►
From YouTube: OpenShift Commons Briefing #123: Network Security with OpenShift and Tigera CNX Amita Gupta
Description
Implementing Enterprise-grade Network Security with OpenShift and Tigera CNX with Amit Gupta (Tigera).
In an earlier Commons webinar, we described Tigera's open source Project Calico, and how it enables simplified networking with secure network policies. Amit Gupta will expand on that topic today with an exploration of the additional features enabled by Tigera's flagship CNX product, and a preview of capabilities in the forthcoming 2.1 release, including even closer integration with OpenShift.
Amit will cover practical workflows demanded by enterprises including meeting compliance requirements for network isolation with auditing, monitoring and alerting. He will also talk about how CNX enables multiple teams (e.g. security, network and development/ops) to easily and collaboratively define hierarchical security policies with role-based access controls and graphical management of policies (at last, yaml is purely optional!), and will draw from examples of real-world users adopting both CNX and OpenShift.
A
Good
morning,
everybody
and
welcome
again
to
another
openshift
Commons
briefing.
Today
we
have
some
of
our
friends
from
tech
era,
other
comments,
members
and
they
previously
did
an
older
demo,
which
they'll
probably
talk
about
a
little
bit
before
and
the
briefing.
But
this
is
an
update
on
what
they're
doing
with
their
enterprise
grade
network
security,
token,
ships
in
fact
era,
CNX
they're,
offering
so
I'm
going
to
let
them
introduce
themselves
and
their
topic.
A
B
Thanks
time
welcome,
everybody
today
is
stopping,
for
this
briefing
is
implementing
Enterprise
green
network
security
with
OpenShift
and
Tiger
hacia
neck
switches,
our
commercial,
offering
my
name
is
Dakota.
Vice
president
of
product
management,
I'll
be
co-presenting
today's
session,
with
cutting
cutting
provocateurs
director
of
first
solution
or
corrected
topic.
Yes,
I
love
today's
agenda.
What
we
want
to
cover
today
is
we
want
to
walk
through
with
you.
A
couple
of
trends
that
we
are
seeing
with
our
users
in
the
market.
B
So
we
want
to
cover
today
I'll
jump
right
into
the
discussion,
to
give
an
example
of
how
some
of
the
trends
that
are
that
we
are
seeing
in
application
development
and
also
deployment.
So
if
you
look
at
today
how
applications
are
build,
this
little
more,
those
big
large
monolithic
applications
that
are
filled
with
a
couple
of
libraries.
In
fact,
what
we
see
today
is
a
set
of
micros
looky
couple
together
around
well-defined
API
contracts.
B
We
also
look
at
these
applications
and
then
we'll
deployed
a
stateful
large
multi
virtual
machines,
but
these
are
small,
stateless
containers
that
are
deployed
in
an
automated
fashion
to
deployment
automation
through
their
CI
CD
pipeline.
So
when
a
w
projects
in
a
code
takes
few
seconds
for
their
actual
code
to
get
deployed
into
their
production
infrastructure
automated
through
their
pipeline
and
more
obviously,
to
these
dynamic
orchestration
tools
and
last
but
not
least,
these
applications
they're
not
anymore
deployed
in
what
we
call
as
a
dedicated
application,
siloed
infrastructure.
In
fact
Aegis.
B
These
are
hosted
on
a
fairly
lasting,
fairly
seamless,
Arliss
infrastructure.
That
being
made
us
go
across
your
data
center
boundaries.
So
what
does
this
implicate
when
it
comes
to
your
underlying
network
architecture
and
how
you
secure
these
applications?
So
fundamentally,
the
fact
that
you
have
broken
down
your
application
into
small
micro
services
in
a
very
large
monolithic
application
is
now
split
across
many
many
different
micro
services.
B
So,
fundamentally,
your
work
load
count
has
significantly
increased
now,
also
because
these
are
the
issues
are
fairly
transient
like
if
you
compare
it
in
normal
virtual
machine
based
application
will
be
around
for
50
200
days
where,
before
there
is
recycle
with
it
included.
When
you
compare
that
to
what
the
data
says
about
continuous
applications,
those
are
around
just
for
a
day
or
two
on
an
average.
So
in
that
model
it
poses
a
significant
strain
in
your
underlying
networking
architecture
and
how
you
secure
these
applications.
B
These
people
do,
you
have
10
times
more
recluse
means
you
have
a
bigger
attack
surface
that
you
need
to
secure,
also
because
all
these
workloads
are
so
transient
and
they're
constantly
changing,
which
means
that
your
underlying
network
infrastructure
goes
through
a
significant
churn
as
compared
to
what
you
may
have
been
dealing
with
in
your
legacy
applications.
So
what
we're
going
to
do
today
is
we're
going
to
focus
on
both
these
aspects
going
forward
for
rest
of
the
session.
B
Now,
as
we
think
about
a
solution
for
these
two
broad
problems,
a
lot
of
feedback
that
we
have
received
from
our
users
is
around
gluten
on
few
areas.
