Cloud Native Computing Foundation Security Special Interest Group, 8 Jul 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CNCF SIG-Security SIG Policy Team: Kubernetes Policy WG Meeting 2020 07 08

Description

CNCF SIG-Security SIG Policy Team: Kubernetes Policy WG Meeting 2020 07 08

A

Everyone it's Jim.

B

A

How are you Robert, hey hello,.

A

A

Check on slack, if Erica is able to join.

A

Alright I messaged Erika a lot, but maybe we can get started in the. Meanwhile, let me pull up the agenda item. So a few things I wanted to just do it so Jaya. There were a few more comments on the in the document, so we can quickly go through. Those I have also another PR submitted to add the selectors. So you you were looking for that feature right, so we can take a quick look at that and then see if there's anything else, to discuss that'll.

C

Be great, basically, you know we have been socializing this internally within Red Hat and there are some other use cases related to observability, where it made sense to you. You know, use it use the same CR so because I'm.

A

Ok, so yeah, let's go through that I'll pull up the proposal and.

A

Okay, so I think the first comment you, the recent one you had added, was on severity. Zoar categories right; well, no yeah.

C

So right now category is in the freeform section right and the request I got from one of the other days and then red hat is to make it more.

C

A well-defined schema element right so that, because anything, that's in the data is going to be free from so we really cannot count on it. So so the idea here is that I know you had a comment on you know. Then we will have to come up with the list of you know.

C

Whatever of this all right right, so yeah, yeah, I, think a couple of things that we thought about where some of them could be security related, the others could be health related like health checks and those were the to be came up with, but we could definitely come up with a few others based on our experience, so that was that was one of the so this way you know the idea here is that if the CR is generated, you know whoever is processing that information can filter out right, the ones that they care about. I.

C

A

So I think one question to think about is: is it still up to the engine that, in terms of what categories to define like say, for example, if this is a CIS benchmark report, would those categories potentially be different or are we defining some high-level categories and we want all reports to fall into those right, so yeah.

C

I think that it's the latter right, so what we were thinking is that we would define some high-level categories. Okay and I agree with you that you know we don't want to over over over architect this, and you know right. You find the next level categories and all that right, that'll become too much if you can put it at a higher, but we know that these kind of reports should be routed to say. Maybe a security operation center versus these kind of reports should be routed to incident management.

C

All right, that's that's the level we are thinking of right. Okay, all.

A

Right would it and is there a way to tie those into like something like we're talking about a or discussed at one point scoring and something like you know, the cbss system, so I don't know, I haven't researched this enough or looked at it deeply enough to know, but if there's some way or if there's some precedence in terms of what you know, what some standard category goods are, then it would be easier for us to say: okay, we're going to adopt that model right, I.

A

Think if you have to come up with some categories, the challenge always becomes. Did we make it extensible? Is this a string or is it a enum field where it's a fixed list and they'll all reports? You know kind of fall into one of one or more of these categories. So, let's you know, maybe if you want to propose proposal list, we can discuss and review and not sure if others like couple Robert, if you guys have any thoughts on this, how to manage a.

D

Little Kevlar for the data.

A

Yes, so the the what Jaya is and is proposing and I think we've discussed this before is making category top-level attribute so fixed attribute within the policy results, and you know having a set of I guess some well-defined categories which reports would fall into or or each result element would fall into, which makes it easier, I guess if you're searching or trying to scan the results externally.

A

D

We're adding metadata, it might also be useful to some sort of tool or vendor thing here, or some notion of names facing like the work, with a number of tools that do broad categorization with metadata and when I go to on-site installations. It ends up being most orgs end up doing customization to their own reflector under internal or Sanders.

D

And so, if we're adding it as a top-level tool, a tappable key to the metadata having a submission to be the names facing it or having an additional qualifier of vendor or tool of origin, helps sort of disambiguate a little bit.

A

Okay, yes, so we do have a you know like in the metadata at the top level of the report. There's does you know what.

C

A

Yeah we could put engine in there and, and certainly different engines can put, you know, put other metadata as required. I think the the additional question is in within the results for each element of the report, but then the results array should we have a well defined category and what would that list? Look like.

