
somewhere
and
we
leave
that
away.
A
Another
thing
of
explain
ability
is
hey.
You
know
what
does
tauren
have
access
to
right?
You
know
I'm,
really
concerned.
I
just
want
to
go
out
if
people
want
to
see
what's
going
on
his
job
titles
this,
what
does
he
have
access
to
and
then
being
able
to
get
a
list
and
say
this
is
all
the
things
that
he
can
do
right
for
compliance
reasons.
That's
very
important
like
for
PCI
compliance,
that
is
a
that
is
stated
right.
A
You
know
where
you
basically
say
like:
okay,
with
this
set
of
attributes,
you're
coming
from
this
laptop
you
coming
from
this
IP
you're.
Coming
from
this,
you
know
in
environment,
and
then
you
put
those
on
to
various
things
who
say:
if
you
have
this
group
of
attributes,
then
you're
allowed
to
access
these
sets
of
things
right.
The
problem
is,
is
how
do
you
know
when
you
grant
an
attribute
to
someone?
A
You
have
to
look
at
all
the
attributes
that
you
know
if
socially,
if
they're
ordered
together
right
and
then
say
these
are
the
list
of
resources
that
give
you
they
give
access
to,
and
so
you
know
we're
suffering
at
a
problem
over
basically
I
think
most
access
controls
are
over
granted
right
and
the
reason
for
that
is
is
because
people
don't
fully
understand
what
they're
doing
when
they
do
it
and
they
go
well
I'll
just
give
that
to
you
and
they
don't
understand
the
impacts.
Is
that
does
that
help
give
three.
D
Okay,
so
we
did
an
analysis
of
the
top
500
most
used
projects
on
GCP
come
compare
their
access
policies
against
other
logs
from
last
30
days.
These
are
policies
that
enterprise
customer
set
for
themselves
and
we
found
there's
about
95
percent
over
grunting,
so
95
percent
of
the
permissions
that
are
granted
to
certain
identities
that
are
never
exercised
in
the
last
30
days.
E
B
You
also
have
a
natural
progression
right,
the
small
companies
of
today.
You
know
you
know
you
start
your
project,
you
give
yourself,
you
know,
I
can
do
everything
in
this
in
this
project,
then
you
hire
more
people,
and
then
you
need
to
have
a
good
way
of
controlling
you
know.
While
you
grow
should
have
access
right,
the
CEO
doesn't
need
to
have
access
to
everything
anymore,
just
because
he
had
that
in
the
beginning,
yeah.
F
Can
everyone
hear
me
so
I
think
from
the
some
of
the
customers
we've
spoken
to
it?
It
really
does
come
down
to
the
culture
of
the
company
to
a
certain
extent
and
big
versus
small
as
part
of
that.
But
also
so
is
you
know,
do
developers
or
end
users
have
control
over
the
culture
or
does
the
security
team
have
control
over
the
culture,
and
is
this
an
opt-in
or
an
opt-out
model
to
security,
and
so
there's
yeah.
A
So
I
mean
yeah
some
some
smaller
companies
and
you
know
it's
not
there
yet.
But
what
we've?
What
we've
noticed
is
is
that
you
start
small
right
and
then
the
studios
get
your
first
round
of
funding.
Okay,
a
little
bit
bigger,
and
then,
when
you
get
your
Series
B
right
and
you're
thinking,
you're
starting
to
think
about
s1
filings,
then
it
becomes
a
big
deal
right.
A
And
so
you
know
if,
if
you're,
if
you've
entrenched
yourself
into
a
bunch
of
systems
that
are
hard
to
to,
you,
know,
explain
and
hard
to
understand,
access
and
you've
ran
over
granting.
Then
there
becomes
this
fire
drill
that
you
do
before.
You're
asked
one
to
go
back
and
like
clean
up
and
and
and
take
care
of
the
stuff
right.
So
can
we
help
people
get
there
from
the
start?
And
you
know
again,
I
think
safe
by
default
is
our
is
our
is
our
is
kind
of
the
admins
goal
right
and
the
better?