One
is
as
they
think
of
a
solution.
It
has
to
work
with
the
radius
organizational
boundaries
they
have.
What
I
mean
by
that
is
just
because
you
have
changed
the
application
architecture
at
the
fact
that
you
have
new
means
on
your
network
infrastructure
doesn't
mean
that
the
separation
of
duties
that
you
have
in
your
organization
is
going
to
change
and
go
into
different
organizations.
B
If
global
corporate
security
teams
are
still
required
to
manage
a
broad
security
rules
that
need
to
be
applied
to
each
of
these
applications.
At
the
same
time,
the
use
of
the
application
owners
or
operators
of
that
application
notice
what
the
network
topology
for
their
application
is
and
how
those
should
be
set
up.
So
the
solution
has
to
honors
these
set
up
penalties.
B
The
second
aspect
there
is,
while
your
application
and
the
federal
micro
services
are
truly
cloud
native,
it's
very
likely
that
rest
of
the
infrastructure
and
resume
applications
that
these
micro
services,
how
to
are
not
in
which
case
is
looking
at
a
employment
model
where
these
micro
services
need
to
talk
to
your
data
services.
Your
log
aggregation
systems,
your
API
gateways,
fundamentally,
the
solution
that
you're
gonna
put
in
place
for
securing
these
applications
got
a
word
affair,
all
Maul
factor,
because
the
world
is
not
as
homogeneous
as
they
would
like
it
to
be.
B
The
first
aspect
that
we
hear
from
our
users
is
around
making
sure
that
the
security
architecture
and
implementation
approach
is
operationally
simple,
there's
a
lot
of
complexity.
That
only
exists
in
these
that
the
prices
of
these
deployments
and
when
it
comes
to
managing
security
for
these
modern
applications
in
conjunction
with
these
legacy,
applications.
B
It
is
very
critical
that
you
make
it
work
with
previous
different
forms,
such
as
a
structure
both
for
your
new
modern
applications,
but
also
your
legacy
infrastructure.
The
acid
work
where
the
videos
are
back
models
with
invidious
organizational
boundaries
and
the
separation
of
beauty,
is
that
your
organisation
may
have
set
a
design,
obvious
compliance
regulations
and
so
on.
So
those
are
the
key
themes
of
it.
B
Let's
jump
into
each
of
these
aspects
to
see
the
trust
are
very
basically
describe
the
philosophy
around
this
model
is
that
you
protect
your
applications
that
if
they
are
all
sitting
on
public
internet,
but
what
I
mean
by
that
is
it's
very
likely
that
almost
all
of
you
guys
have
advanced
persistent
threats
in
your
environments
or
various
malware,
sophisticated
malware.
There
are
lurking
inside
your
network,
and
if
that
is
indeed
the
case,
then
you
design
in
a
security
model
that
essentially
requires
identification
from
multiple
sources,
enforcement
of
policy
and
security
and
radius
different
locations.
B
We
prescribe
a
four
prong
approach
to
zero
test
model.
So
what
is
authentication?
Second,
authorization,
encryption
and
inspection.
So
when
consumed
authentication
assuming
you
have
these
threads
lurking
around
in
your
environment,
when
you
trust
or
would
you
believe
it
workload,
asserting
a
certain
IP
address
and
building
your
security
around
just
that
Network
identity?
B
The
first
aspect
is
definitely
white
list
everything,
so,
by
definition,
is
denying
all
access
and
then,
through
intent,
based
deliberative
rules,
you
define
which
application
is
allowed
to
talk
to
what
and
as
if
you
find
these
whitelist
rules.
Obviously,
we
gonna
validate
identity
based
on
both
networks
and
cryptographic
identities,
but
they
also
enforce
these
whitelist
rules,
because
a
multiple
enforcement
points,
and
specifically
those
are
one
at
the
edge
of
your
application
at
the
edge
of
your
pod
and
also
the
edge
of
the
host.
B
So
in
that
model,
where
you
have
enforcement,
at
least
in
different
layers,
you
have
a
fairly
comprehensive
security
for
your
applications.
The
third
aspect
is
encrypting
everything,
so,
while
the
payloads
are
encrypted,
which
means
that
you
really
don't
have
to
make
any
assumptions
on
the
underlying
network
now,
what
this
does
is
you
have
either
completely
mediated
or
minimize
the
attack
surface.
The
new
attack
surface
that
you
had
generated
by
creating
more
these
micro
services
of
these
10x
workers.
We
talked
about
earlier.
B
You
also
get
these
different
components,
rules
check
mark,
because
now
you
have
proper
segmentation
on
your
verticals.
You
have
encryption
in
place.
You
are
constantly
monitoring
that
and
you
have
also
eliminated
any
kind
of
sophisticated,
complex
internal
and
external
threats
in
your
in
water,
so
the
critical
aspect
of
our
security
model
across
these
pieces.