D

And just the the feedback from the other key right hat was with regards to the desire for having a top-level category was.

D

On the basis of like basically we're talking about moving out data to the top level and I'm just trying to describe the differential, if you go to index both we're just what's the what's, the differential value add.

C

Yeah, so this is yeah, so I think what we are saying is that if you obviously you know right now, the proposal is to put category within data right, but then whatever is in data, is all freeform. So we cannot count on being that I put in category as a top-level item.

C

Then the consumer of this data could then filter and route it to appropriate destinations, because I mean the whole point of generating this data is we want it to be actionable and we want to take some actions of it right and the actions could be taken by in certain management tools or using security operations center, or you know, depending upon what is emitting this alright. So having that category will help us route or filter out things that we need a process.

D

C

D

About that constrain the vocabulary constraint here, like at some level there you know having like, are we just concerned about being overly prescriptive when it could be an operational concern, it could be a cos cost concern could be a good security concern, I mean the and so category then becomes almost reformed on the value perspective and at ROI the indexing other fields in this and so I'm. Just it's a little bit fuzzy to me on, like I, understand what you're saying but I feel like we're.

D

Gonna have to be indexing, these fields anyways and there's also the concern around. What is the constraint vocabulary that actually makes sense.

A

Yeah that latter latter part, is what I'm concerned about too so I think there's two ways to approach right. One is we could still make category a top-level field within resource, but leave it as text which each engine could decide what categories it's you know creating or reporting. So that's slightly better than leaving it in data. Where there's data is you know, kind of optional and not structured like Jaya is pointing out the other option. Is we make categories sort of a strict set which I think yeah?

A

That would be a concern because, maybe not everything falls in that set unless again there's some standard. We can point to as a precedent. What about category.

D

Is a top-level field unconstrained text there also up and also optional right.

A

So that that could be the way to do it, and then maybe it satisfies both both perspectives, right we're for engines that want to have some categories and count on those. We know that, let's say, for example, if it's coming from Rackham that there will always be a category and Rackham can published a list of categories that it allocates or assigns to reports with something like that. Potentially work, juror I.

C

Think what you're saying is that will make category a movie to the top level, but then don't be prescriptive in what is put there as it was proposing right.

A

So making an attribute of Reese or sorry of results right, so each result will have a category attribute just like we have status and scored, and it will just be text, and it will say at least in this first release. Each engine will be responsible, for you know, managing its list of categories that it publishes results with.

C

That's a good middle ground and I think you know, maybe you know Bay then, based on our experience of applying this. You know we can. We can come back more prescriptive right.

A

C

A

And if we see some standards, sort of de facto approaches emerge right. We can adopt those and standardize on those, but yeah I think that at least gives you attribute to rely on versus not having anything defined in this schema. Yep.

C

A

Great Thanks, so let me make a note of that.

A

All right and then I think the other other comment was on the policy attribute.

A

If that could be a UUID so versus right now we have it as a string and in the examples we're showing you know, names right so so I think it should be possible to also convert to UUID to a string format and put that in there. So once again, it seems like this would be more of a concern for, depending on how your what which engine is reporting. If you choose to use you, you IDs, you can was there something that would prevent I guess using a UID in that policy field. Right now,.

C

That suggestion back and come back to you whether again, you know I'm looking at it from who what is consuming this right right, so I think the UID maybe is giving us a more more prescriptive than just it being a string. It could be anything any string right so.

A

Right so like when, when we were looking at other mappings like for, for example, for key VAR know, we were thinking of doing policy, name, slash, rule name in this field right. So in your example, if you want like a UUID and even then, if you want to append or have like a name to make it more readable, you can or if it's just a UID, that's fine too.

C

A

It'll convey to index back to like a rule or a policy element that created this result right, yeah.

C

Could we put some examples here like the example that you mentioned right, I think that'll help us, because then we can say you already have it here.

A

Yes, a year, it's just bought security, : checked. So it's like a there's two names appended with the : ear. Let me see if there's something else up here.