F
Think
by
cultural
science,
not
completely
a
great
level
of
that,
but
I
think
you
know
as
you
as
you
get
into
companies
that
have
teams
around
security
and
teams
around
compliance.
In
many
cases
they
you
know
that
position
is
default.
Now,
when
you
have
operators
who
just
want
to
say,
get
us
work
load
into
production,
their
position
is
default.
F
Yes-
and
you
have
this
quite,
I
think
healthy
tension
between
people
who
want
to
see
policies
complied
with
yeah
and
teams
that
just
want
stuff
to
work,
and
one
of
the
attributes
of
a
good
access
control
system
should
be
that
it
is
able
to
provide
a
language
and
provide
a
mechanism
that
allows
these
two
folks
to
coexist
without
being
at
each
other's
throats
road
all
the
time.
Yes,.
A
I
bet,
you'd,
see
a
convergence
between
developers
and
and
compliance
people
right
and
I
think
that
tension
exists
days,
because
we
don't
have
good
tools
for
determining
who
has
access
to
what,
and
so.
Therefore,
the
only
thing
that
they
can
do
is
to
react.
Saying
no
one
gets
access
to
everything
and
I
approve
everything
right
to
make
sure
is
that
yeah.
F
I'd,
extend
it
as
well
and
say:
there's
a
reciprocal
piece
from
the
developer
standpoint,
which
is,
if
you
can
tell
me
upfront
before
I've,
engaged
in
a
long
development
cycle
that
there's
actually
very
good
reasons
why
you
can't
talk
to
this
other
thing
or
you
don't
have
this
particular
right
on
this
resource.
Then
you,
then
you
can
either
negotiate
that
or
you
can
work
around
it
rather
than
hit
a
wall
at
production
time,
yeah
I.
A
B
That
is
also
important.
We
want
to
give
people
the
ability
at
Google.
We
have
this,
this
default
setting
of
trust
but
verify
right.
So
we
implicitly
trust
our
developers
to
do
the
right
thing,
but
we
check
that
they
actually
do
that
and
if
they
don't,
you
know
we
fire
them
and
at
you
you
won't.
If
you
want
to
be
able
to
yeah,
we
don't
allow
certain
things,
and
so
we
want
to
be
able
to
allow
people
to
do
a
setting
like
that
right.
B
We
talk
to
some
of
these
cloud
native
companies
and
we
can
see
that
they
have
a
similar,
simpler
notion
right
and
in
order
to
do
that,
you
need
strong
audit
capabilities
right
and
that
these
strong
audit
capabilities
fundamentally
then
allow
to
give
the
developers
more
trust
right.
They
can
they
can.
We
allow
them
to
do
the
right
thing
and
we
can
see
when
they
do
the
wrong
thing
and
then
we
can
react
to
that
and.
A
You
know
a
standard
way
of
specifying
that
and
think
you
know
what
I
see
is
that
in
in
a
lot
of
systems,
they
don't
they
don't
allow
for
dry
run
modes
or
things
like
that
that
help
you
understand
what
you're,
what
you're
gonna
do
and
whether
this
is
okay
or
not.
This
gets
to
the
point
we're
making
making
earlier
so.
B
Google
we
have
built
very
sophisticated
and
was
sorry
I
didn't
give
you
a
microphone
in
time
that
we
not
only
need
auditing,
but
we
also
need
a
way
to
analyze
those
audit
logs
to
see
that
you
know
something
bad
happened,
so
at
Google
yeah
we
have.
We
have
built
those
internal
tools
right
and
I
think
it
would
be
really
interesting
to
make
some
of
those
available
to
to
customers
as
well
right.
What
is
the
interesting
data
that
you
want
to
analyze
right?
B
A
This
is
cool
because
we
haven't
really
talked
a
lot
about
audit
logging
in
our
in
auditing
a
lot
in
our
meetings
so
far,
so
I
really
appreciate
that
this
is
this
is
coming
up
here
and
it's
something
that
I
think
we
should.
You
know
add
as
a
clear
use
case
right
that
we
should
be
covering
for
certain,
and
then
you
know
it.