B
The
second
aspect
is
around
ear,
multi-cloud
and
legacy
infrastructure.
So
that's
something
about
more
than
likely
or
applications
of
these
micro
services.
They're
talking
to
various
different
resources
in
your
infrastructure,
whether
they
are
sending
logs
to
a
log
aggregation
system,
they're
talking
to
api
gateway,
they
have
corporate
data,
centers
that
stores
whole
bunch
of
shared
services,
and
it's
very,
very
common
to
not
implement
a
vibrating
security
model
across
these
disparate
systems,
because
it
is
so
hard
to
do
that
when
you
are
dealing
with
security
in
different
models.
B
I
can't
these
different
systems
and
that's
fundamentally
what
we
solve
with
tiger
rusty
and
egg
switches.
We
provide
a
a
unified,
consistent
policy
enforcement
model
that
works
across
your
effort
in
its
infrastructures,
whether
these
resources
or
windless
running
as
parts
or
virtual
machines
are
even
bare
metal
infrastructure.
You
get
everything
with
security
implementation
model,
whereas
across
various
different
infrastructure,
then
you
can
enforce
a
common
security
model
across
these
various
different
workloads.
B
The
third
aspect
is
around:
how
do
you
actually
enforce
your
your
organizational
model
and
was
it
designed
this
security
architecture?
How
do
you
actually
operationalize
the
security
architecture
expert
here?
Your
your
control
and
compliance
policies
to
a
couple
of
key
capabilities
that
Tiger
Phoenix
offers
is
the
ability
to
define
role
based
access
control
around
who
can
define
what
security
policies
a
very
simple
example.
B
All
this
stuff
is
also
available
through
a
very
comprehensive
audit
mechanism.
From
each
of
these
policies,
you
can
set
up
various
different
audit
logs.
You
can
set
up
treacherous
pillars
that
allow
you
to
integrate
any
policy
violations
or
compliance
issues
directly
into
your
security
were
close
to.
The
key
aspect.
Here
is
that
you
leverage
your
existing
organizational
model
to
enforce
these
policies,
integrate
with
your
existing
workflows.
B
If
you
want
to
send
some
of
these
pillars
and
other
data
to
your
security
operation,
centers
or
not,
every
issue
system
that
is
seamlessly
integrated,
we
we
manage
a
detailed
time
series
data
for
various
metrics
that
we
are
collecting
from
your
workloads
and
again,
all
those
memories
could
be
integrated
with
your
pennant
winning
system.
So
you
can
profile
the
network
traffic.
You
can
look
for
legitimate
englishmen,
traffic.
You
can
look
for
anomalies,
indicators
or
compromise,
and,
as
you
discover
or
uncover
those
aspects
it
it
could
be
integrated
in
your
incident
response
workers.
B
The
more
that,
in
terms
of
the
security
architecture
we
talked
about,
can
also
be
very
seamlessly
operationalized
into
your
existing
security
infrastructure
at
work.
The
last
piece
wrap
around
this
set
of
difficulties
is
around
the
networking
architecture.
So,
whatever
key
aspects
of
a
theater
security
model,
is
you
bring
down
the
complexity
that
you
have
at
the
traditional
hierarchical
enterprise
networks?
B
We
provide
a
flat
IP
networking
model
with
the
with
the
capabilities
around
like
listening
to
traffic
and
managing
fine-grain
security.
On
top
of
that,
keeping
is
very
seamless
for
us,
our
regions
to
manage
their
service
level
objectives
or
even
their
resumes.
They
need
to
meet
from
each
of
these
applications.
B
Today,
I'm
not
going
to
go
through
a
whole
bunch
of
architecture
details,
but
a
couple
of
things
that
I
do
want
to
call
out.
The
ceiling
solution
is
built
on
top
of
various
open
source
projects,
including
obviously
our
flagship
project
capital
and
making
it
some
of
the
core
capabilities
from
sto
into
this
architecture.
That's
how
the
solution
comes
together
beyond
some
of
these
core
capabilities.
We
believe
we
also
have
a
very
better
together
story
with
OpenShift
at
the
line
platform.
So
is
the
most
recent
release
of
Felix.
To
that
one
that's
coming
out
shortly.
B
We
have
done
a
much
more
simple
installation
process,
so
you
can
actually
use
OpenShift
and
cebu
to
go
ahead
and
install
c
NX
in
your
environment.
We've
done
WOD
integration.
So
from
a
login
experience
perspective,
it
is
truly
seamless
for
OpenShift
users.
We
also
extend
them
OpenShift
api
server,
so
you
can
use
the
command
line
to
apply
any
kind
of
cnxn
figuration
and
manages
those
rules,
and
then
last
but
not
least,
this
is
offered
as
a
supportive
solution
for
our
users,
for
both
the
tiger
ax
and
Red
Hat.