A

Yes, a year we have similar like API server and then so your this was like CIS benchmarks or it's the category and then the the actual rule or the check.

A

But then in metadata we have like the index right. So it's certainly possible. You could, you know even do : 1 dot, 2 dot, one in this first example. If you want to put the index in the name, so it's just reformed text over here.

C

C

Ok yeah: let's leave it as a string and let me take that back and see whether it's really really needed. Ok, ok,.

A

All right that sounds good.

C

And I think the other comment I heard was about execution count and exact execution count is already dropped. Yes,.

A

So I think I might have briefly mentioned that in the last meeting is so when, when I moved things over to the repo and to the CR, because you know the the timestamp in and that information is already in the resource metadata I removed both the creation, timestamp and the execution count, and if we need something like that, we can bring it back. But for now didn't seem like there was a specific need for that. But yeah anyone has any other thoughts or comments. We can decide.

A

Ok yeah, so there is, you know. One thing I want to do is at some point. We should just start. You know using the git repo for comments and PRS right. So maybe we will after this next set of changes, we can lock the document and just move things over to the git repos, because it'll just be easier to track and comment only change and things like that and I. Think there's a few.

A

You know one issue: it's I just submitted a PR yesterday for the resource, scope and selectors I, don't know if anybody knows of a good way to generate documentation. Out of this, the open, API schema or the go tags but looks like coop builder had some facilities, but they no longer work. So you know, if there's a good way to generate Docs, that's something we need to do so. We can review each field and and the data easily and then I think we're waiting on additional samples like we've talked about right.

A

So if there's anyone has samples to submit that would be good to create PR zon as well, and we can make sure that they, you know we can test them quickly with the CR. So currently you can, you can install the CR. You can create a yeah mol that matches that CR and you know see what that looks like. So that's probably the easiest way to try things out.

C

So Jim is the next step to take this I know: I was not there in that Sagat meeting I assumed you and Erica went and presented this there. Is that correct? We.

A

Did briefly talk about it and you know at least socialize the idea so I think what we want to do. First, though, is show more examples and then also propose how we write like perhaps adapters for or show that you know different engines are using this. So one of the you know on governo we will, you know start so. We currently have a CR for policy violations and Carano which we're going to replace with this policy report and produce these reports.

A

So we'll work on that and then, if there's some like another potential adapter we had targeted was using something like gube bench right for CIS reports, I think once we have some some examples of that, we can go back to say Garten in a show that there's actual usage and ways of adapting different reports and what that looks like, and we can also work with I think there's a list of other projects we had listed in the document as potential for using this I.

B

Did reach out to the steerer folks and I'll, see if I can get engage with them to get some feedback yeah.

E

I would like to see how we can look at gatekeeper, maybe I'm, one of the maintainer zone. Gatekeeper I, did comment in the doc as well, thanks for driving this by the way.

A

Sure yeah, so definitely you know that would be great I.

E

I did have some I guess questions around I know. You replied to my comments regarding you know. Writing violations of CRS.

C

E

We we actually had a community like what, in last week's gay keeper call, we actually went through all the options in terms of, like you know, usability versus scalability versus security. All of these type of concerns with our current implementation for writing.

C

E

To OCR versus you know, kubernetes events versus you know, someone even suggest so like. Oh, what, if you just expose an endpoint for people to like right, so I created like a table that looks at all the options and I kind of want to make sure we sync you know either here or another call whatever makes sense just so that we can kind of look at. You know this proposal, your your you're looking at it is very much still writing to accustom resource right and I.

E

Think based on the usage that we're seeing and the comments from people at least from gatekeepers current implementation is not. Us is not really scalable for large clusters, so I want to make sure we touch point on that and and and make sure whatever it is in. This proposal addresses that concern as well right.

A

Yes, so one the evolution of this I think you know from some of the early discussions and we've been through in Prior meetings, a lot of those same options and discussions on what would work best and looking at whether it's you know, events of course and I think there's some commentary in in this document here on the pros and cons.

A

Looking at things like creating custom resources and what we had sort of settled towards Ori Walter words was trying to make sure that year the reporting was reflecting current state for admins right. So we were not not focused so much on any history or historical state, because the thinking was that could be done outside the cluster and it's best done outside the cluster.