A
It
feels,
like
you
know,
with
with
slot,
like
with
things
like
cube
flow
and
and
whatnot,
like
building
pipelines
for
people
to
do
this
on
a
regular
basis
and
and
encouraging
standardization
among
at
least
the
cloud
native
projects.
I
would
hope
right
would
be
a
really
beneficial
thing.
So,
if
you
use
these
products,
you
have
some
level
of
guarantee
that
they
support
this
auditing
system
and
they
can
tell
you
who's
used.
What,
when
whether
you're
over
granting
whether
you
have
a
surprise.
B
Then
one
of
the
interesting
things
that
is
happening
is
there's
this
creation
of
existing
access
control
system.
So
we
talked
to
some
of
the
large
customers
out
there
that
have
interesting
use
case
and
we
asked
their.
You
know
what
is
their
the
interesting
problem
that
you
are
facing
right
and
I
bet
in
a
lot
of
enterprises.
People
have
this
problem
that
we
see
at
the
moment
at
Google.
B
There
is
an
active
directory
somewhere
and
and
the
administrators
think
about
access
policy,
as
you
know,
whatever
I
have
in
my
Active
Directory,
and
how
do
you
map
that
into
the
the
policy
systems
in
kubernetes
right?
How
do
you
map
your
Active
Directory
into
a
an
our
back
policy?
That
is
reflecting
the
policy
that
that
is
supposed
to
be
in
that
Active
Directory.
And
how
do
you
do
that
when,
when
the
data
gets
federated
right,
I
think
that
is
an
interesting
thing
that
that
we
learn
from
the
NIST
folks?
B
B
Is
we
ingress
that
whole
data
and
then
we
throw
all
the
policies
away
and
we
assume
you
know
whoever
has
that
data
is
allowed
to
analyze
it,
otherwise
you
wouldn't
have
given
it
to
them
right,
but
it
would
be
interesting,
probably
to
be
able
to
say:
okay,
here's
my
complete
medical
record
and
if
you
won't
only
want
to
do
something
on,
you
know
addresses
of
people
that
go
to
a
clinic.
You
know
that
is
probably
something
that
that
some
analysts
can
do,
but
they
are
not
allowed
to
see.
G
C
Fun:
okay,
cool
one
thing
that
I've
sort
of
seen
and
just
as
a
consultant
for
the
last
couple
of
years,
the
company
I
worked
at.
We
were
really
big
proponents
of
this
idea
of
sort
of
agile
security
and
meaning
you're
building
in
security
concerns
and
tooling,
in
your
continuous
delivery
pipelines
and
security.
People
seem
to
like
that.
They
seem
to
you
know
if
we
can
provide
certain
guarantees
in
our
delivery
pipeline
can
be
move
faster,
and
you
know
some
of
the
smarter
put
some
of
the
more
hip
teams,
or
you
know
they
see
the
tooling.
C
They
see
the
logs,
we're
doing
it
every
single
time.
You
know
we
can
prove
that
before
anything
go
to
production.
It's
going
through
these
checks
cool.
You
know,
move
as
fast
as
you
want.
Basically,
access
is
a
little
bit
different
and
there's
always
that
one
security
person
who
doesn't
really
trust
the
tooling
as
much
because
there's
there
are,
you-
know,
code
pathways
potentially
that
won't
be
executed
until
that
one
time
and
those
tools
aren't
checking
all
of
your
clip
paths
right
and
so
access
control,
a
sort
of
in
a
similar
vein.
C
Where
there's,
unless
you're
checking
all
of
the
code
paths
of
your
entire
code
base,
you
don't
know,
what's
attempting
to
make
access
to
what,
because
those
things
may
not
be
executed
in
your
test,
environment
and
so
like.
The
idea
of
auditing
is
great,
but
there
may
be
incidents
that
don't
show
up
until
it's
been
in
production
for
four
or
five
years
right,
and
so
what
I
I've
kind
of
been
pondering
about
this
for
a
long
time,
it's
like
it
would
be
great.
Like
I
went
to
the
oppa,
you
know
discussions
as
well.