B
So,
let's
look
at
a
quick
summary
of
how
each
of
these
capabilities
line
up
so
obviously,
as
we
opportunity
user,
there
are
some
things
that
capabilities
that
are
available
out
of
the
box.
So
you
get
the
cni
networking
you
get
the
covetous
Network
policy.
If
the
idea
presentation
with
a
calico,
which
is
our
open
source
project,
you
get
some
additional
capabilities
on
top
of
that,
so
you
can
now
to
direct
infrastructure
peering
without
setting
up
any
kind
of
or
limit
one.
B
So
you
get
that
flat,
IP
network,
you
also
get
a
advanced
Network
policy
model
which
is
out
of
calico,
so
that
gives
you
capabilities
for
additional
protocols,
any
kind
of
negative
matches
you
pose
protection
along
with
that
global
policies.
We
also
have
capabilities
that
we
recently
added
and
our
network
sense
for
implementing
rules
for
traffic
going
in
and
out
of
those
resources
that
are
not
necessarily
running
out
of
a
chip
and
then,
last
but
not
least,
we
have
recently
added
application
layer
policies.
B
Now,
when
you,
when
you
look
at
on
top
of
that,
what
Phoenix
offers
in
conjunction
with
open
so
as
I
talked
about
the
separation
of
duties
of
the
reefs,
are
bad
control
policies
for
that's
aligned
with
your
organization
model,
so
you
can
have
your
global
security
organization
with
my
policy,
you
can't
have
your
cluster
operators
decline
policy
and
you
can
have
your
own
happier.
Allocation
developer,
manage
fine-grain
control
of
their
applications,
and
all
of
that
will
work
seamlessly
with
when
you
propose
to
find
it
online.
B
We
also
offer
capabilities
around
federating
your
workloads
across
cluster
boundaries.
So
what
this
allows
you
to
do
is
if
you
have
distributed
applications
or
common
services
that
are
leveraged
across
cloud
across
cluster
boundaries,
you
could
even
configure
that
and
manage
that
Christian
X,
as
I
mentioned,
there's
a
avidians
instead
of
mainframes
that
we
will
publish
into
so
that
would
we
would
monitor
your
policies
and
we'll
provide
security
violations
and
alerts
around
these
metrics.
B
Let's
switch
the
topic
and
talk
a
little
bit
about
a
case
study
that
I
were
a
president.
Yes,
so
today's
cars
are
Vegas,
they
on
an
average
have
more
than
100,
plus
CPUs
inside
all
of
these
waiters.
They
are
actually
smart
and
points
in
a
very
global
distributed,
IOT
network.
Now,
what
does
that
mean
from
a
car
manufacturers
perspective?
B
To
this
specific
example
is
about
a
similar
global,
auto
manufacturer,
who
is
essentially
renovating
how
they
their
applications,
build
their
application
and
deploy
these
applications
in
a
fairly
modern
infrastructure
in
a
modern
architecture,
and
they
rightfully
so
choose
open
ship
as
their
platform
for
their
containerized
applications,
so
they're
willing
at
self-service
platform
for
these
containerize
applications
that
will
be
offered
the
opportunity
loads.
Now.
The
key
challenges
they're
running
today
was
motivation,
the
right
platform
and
sensor.
B
They
continue
as
a
service
offering
for
the
developers
there
was
soon
is
not
of
all
arcane
network
infrastructure.
That
was
not
working
very
seamlessly.
With
this,
this
modern
infrastructure
philosophy
they
had
liquid
security
devices
appliances
that
would
take
several
months.
The
change
is
in
groups
by
relevance.
They
were
not
designed
to
work
with
these
dynamic
abroad.
At
the
same
time,
they
had
this
requirement
to
enforce
security
across
radiance
to
kill
organizational
boundaries,
which
means
they
want
to
developers
to
be
able
to
manage
security
for
their
app.
B
So
fundamentally,
they
were
in
this
situation
where
they
would
either
choose
a
model
where
security
is
enforced,
value,
in
which
case
they
would
compromise
the
benefit
of
this
platform
and
the
subsurface
optimize
elasticity,
or
if
we
go
in
that
they
have
to
compromise
on
fine-grained
security,
suppose
that
needs
to
be
imposed
on
these
applications
that
are
connected
and
working
with
devices
resources
that
are
across.
Please
I
crafted
it
as
such
a
pathway
to
the
limousine.
There
was
a
ton
of
war
between
Natalie
and
security,
they
would
choose
one
or
the
other.
B
That's
where
Tiger
Athena
comes
into
play
is
be
able
to
provide
full
and
not
have
to
compromise
the
permittivity
or
security.
So
the
point
of
Tigerettes
earrings.
They
are
managing
their
fine
grain
policies.
Across
our
platform
they
have
defined
various
different
global
tiers
around
how
these
policies
are
created.
B
Who
has
access
to
those
all
these,
and
these
only
that
we,
although
have
they
built
on
dynamic
application,
constructs
they
come
with
full
on
it
and
lock
for
that
media
compliance
means
and
it
serves
their
the
security
and
compliance
needs
across
the
entire
platform
and
the
applications
hosted.