A

You know, although again we're not mandating one way or another and then the evolution of this initially, if you recall this started out with just reporting violations and that's what, for example, cubano does today it reports violations at you, know the policy rule level so for each rule and object, there's a violation CR, and that has some pros and cons tier right.

A

So here what we wall towards is allowing the flexibility of aggregating weather and allowing that also the flexibility for each engine to decide whether it's just violations, whether it's violations and a success summary or you know some other level of detail and at what scope and granularity they report. So there's a lot of flexibility, but it's more or less left up to each policy engine to decide what works best and that's you know, I guess.

A

If you're trying to build a common structure seems like that would be the the most I guess agreeable option overall but yeah. At the same time, of course, you know one. This could also be used in a manner where there is still one violation created per per policy rule and per resource which, like you mentioned, could lead to scaling problems.

A

So that's where there would have to be some intelligence in the engine to make sure that if there's grouping done, let's say for at a namespace level or if it's something related to the cluster, it could be at the node level or even just a control, plane and notes.

A

Things like that, so yeah I think what we wanted to make sure is: there's enough flexibility to slice and dice this in many different ways and then leave it up to the engine to determine what's the best way to report results and focus more or less on current results, not so much on history, but would love to see you mentioned like the comparison table, and perhaps if you want to even you know if we could want to put that in here or link from this document, and then we can discuss yeah.

E

We can definitely do that I again, I I did take a look at the agenda. I didn't see a lot of other topics. So if you know my I push you at.

C

E

Right now, if they.

C

Don't give your time.

E

Permits, okay, cool! Let me just oh I cannot start sharing.

E

All right, um can you see my screen? Let me know if you can see my.

A

Yes, we can't now: okay.

E

Cool um again, this is learning. This is basically learning from running gatekeeper and getting user feedback right. So definitely this may not apply to other projects, but I think some of these use cases and concerns might be applicable as well right. So currently we have two approaches in terms of reporting violations. So, as you can see, currently we write the violations to the chill constrained and gatekeeper is the you can think of them as a pop, a policy right and in it.

E

So let's focus on in a large cluster scenario right, so let's say you have a constraint that looks at you know: do you have resource limits on your pod right and let's say your cluster has like thousands and thousands of pots and they're all violating so this you know, status of resource could grow quite quite quite fast right and then so what that means is essentially, if you use this approach in your cluster in a large cluster, you could run into that sed.

E

One megabyte object limit, not only that you know this could also have a huge impact on the API server, because you know you're basically,.

E

You're, basically, writing updating the policy depending on the number of policies you. The cluster, has violations for right and I think this is probably the closest to what your what the proposal for policy reporting looks. Like, though I understand you know it does have the flexibility of allowing the policy engine to decide how you want to basically shard the updating, see our process right, whether that's by you know, like you, said, namespace or GVK right group version kind.

E

You could you can slice it up in a different way to reduce that impact right, but even even with that, you know there that that su an object, women, it can still be pretty- can still be there right and the other the. So we so forget keeper project. We came up with another approach which basically writes all the violations for both a mission time, and you know audit to write the violations to the gatekeeper logs and that approach does not run into these limitations because we're writing to the log.

E

However, you know that will require the consuming solution to basically parse the log right and then there's. Of course, they Cuba Nettie's events. We really like this approach in this is something we're working on now. What we like about it is is the fact that you know by default, kubernetes will remove these events right.

E

The the default ETL is one hour, and the impact on the API server is the number of violating resources, and you know the fact that it doesn't have cluster space cannot associate cluster scoped violating resources that can be mitigated by associating this event object to a resource, in, like say, a J keeper system namespace.

E

So we think this is actually quite nice because we can leverage a native kubernetes object and the fact that it has a tto a actually. We can ensure that these objects will get cleaned up and it is kind of similar to the policy reporting report proposal because, like you said earlier, it it's only looking at the current state of things rather than a historical record of every violations ever right and some of the other options that were considered.