C
They
were
really
cool
if,
if
there's
a
common
language
that
describes
not
only
access
control
policies
but
policy
in
general,
the
idea
of
having
formal
proofs
actually
isn't
that,
like
it's
not
out
of
the
ordinary,
it's
not
out
of
the
realm
of
possibility
like
we
can
prove
that
before
you
ship.
This
thing
that
these
two
things
communicating
to
each
other.
All
the
paths
are
good.
H
Amazon
AWS
doing
formal
methods
on
their
access
control
policies
and
that
stuff
is,
is
working
intractable
and
that's
what
they
use
for.
So
many
people,
that's
on
their
s3,
buckets
that
their
access
permissions
are
not
what
they
think
they
probably
not,
what
they
meant
and
so
yeah.
So
those
things
are
definitely
possible
if
you've
got
the
right
kind
of
framework
and
you
thought
about
it
and
just
do
the
do
the
work.
It's
definitely
tractable.
B
A
Know
if
you
in
environments,
like
first
here,
for
example,
you
can
actually
set
as
a
matter
of
policy
who
you
can
talk
to
and
who
can
talk
to
you
right
and
if
you
can
specify
that
as
policy,
you
have
a
more
reasonable
guarantee
that
you
understand
the
nature
of
your
code,
because
you've
effectively
boiled
it
down
to
a
graph
that
you
can
show
on
a
wall
and
say
these
are
the
only
things.
I
know
how
to
talk
to
each
other.
A
So
sometimes
you
know,
depending
on
the
tooling
like
we,
you
know
these
things
all
work
together
to
kind
of
create
this.
This
against
secure
by
default
environment
I
like
the
idea
of
taking
a
set
of
language
and
really
figuring
that
out
to
see
if
we
could
do
formal
proofs.
I
I'd
like
to
understand
more
about
the
Amazon,
how
they
do
that
and
what
value
it
brings
and
so.
B
So
one
thing
that
we
do
at
Google:
we
have
some
policies.
When
that
gets
introduced,
we
can
run
that
in
log
only
mode
for
a
while,
so
you
can
actually
observe
what
would
happen
and
then
you
can
lock
it
down
later.
Based
on
that
observation,
that
obviously
makes
it
necessary
that
you
need
to
run
actual
workloads
against
that
policy
right.
So
the
thing
that
we,
our
perennial
fear,
is
this:
this
once
a
year
or
once
a
quarter,
let
some
financial
person
is
running
right.
A
Cool,
so
we
talked
about,
explain,
ability,
a
bunch
right
and
what
I
found
is.
It
generally
has
a
tension
between
Express
ability
right
and
then
one
of
the
things
I.
You
know
that
comes
up
a
lot
in
in
in
policy
stuff
is
well.
How
do
you
deal
with
with
composition
of
policy
right,
and
so
you
know,
is
one
of
the
questions
I
wanted
to
ask
in
the
in
the
opah
talk
where
it's
like
in
their
system.
If
you
have
multiple
layers
that
express
the
same
policy
right,
you
know
you
do
a
composition
model.
A
Those
composition
models
now
are
completely
ad
hoc
right
in
terms
of
of
some
people
do
inheritance.
If
you're
you
know
like
like
I,
am
some
people
use
like
networking
policies,
use
rule
numbers
right.
You
know
other
systems
have
full
override
capability,
so
you
know
the
policy
system
within
G
suite,
for
example,
you
can
do
full
fully
expressive
overrides
and
you
could
do
this
like
group
layering
on
top
of
it,
and
so
it
becomes.
A
You
know
difficult
for
operators
and
we
talked
about
the
personas
right,
we're
giving
them
all
different
ways
of
doing
this,
and
you
look
at
quota
quota
is
the
minimum
of
every
level.
Above
you
all
right,
if
you're
doing
hierarchical
quota
and
something
Krishna
we're
discussing
is
is
can
we
can
we
formalize
what
that
means
right.
A
So
you
know
I
think
just
as
a
general
thought
experiment
is.