Other
infrastructure
is
a
great
quick
example
of
how
this
works,
so
in
their
case
they
have
a
pre
broad
set
of
tiers
defined.
B
C
C
I
will
actually
synthetic
scenario,
but
it
sort
of
mimics
something
that
we
regard
as
a
number
of
customers
do
in
a
similar
sort
of
model,
as
well,
so
I'm
going
to
walk
you
to
a
line,
and
the
third
element
goes
the
second
sort
of
a
part
of
that
PCI
compliance
scenario.
It
was
workflows,
X
and
not
just
pods.
An
open
ship,
but
also
virtual
machines
are
part
of
ownership.
Oh
one
thing
is
notice
about
CX
is
that
it
is
a
infringing
use
platform.
Obviously
it
is
become
Marcia
Nexus.
C
These
are
all
designed
to
be
automated
and
I.
Think
this
reinforces
the
condom.
It
made
that
many
of
our
customers
are
struggling
with
is
the
fact
that
open
show
itself
provides
a
very
declarative
and
automated
platform
for
applications
and
in
fact,
the
online
infrastructure
itself
is
typically
deployed
as
code,
whether
is
the
compute
instances
or
even
the
you
know,
networking
today's
in
tech
miss
and
training
typically
link
decline.
C
You
all,
and
then
you
have
you
a
prescription
conform
to
that
model,
but
very
often
our
customers
are
struggling
with
the
layers
in
between
which
are
not
yet
automated
and
dynamic,
and
declarative,
and
specifically,
CMS's
focused
on
helping
move
that
infrastructure
layer
between
the
actual
computer
network
infrastructure
and
the
application
platform
to
also
become
more
declarative
model.
So
many
users,
some
instances
of
that,
can
determine
illustrators
example,
I'm,
going
to
use
a
synthetic
application
to
what
we
have
in
application
called
stars,
which
is
a
micro
sir.
C
Application,
where
there
is
a
client
which
happens
to
be
have
a
second
label
to
supply,
is
veena,
has
a
label
that
says
role
equals
play
and
compliance
equals
PCI
in
the
case
of
ceilings.
What
we
do
is
you
can
find
load
these
labels
for
the
application
when
it
is
writing
in
a
virtual
machine
or
a
temperamental
host,
or
in
the
case
of
kubernetes
and
OpenShift.
C
We
simply
inherit
the
labels
from
open
shet
and
what
is
the
reason
for
that
is
because
the
15-year
agora
helped
develop
the
network
policy
model
in
kubernetes,
and
so
what
you'll
find
in
communities
and
therefore
authorship
is
a
model
that
regularly
mimics
our
model
for
network
policy,
including
things
like
tables
the
nation
and
the
client.
We
typically
have
a
number
two
microservices,
so
we
have
a
from
a
piper
service.
They
have
a
such
labels,
including
one
that
says
composite
equals
PCI.
C
We
have
a
couple
of
micro
service
bees
which
are
selling
as
a
package
which
also
have
this
label
level
one
of
that
label.
One
of
those
micro
service
instances,
has
a
label
that
says
compliance,
equal
speech,
guy
versus
another
one
of
B,
which
does
not
have
that
label.
So
now,
I
know
what
we're
doing
into
that
implies.
C
In
this
case
it's
actually
running
on
a
virtual
machine
instance
in
the
cloud,
but
in
this
case
we
do
have
labels
associated
with
that
instance
as
well,
which
is
a
one
of
the
label,
says:
compliance
equals
PCI
half
and
when
we
get
to
the
obligation
is
shown
in
the
UI
for
the
application.
But
the
solid
bars
reflect
that
connectivity
is
being
attempted
and
as
possible
versus
the
mic
bars
where
connectivity
is
being
attempted,
but
not
being
allowed,
and
typically,
if
I
could
by
network
policy
that
is
preventing.
C
C
C
C
At
my
subscribing
thing,
that's
any
chat
bubble,
but
in
FA
what
you'll
see
is
when
Bob
Long's
and
he
sees
the
default
network
policies
that
he
had
applying
for
this
application.
And
specifically,
you
see
a
number
of
kubernetes
network
policies
in
the
default
network
here,
and
this
is
what
you
get
when
you
have
an
application,
any
defined
network
policies
by
Aphrodite's.
So,
coming
to
the
application
view
itself,
here's
the
application
view.
C
Let
me
actually
do
one
more
thing:
yes
and
now
I
the
bar.
By
doing
both
permissions,
do
not
create
new
policies,
and
this
is
done
by
a
OpenShift.
Are
back
so,
let's
say
I
create
a
new
test
policy
and
put
it
in
a
given
namespace,
oh
by
the
way,
kubernetes
policies
like
names
they
suddenly.