E

You know a new violation resource, so another CR and then of course like another in point and that allows users to query. But that will that will require em, tell us and just a lot more work to make sure this is actually in production, ready, I, guess I, just kind of want to briefly go through this, and and did you guys, have any questions or thoughts.

A

Thank you for sharing this. This is a really good summary and touches on a lot of things that we have discussed either in some of the document comments or in Prior meetings and sessions.

C

A

Just thought and would love to hear from others as well, but I think the way we were approaching this as events, it's not so much as whether you would want events and a resource, but it's almost like most engines will end up doing both right because events.

C

A

Necessary and they seem to be solving different different goals. One.

C

A

To give the cluster admin some state which they can easily in a collect, through tools like Google, etc, to see what's going on with policies or polish policy engines they may have configured, whereas others are, if you're looking at a something like a part or a deployment. Obviously you want to see events on that to say maybe there's some violations etc.

A

All right, so we were not thinking of that as either or or our solving the same goal, but the fact that most engines, you know to be used in production systems, would report events kubernetes events, which is like you mentioned a great mechanism for what events are meant for, but it didn't seem to be solving. At least you know the goals of what we were thinking for. The policy report.

E

So and so I think for the purpose of consolidating and ensuring that all the projects have the same I guess spec or AP is: do you envision that something like a keeper will then create these new CRS based on the proposal.

A

So that's one option where, if some you know policy engines or tools like gatekeeper, natively create the reports and that's what we were thinking of doing for keyboard know for other tools. Perhaps you know the other way of doing this would be to write adapters which are consuming like say, for example, for Falco or cube bench. Those could have adapted which just produce reports or maybe over time. They also have native features to generate these reports.

A

I think there was lizard, also added some comments, for you know a project they were working on bird. There was interest in also standardizing on the way of reporting, so maybe with that project you know also policy reports would become native over time.

E

Okay, yeah, that's helpful. I still think you know the scalability concerns with, and you know the impact on. Icu is still one thought you know. I would still go back and think about. How do I litigate that yeah, yes,.

A

I would love to you know, get someone one thing: I do want to mention and sorry, Robert I think you were also meant trying to mention something the one, so you from you know from the rack'em team and also suggested, and we just updated the document and as well as submitted a PR, for this is adding selectors for so in your example like, let's say, if you have thousands of pods, if there's a way to group these pods based on labels, so right you.

C

A

Option would be in a result element or even at the scope level. Instead of you know, naming an object or referring to it by GVK or something similar. You could then use a label selector to group several objects, maybe hundreds of pods, if it makes sense so I think there so again, if there's other ideas for how we can add that level of flexibility to be more concise in the reporting but point to a larger set of objects.

A

The other thing that one of the options problems we run into you're like what caverno is given also does background scans right, so it will periodically scan the entire cluster and there, of course it's not just you know at one point, it was picking up on even pods that were not being scheduled, not that were failing, but for those sort of things of course, then that you know the engine would have to. You know, manage the state and make sure that it's not reporting on objects which are not active but I totally understand.

A

You know the concern and I think it'd be good to see if there's some other ways to make the report scalable by pointing to a set of objects. It's a label. Selectors was another option that we recently added and just to help address that.

E

Yeah so so that's the size limit for SCD objects. So basically you know that's a constraint of I, guess a CD, and so when we think about you know any of the kubernetes objects or CCR's they they all, basically as the size of the object. Gross you're gonna eventually hit that one, so 1, 1, megabyte size limit and I can find a link to that. If it helps where the docs says that if it helps.

B

So it's not a limiting the number of objects. It's just that amount of data encapsulated.

E

Right so there's size limit per object, but I believe there's also a limit for sed as well.

E

A

E

Translate to number of objects. Yes right. There.

A

Are limits for both you're right, like I, think it's 1.5 or something like to that one megabyte order per object and then there's some other limits for the total number of objects, etc.

B

E

Just linked it to the docs I.

B

Would have thought that other projects wouldn't fit yeah tens of thousands, if not hundreds of thousands of objects.

E

Yeah I think that's why the recommendation is to keep the object small right at this. If you search for like config Maps I, think there was a issue in kubernetes weibo, where someone says like how big could my config map object be, and it was also linked to this size limit for sed.