Is
that
what
how
can
we
accommodate,
for
you
know,
kind
of
the
past
and
what's
there
and
also
be
able
to
formalize
it
and
say
this?
Is
the
model
and
therefore
I
can
express
it
in
something
like
that?
I
can
understand
that
this
is
how
it
works
and
and
whatnot,
and
then
be
able
to
give
an
attribute
to
it.
To
say
like
how
composable
is
things
or
you
know
what
not
and
and
and
whatnot.
So
that's
just
my
thought.
Experiment,
yeah.
I
Test
yeah,
yeah,
so
I
guess
one
of
the
goals
with
oppa
from
the
beginning
has
been
to
create
a
language
that
you
can
scale
or
grow.
Basically
right,
so
you
can
write
those
low
level
rules
that
that
are
referring
to
like
deeply
nested
values,
but
you
can
also
write
higher
level
rules
that
that
are
much
more
human
readable.
Now,
the
other
side
of
that
is
like
giving
people
full
expressiveness.
B
And
then
one
of
the
other
problems
that
we
see
now
is
the
Federation
aspect.
Right,
you
know,
almost
everybody
is
dealing
with
multiple
of
these
access
control
systems.
Read
at
your
own
company,
beat
at
the
various
cloud
providers
in
the
various
open
source
systems.
You
are
using
right.
If
you
run
in
my
sequel
inside
the
kubernetes,
you.
C
B
C
I
think
like
that
is
an
that
in
itself
is
an
exercise
that
people
don't
really
have
guidance,
how
to
do
like.
How
do
you,
how
do
you
document
IP
table
policy
without
dumping,
the
entire
thing
into
an
Excel
spreadsheet
right
and
there's
no
good
way
to
translate
even
the
current
set
of
systems
into
something
that
can
be
aggregated
and
understood
by
everyone
and
so
yeah
we're
introducing
new
systems
that
are
able
to
help
sort
of
alleviate
some
of
that
stress
in
new
systems.
But
what
about
the
stuff
that
we
already
have?
G
A
Mean
one
one
truth:
I
think
that
that
at
least
I
I
believe
is
that
every
system
that
comes
out
is
gonna
have
some
sort
of
policy
management
system
built
in
and
each
of
these
systems
is
needs
to
by
necessity,
generally
is
in
isolation
right,
so
you
can
run
my
sequel
on
bare
metal.
You
can
run
it
on
kubernetes.
You
can
run
it.
A
You
know
on
any
number
of
scenarios
and
it
can
be
run
standalone,
so
it
needs
its
own
policy
management
system
to
be
able
to
control
who
has
access
to
what
tables
and
and
what
data
meanwhile
might
be
combined
with
an
application
right,
and
so
these
things
are
composable
by,
unfortunately,
by
their
very
nature,
and
it
makes
it
difficult
to
do
like
a
one
size
fits
all.
So
we're
kind
of
in
the
game
of
making
these
things
talk
together.
Right
and
I.
A
A
What
the
you
know
how
the
policies
are
expressed
and
and
then
be
able
to
compare
in
their
environments
at
least
say:
okay,
I,
have
my
secret
of
this
I
have
this,
but
they
all
have
the
same
concepts,
and
so
therefore,
I
can
express
my
intent
and
I
expressed
my
intent
and
my
sequel.
By
doing
this
and
I
express
my
intent
in
kubernetes
by
doing
that,
right,
I
think
we
can
get
there.
That's
that's
a
journey
on
the
road
to
I,
think
a
more
Universal
system,
so
I
appreciate
that
comment
for
certain
and.
B
So
one
of
the
things
we
should
tell
people
is
how
you
can
find
us.
We
didn't
put
a
URL
here,
so
it's
the
safe
working
group
is
part
of
that
or
we
want
to
be
become
a
member
of
the
cloud
native
foundation.
We
are
on
github,
so
we
try
to
make
our
all
of
our
discussions
transparent.
We
post
our
weekly
meeting
notes
there.
We
are
starting
to
use
issues
on
github
to
start
discussion,
so
if
you're
interested
open
an
issue
on
there
and
and
start
to
talk
to
us,
thank
you.