Obviously
in
C
and
X,
you
can
have
global
policies
as
well
extra
feature.
We
have.
You
can
have
interesting
interest
policies
and
you
can
choose
to
use
just
the
kubernetes
network
policy
syntax,
which
gives
you
to
your
teachers.
C
I'll
use
the
Calico
quality
syntax,
which
gives
you
a
lot
more
features,
including
log
actions
denied
times
and
so
on.
So
in
this
case,
I'm
going
to
say,
Bob
is
trying
to
create
a
policy.
That's
in
allow
a
UDP
port,
let's
say
50
paid
for
DNS
I,
save
that
save
the
rule,
and
let's
say
it
goes
to
save
the
policy
notices
everything
to
integrate
policy.
C
That
says
Bob
trick,
trying
to
create
a
policy
and
this
time
with
this
metadata
and
not
just
divide
the
let
me
log
out,
is
Bob
and
come
back
and
log
in
as
a
different
user
in
Photoshop,
so
that
we
login
as
user
Sally,
who
happens
to
be
in
sale,
business
unit
8
and
in
when
I
walk
in
a
Sally.
Now
you
notice
that,
in
addition
to
that
default,
here,
I
now
have
a
business
unit
here,
which
I've,
given
some
permissions
to
view
and
Sally
can
go
ahead
and
commissions
in
that
business
unit.
C
C
C
C
So
these
are
the
permissions
I've
created
for
Baltic
sales.
That
vlog
is
allowed
to
work
on
these
artifice
by
just
watching
lists,
and
specifically
the
gears
that
is
giving
access
to
is
the
default
here
and
all
you
can
do
is
get
the
policies
from
the
people
appear
right,
and
this
is
something
that's
being
associated,
but
with
use
of
all
it
can
also
be
associated
with
other
users
in
Oh
picture,
and
these
are
map
controls
of
standard
kubernetes
and
open
share
are
back
controls
that
reinforce
with
policy
right.
C
C
If
we
can
talk
to
Vivi
and
we
can
talk
to
DP,
but
this
other
Part
B,
which
is
running
without
this
label
on
G+
PGI,
will
no
longer
be
able
to
talk
to
the
other
pods
because
it
is
missing
the
speech
checkup
last
label,
and
so
what
I
can
do
is
if
I
now
apply
this
policy.
So
if
I
know
that
the
Polish
am
gonna
apply,
will
apply
a
little
shop
in
this
info
sexier.
C
So
right
now,
I
have
a
couple
of
things
to
allow
the
UI
application
to
work
correctly
and
just
give
what
complicit
pass
the
things
pass
to
the
next
year.
So
now,
if
I
and
do
an
emoji
applied
and
I
think
the
Nazi
create,
doesn't
really
matter
concept
here,
PCI
I'm,
creating
these
new
all
the
scenes
here
and
if
I
go
to
the
UI
you'll
notice,
like
these
qualities
are
just
I
appreciated.
I
could
have
just
as
easily
change
the
policy
by
the
URI
separate
off
like
a
rocket
test
policy.
C
I
could
have
done
this
globally
and
I'm
going
to
down
the
slow
belief.
Example.
I
would
have
added
a
rule.
That
said,
is
not
allowed
any
protocol
if
compliance
equals
PCI
give
that
and
save
life
and
applied
that
in
all
pods,
where
which
I
can't
compliance
equals.
P
XI
I
now
had
I
seen
this,
which
is
essentially
what
I
did
by
applying
that
OC
command
I
have
done
the
same
workflow
bada
UI
and
save
that
as
a
yahoo.
So,
in
a
penny,
what
you
can
do
is
rather
than
anything
he
ammo
by
hand.
C
The
intent
is
that
we
give
you
a
nice
UI
or
the
folks
can
can
edit
the
policy
stable
channel,
run
it
through
the
CD
system.
So
really
move
towards
managing
policy
is
code
rather
than
the
earlier
methodologies
that
people
have
used,
which
is
very
error-prone
ways
and
in
India
home
behind
and
Louise
leaving
it
up
to
the
developer
anyway.
You
know
that
anyone
that
quality
file
will
see
apply
notice,
that
these
policies
exist,
and
this
is
all
being
applied
and
see
intersect
here.
C
In
other
words,
these
policies
are
being
evaluated
before
the
security
operation
sphere
before
the
business
unit,
one
tier
before
the
default
credit
is
here,
and
so
what
I
believe
is
these
policies
that
we
just
applied?
Take
prevalence
based
on
the
by
the
inputs.
X
takes
precedence
over
the
develop
recommended
me
your
message
and
example.
We
look
at
what
this
policy
says.
C
In
this
case,
what
we
have
is
a
dynamic
set
of
rules
which
are
applied
in
lockstep
of
the
application
but
tied
to
organizational
hierarchy.
So
we
are
allowing
in
public
teams
to
codify
the
policy
rules
and
enforce
that
at
all
times,
it's
all
given
a
cell
for
all
human
applications
so
that
individual
application
robots
don't
need
to
go
back
and
have
the
student
for
month
wait
period.