E

And by the way already had that limited when we do like large clusters like Lotus, so we're already seeing the errors.

A

Okay, so I think I'm that scalability this you know it would be good to see as we look at different examples to really test out the flexibility of the reporting, and if we can, you know make it find that right balance, but for based on either namespaces workloads or other levels of grouping. You know for some of these common common type of policies and reporting that we want to do if there's any other ideas.

A

Yeah, let's you know. Definitely we can expose our on slack or you know just like either through get or even just comments on the document.

A

All right so I did see Christophe you had added. You know an item to the agenda, so I want to make sure we have some time to cover that.

F

Yes, hello, everyone, so, first for those of you who may not know me, I want to introduce myself. My name is Christoph Blocher and I am a member of the ready steering committee, um so I wanted to come and introduce myself and quickly speak about a newer initiative that the kubernetes during committee is is undertaking with annual reports from our various community groups. The goal of this is, we are noticing, across the community kind of an evolution of just like how information is moving throughout the community.

F

When we look back, you know over the last, like five years, six years or so we in the early days of kubernetes, we had a third, they community call that, but most people in the community would end up joining and and things and working groups and stuff would would be giving rotate or reports. In that particular meeting.

F

However, we used to have those. Every week we've moved monthly and as far as like presentations, Matco stuff, we're now up to 50-plus different community groups when you take into account SIG's working groups, user groups etc. So trying to get reports in that fashion, just isn't, isn't edible.

F

So we are trying to do this kind of way more, like decentralized manner, that all the various community groups can submit reports and these are been visible and and and we can increase that kind of communication between the various things and working groups that we have if I can share my screen briefly,.

F

So an email went out yesterday to ke dev. That kind of explained some of this. We are starting with working groups this year in 2020, and the reason we're focusing on working groups is working. Groups are in particular a group that requires lots of cross communication between different things in that cosa, because by the nature of working groups they are.

F

They have many stakeholders themselves, so we're trialing us with the working groups in 2020 to ensure that we kind of have a picture, and we have like clear communication on what all of our working groups are working on and really asking. The question: like: are our various community groups in working groups? Are they healthy? Are they following best practices as far as like holding meetings on regular basis, recording them putting them on YouTube?

F

Do you have an open mailing list, just kind of going going down that bat checklist?

F

The I've also included links to these in the agenda, so so folks can kind of pull these up and read them on their own, so the scroll down to the questions. So these are the kind of pieces of information that we're looking to get from all of our various working groups. Things like yeah or your owners files up to date are your sub projects.

F

Matt, you know, are your these are meeting times it's like the list of meeting time, which is something that I actually found with with the policy working group like you're listed meeting times and such are not up to date in the community repo. So it could be hard to find and encourage people to to come to meeting.

F

If there's, you know still things that need to get updated as far as your your times and who the organizers are, and things like that, so the reason I am in particular, coming onto to the policy working group is because I've been assigned as the liaison from steering to this particular working group, so I'm just kind of your friendly point of contact as far as working with you to get this report done, because we know like the nature of 2020 right now, there's a lot of things going on we're not setting like specific, like a specific deadline of when this needs to be done.

F

By is something that we want to kind of work with. The the folks that are involved in the working group to get it done. I'm, but, like my kind of like vision, would be sometime in the next couple months that that we can collaborate together go through and get they go through this annual report process and then kind of gather any feedback of like. Was it useful and do you find like after we collect this working because they're very annual reports that we kind of see some action from them?

F

Like the you know, if there is ways that either the community can help you or you can help the community that we see, those kind of things happen.

F

Yeah I guess I wondering if there's any questions.

B

One specific question I think the this document that you're looking at I think it was linked in either the email us anyway I was it I was trying to get to the list of questions and I access. So then I can follow up with you later and find out. If that's something on my end, this.

F

Document is in the community repos like I've, also linked it in in the meeting minutes. Let's this one and redirect to our community repo. So.

C

There's a public.

F

Open source, so anybody can see this there's no authentication or anything for that. Okay,.