C
While
the
imperfect
team
reviews
in
a
hey
with
this
request,
valid
anon,
and
is
this
application
violating
a
policy,
so
that
is
the
second
sort
of
willful
I
wanted
to
demonstrate,
and
third
one
with
some
of
the
operations
workflows
and
in
the
CNX
manager
UI,
you
can
get
lots
of
individual
views.
You
know
both
current
and
historical
during
what
was
the
policies?
What
is
the
data
flow?
How
many
applied
in
your
95s?
Those
are
real
dollars
and
diplomat.
C
Looking
at
the
total
policies,
in
effect
the
number
of
unused
policies,
let's
not
do
other
exchange
that
these
policies
are
currently
and
use.
It
can
show
the
number
of
endpoints,
so
you
can
actually
go
back
and
drill
down
an
endpoint
look
at
the
labels
via
their
edit
deliveries.
Look
at
notes
what's
running
an
individual
ability,
but
even
beyond
that,
we
also
integrated
to
other
environments
that
customers
tend
to
use.
C
So,
for
example,
if
you
want
to
have
this
view
by
a
say
of
Prometheus
or
a
rope
on
a
dashboard,
we
can
give
you
sort
of
views
and
desires.
For
example,
if
when
I'm,
showing
you
guys
a
profile
on
dashboard,
they
you
get
these
legal
historical
logs
of
traffic,
denying
by
policy
same
thing,
drill
down
and
especially
in
find
out
like
five
eggs,
you
can
define
thresholds
as
to
what
you
want
to
happen
to
and
a
certain
threshold
to
see
it.
But
sample.
C
Do
you
want
to
start
blogging
traffic
and
I'll
come
back
and
show
you
that
the
log
action
in
a
second
but
one
of
the
things
you'll
notice
is
I've
been
sending
traffic
to
this
infrastructure.
While
we've
been
speaking-
and
you
might
have
not
seen
my
slack
alerts
been
popping
up
in
the
back
but
an
example,
one
of
the
alerts
that
I've
configured
in
my
see
this
demonstration
is
the
ability
to
send
alerts,
in
my
case,
to
plot.
C
You
can
obviously
pick
your
favorite
other
big
system
with
by
public
Prometheus
and
Ravana,
but
I
mean
sending
other
society
and
you
can
actually
drill
down
as
to
what
threshold
you
want
others
to
say.
For
example,
if
I've
said
the
dress,
all
Dubai
c55,
it's
a
second
100
connections
per
second
we're
trying
to
someone
find
it.
While
a
policy
I
want
to
get
another
extent
to
slack
so
a
longer
cycle
like
one
of
the
words
that
we
automate
with
with
CMS
but
I,
show
you
here
in
a
monorail,
you
can
do
this
as
well.
C
C
C
C
Now,
if
I
go
back
to
my
login
year,
is
notice
that
I'm
actually
getting
psychic
logs,
like
the
totem
pole,
headers
of
the
different
source
and
destination
IP,
including
on
the
metadata
that
you
can
optionally
log
as
well.
That
says
these
packets
are
being
received
from
these
sources
on
this
particular
interface,
and
this
is
something
that
can
be
used
by
audit
teams
within
a
typical
enterprise
to
go
back
and
say
things
like
7:00
p.m.
last
night,
here
with
the
state
of
policies
in
the
infrastructure,
give
the
human
attempts
that
would
mean
to
violate
policy.
C
C
This
environment
do
with
customers
like
the
global
automaker
like,
and
they
prefer
to
is
moving
them
away
from
this
whole
three
to
four
month
period,
where
they
need
to
enable
manual
controls
or
a
different
application.
Rollers,
but
now
are
completely
automated
infrastructure
with
all
of
the
workflows,
including
the
including
the
automation
for
that
around
auditing
and
logging
and
so
on,
and
they
completely
automated
crosswalks
Title
II
I've
been
getting
some
chants
and
comments
and
blue
jeans.
C
C
What
floors
that
we've
been
able
for
a
number
of
our
customers
around
how
they
can
feed
up
and
automates
the
applica
and
web
flows
in
lockstep,
with
OpenShift
Russians
within
the
open
sure
platform,
but
also
across
the
infrastructure
beyond
open
shipped,
but
at
the
same
time
not
compromising
on
security
and
the
fact
that
now
they
can
get
these
in
their
audit
logs,
in-depth
history
of
quality
and
in-depth,
instrumentation
and
metadata,
but
in
a
truly
dynamic
manner.
And
so
the
Journal
said
this.
C
This
link
should
give
you
more
detail
on
the
collaboration
that
we
have
with
rawhide
and
how
is
making
this
an
integrated
party
experience
with
overshift.
We
also
have
a
communities
like
channel
where,
with
projects
like
project
calico
and
sto,
we
collaborate
very
closely
with
the
communities
that
are
enabling
these
capabilities
and
so
come
join
us
come
talk
to
us.
We
will
continue
to
highlight
some
of
the
more
advanced
workflows
as
we
have
more
pickups
and
events
in
the
future
and,
let's
say
I
will
now
transition
using
any
sort
of
questions
or
discussion.
C
A
Thank
you
very
much
graphic
and
I
meet.
We
do
have
one
question
and
Peter's
gonna
have
to
jump
off
it
in
a
little
bit,
but
you
wanted
to
know
more
about
the
types
of
policies
that
can
be
created.
I
can
package
scans
and
contents.
The
part
of
the
policy
is
the
session
of
where
and
able
to
validate,
based
on
established
session
known
session,
etc,
and
then
for
the
types
of
validation
he's
interested
in
with
validation,
traffic,
valid
DNS
traffic.
It's
a
long
question
bell
traffic
that
I
know
the
protocol.
C
Olivier
thanks
with
present
period,
I
think
it's
been
a
lot
of.
You
should
catch
up
at
some
point
but
yeah.
There
is
a
number
of
circuit,
advanced
capabilities.
We
have
in
CNX,
which
enable
a
number
of
sort
of
scenarios.
So,
for
example,
you
asked
the
question
about
things
like
following
traffic
profiles.
C
There
is
a
number
of
features
we've
built
in
in
terms
of
things
that
could
sink
to
capabilities
that
exist
in
Linux
and
Braille
already,
such
as
plugging
into
leveraging
contract
in
the
in
the
Linux
kernel,
for
example,
I
mean
in
phoenix
is
purely
a
something
that
leverages
the
standard
and
its
data
paths.
In
other
words,
we
just
create
routes
in
the
Linux
kernel
and
I
professed
rules,
I
have
in
standard
route,
other
distributions
or
Linux
by,
for
example,
here
you'll
see,
there's
some
additional
features.
C
We
have,
for
example,
one
feature
we
have
is
pretty
act
where
you
can
apply
this
on
forward,
then
the
number
of
sort
of
capabilities
here
are
on
enabling
a
few
advanced
scenarios,
in
addition
to
the
actual
policy
editor,
where
we
have
some
specific
rules-
and
you
can
log
us-
deny
upon
a
number
of
sort
of
additional
actions,
not
just
on
endpoint
selectors.
You
can
do
this.
Obviously
in
speech
selectors
as
well
and
location
shift.
Are
you
can
do
this
on
fiber
matches?
C
We
have
additional
features
around
networks
s,
but
all
of
this
is
kind
to
standard
capabilities
that
are
imposed
by
the
Linux
kernel.
I
mean
this
is
the
kind
of
ravel
kernel.
That's
shipping.
Today
we
don't
insert
any
kernel
modules,
we're
not
in
the
in
the
actual
data
file,
but
essentially
we
create
the
rules
in
the
next
student
for
set
policy.
Another
novel
is
that
do
not
try
option
here
is
you
can
actually
turn
off?
C
Do
not
track
for
applications
like
memcache
P,
which
is
another
example
of
an
interesting
application
and
khakha,
and
the
rule
was
where
you
might
have
a
large
number
of
short-lived
connections
that
you
may
not
want
to
come
as
contracts.
So
there
are
a
number
of
sort
of
scenarios.
There
I
think
the
cases
that
you
are
calling
us
there's
a.
C
We
actually
encountered
a
number
of
scenarios
like
that
as
we
talk
to
customers
of
the
last
year-and-a-half,
and
those
are
things
that
we
do
have
enabled
you
know
the
valid
nephew
peak
traffic,
valid
DNS
traffic
and
so
on.
One
thing
I
did
not
demonstrate
in
this
demo,
but
it's
something
that
we
have
an
extra
me
right
now
is
calicoes
application
policy,
and
specifically
there
you
have
the
ability
to
specify
things
like
I
want
to
allow
HTTP
decks,
but
not
thoughts.
C
I
want
to
allow-
maybe
this
particular
application
transaction
to
occur,
but
not,
and
that
is
a
pretty
innovative
and
advanced
functionality
that
we
announced
at
the
last
coupon.
We
have
it
working
in
tech
preview
now
and
something
that
we
have
seen
a
lot
of
slide.
But
at
some
point
maybe
I'll
give
you.
If
we
can
get
in
my
back
would
love
to
come.
Come
I
can
demonstrate
the
application
policy
integration
that
we
have
with
this
field,
and
here.
A
See
you
all
right
at
some,
if
I'm
sure,
and
we
can
schedule
a
little
briefing
there
at
about
the
end
community
central
enough-
they
lose
that
they
have
given
me
for
openshift
Commons.
So
please
do
come
and
find
me
there
and
we
can
schedule
a
briefing
or
if
you
have
another
topic
that
you
you're
passionate
about
and
you
want
to
schedule
on
and
are
hear
about
it.