B

There was there was one thing, but it said that we, like click here, the list list of questions and then I clicked it, and it said there was a Google Doc and I didn't have permission. So, oh, oh, maybe I'll follow up with you and see if that's even necessary, but overall yeah I applaud the idea. I think it's good to collect it. I would say that hopefully it's a data once collected is consumable and and easy to analyze. I guess when everything when I was a hammer, a DevOps amer everything looks like DevOps.

B

If it was somehow codified, you know scripted and available in some reap repo or data source, or something that we could slice and dice. That would be cool.

F

Yeah, all of these all of the annual reports once they're like finalized, will be like openly published. There is so there are some sections in here we're like we offer the opportunity for chairs and organizers, like you know, to basically to come with us with things that might be sensitive, and this you know. If there's you know, if there are problems like because, oh you know, there's a bunch of questions in here, but the key thing that we're trying to get a kurma from a steering committee perspective is.

F

Is the group healthy and that question can mean lots of different things? It can mean yeah. Are you meeting on a regular basis when people come with new ideas? Is there like an openness to them?

F

It can mean that there isn't, like you, know, weird dynamic between either the people or the companies that are involved in a particular community group. We want to know if things are healthy, and sometimes you know at least initially there might be things where you're we're, like you know,.

C

F

The working person saying like no we're not healthy and here's the reason, and maybe we want to be a little bit more, a frank and blunt about what's actually going on than something we want to initially publish publicly.

F

So we do offer like there is like kind of a private review period or for these annual reports, but once they're finalized and any private information is like, you know, removed or or sanitized in a way that, like everybody, including like the working group and steering, feels it's like ready to go public, then we will be publishing these publicly so that exam, the entire community kind of consume.

F

That information and we're also trying to like that they email the parrot sent kind of goes into some of the gold, but like when one of the things that I am also like I'm personally, like really passionate about, is connecting connecting positives as well like not just the negatives like we do want to know if a group is unhealthy, but we also want to figure out like if something that a group is doing really well is really working for them. Is there a way that we can either like make that a best practice?

F

If we can share that information with, like another community group or working group that isn't so healthy and that kind of a cross-pollination of information between them, as well as just the raw like? What are you working on and.

C

F

Sure that everybody knows what what the various groups are working on and if they need. Oh.

A

This is good, thank you and yes, certainly happy to help and we can work with Erica and Howard also to help fill in some of this yeah.

F

So yeah this this was just kind of like an initial introduction and discussion. I will be following up with some more like directed emails to to mailing list and towards the organizers and chairs and such to kind of get the ball rolling on this.

F

But in the meantime, if there's any like questions or comments or that kind of stuff you have, you have a face and a name like you can come and contact me and I can kind of help answer or like direct those questions to the right role and in generally, even outside of this particular process. I, am your liaison I?

F

Don't make decisions on behalf of the steering committee, but I am kind of like a communication conduit that like if you need something from the community as a whole or from the steering committee specifically I, am a person that you can kind of come and talk to and I can point you in the right direction. As far as any of those kind of wider governance issues, or you know, resourcing issues of touch.

A

All right, fantastic! Thank you.

F

Dave, thank you. Ron, okay,.

A

Any other items of things we should discuss today.

A

Doesn't seem so so thank you, everyone so I will make updates. You know based on what we discussed for the categories you, if you can, you know, take a look at the PR on the selectors and I see if that addresses. You know what you were looking for or if there's anything else to be done and we can get that merged and.

C

A

You know, let's reach out, there's any other ideas on the scalability. We would love to discuss and we'll follow up on that as well.

E

Okay, I'm going through the dark again to look for the namespace leichter thing: you're talking about Thanks, okay,.

C

E

Ping you, if I'm any caution, Thanks and I, think Jim.

C

You would like all parties to post examples there right. Yes,.

A

Yes, so just please create PRS with some samples, and you know, because that will help us firm up the structure and you know also, if we can start you know so just you can just create a PR directly on the git repo yeah and if there's anything else that comes up that we feel we need in the reports we can. You know that will help flush that out.

A

All right, well, thanks. Everyone thank.

E

A

A