 Hello Taylor. Pedro. Hello. Wait until five after. I don't know if you can hear me. I think I was muted. We'll get started at five after high. Again, Brian and other folks. Hi Oliver. Hi Taylor. Hi everyone. All right y'all. Welcome to the cloud network function working group. I'm going to post the meeting notes. Hi, Ian. Morning. Add your name to the meeting notes. We appreciate it. Does anyone have any topics I'd like to discuss? Otherwise I'll just jump into our full request. I'm not hearing anything. I'm going to jump in. Let's see. I don't, yeah, we don't have Jeffrey on the call. So I'm going to wait on air gap. He said last call he was going to work on it. Brian. Should I open the compliance? I want to talk about that. Did you have time to go through the. No, it just needs me to work through the comments and I haven't done it in the last week. So I don't, there's anything to discuss there. Maybe let Brian, I think this might be your first time on this call. Is that correct? That's correct. Yes. That's the first time. That's the first time. I don't know. At least I seem to have got lost on which calls I needed to be on. But anyway, that's the problem. So you take a look. If you feel like it on the notes, we actually have. These recordings. If, if y'all didn't hear it. Everyone of these calls are being reported. And they eventually make it up on the CNCF YouTube. So there's past recordings. There. Eventually these notes will probably get rotated. And then we'll link the telecom user group has older notes as well. And the. Most of the content. If it's not in the meeting notes. It's going to be in the. Get hub itself. And the. Areas are going to be. Use cases and user stories. There's a lot of. Context there. We're trying to put best practices. They're going under here. And. There's also a forum. Discussion forum, where you can see. A lot of different topics here where there's things going on. And when new contents coming in, we'll get a pull request. And we will. Discuss the different comments. And then we'll try to. Try to come down to some type of. Consensus or at least a. Someone's views has been expressed before it moves through. And we've had enough. Thumbs up or. Plus ones to move it through. And let's see. So the Jeffrey salons. He was at charter communications. He's now at Dell. He's been working on it. He's been working on it. He's been working on it. He's been working on it. That's context for. What that is about. Ian's been working on one for. Recording. Your compliance to the best practices. So if you're not following it, maybe there's a security best practice. And you're saying there's a. Application or component. That for some reason. Can't follow. You're having privileges disabled. You want to make sure that. It's recorded and communicated. So that. The ones consuming and. Using the application and service providers, like Vodafone or you are. Will know and can handle that. So that's the idea around that practice. And you feel free to. Come. Read and look at the comments. Go look at the different. Content in here. And we'll talk about the best practice itself. Let's see. So another one here. And we may not have been on this call. So I'm not sure if it's been handled. This is a best practice around. It's not given me the other view. Maybe it's on this one. Oh, there we go. So best practices on. This is related to the Kubernetes API. For. This is a security related best practice, actually. Anonymous request, audit, logging, and a bunch of other stuff. This one. Is one, I would say it's more of a work in progress. I think that. The person working on this, Ben, he is. I'm going to be moving it over to the, it was in the wrong area of the. Of the repo. But the other part would be some pieces that you would see on. Oops. Some of the other practices. I'm going to go back here for a second, but. Yeah, I'm only seeing one. So I don't think this best practice is one to. That we can do much about right now. Now, we're just going to, it'll be a little more frequent in. Hasn't made the updates. But eventually we'll have something like, let's do this one. No root. So we have motivation. The goals of the best practice. So this one's about not running. Processes is right. Run them as non root user non privileged. This is a good idea. Have some type of context, user stories use cases that relate it. This actually goes to a whole set of user stories, supply chain attacks, which you might be interested in since you're doing security over Vodafone. We talk about different issues and how not allowing root users can get positive for those. And then problems or caveats that you could see if you follow this. And then a whole set of references on why we're putting this forward as a best practices. And if there is alternatives or anything like that. So that's the idea eventually with all of these is to have a lot of context and information for people that are wanting to adopt and implement these practices. So it looks like we don't have anything that we can move forward with progress on the current pull request because they need some work based on the last feedback. Is there any other, does anyone wanna have anything to discuss or wanna look at anything? Brian, if you have any comments, questions. At the moment, just feeling the way around. Oliver, you have anything? Not, nothing specific, Taylor. I think one of the things is just, I know we have use cases and we have some user stories around for the stateful CNFs. I'm not exactly sure. I'm not sure if we, how we kick off some of the best practice work. So for example, based on any of the user stories and use cases that may have been submitted, I'd like to take a shot at doing some of them for stateful CNFs, but I'm not sure exactly how to, how to progress out of it's just to do it and then we have a discussion or there's anyone else who may be interested in participating together on that. Yeah, if you have some idea of one or two or whatever that you have a good grasp on, this would be, you think it'd be a good one. I would just start writing it out and however that's most comfortable. If you wanna do it in a Google doc or a HackMD, fine. If you wanna write it and just do an initial pull request, you can always mark a pull request as draft, but bring it up for discussion. So this one isn't marked as draft, but we could always, wherever that is, I think it might be at the top. Anyways, when you're putting in the pull request, you can mark it as a draft. You don't have to put it as a draft because it's not gonna be accepted. Putting it as draft would just be more communicating. Actually, putting it as draft will not allow it to be merged. So if you wanna make sure, but where to get started would be what you think you can talk about that you feel like you have enough information and then wherever you would want to work on it. As far as in here, if you look at what Ben did, these are more of the high level. This is more of, in my mind, the proposal and summary section of the best practice, which is fine. It's a good start. Now we need to fill in other pieces that we think are necessary before we move forward. You could start like that or you could go with... I'm in the wrong area. Let me go back. You could always copy like this, no routing containers and then start filling in each of the pieces. And I believe Ian said last time we probably wanna make some adjustments on what's required before we're gonna let it through. We don't think everything in here now is as relevant. But I'd say if I was gonna point it out, the summary and motivation goals are important. Non-goals usually, but you'd probably be intuitive on whether that's important. The proposal, of course, would be important. And then the context. Well, you already have the user stories. So we have those in there. We could just put links to existing user stories. So I think you're good to go there. Trade-offs and constraints, probably important, but doesn't have to start, could be empty. I think references are very important when we're talking about these, but it doesn't have to be as extensive. This one we've even added to this particular when I think a month or six weeks ago. So we keep adding to it, which is totally fine. So you have a few choices, but I would say just get started. And then if you have something that's out there and you can say, here's my first version of a best practice or a set of best practices, and you can show people, you may have a few other people that say, oh, I'm interested, let me help. Sounds good. Okay. Thanks, Stella. Yeah, you're welcome. Does anyone else have anything? I'm gonna add this for Brian, since you're involved in the security. We haven't put forward a bunch of new best practices, but we'd like to. We have a whole set of notes and content around lease privilege. And you may be interested in this, Brian. Yeah, definitely. So exception. So this one is really specific to lease privilege. I think we were just putting notes in here, Ian and I, but we'd probably, it's applicable anywhere, best practice right up. But if I scroll down, why don't we want lease privilege? So there's this whole content about why that's important, and then where it could potentially affect some examples and other things. And then we actually start talking about behavior and stuff, eventually. Don't run containers. These are different potential practices. Don't run containers with privilege through talking about mounting host directories, what can happen with those sort of things. So there's a whole set of things in here that you may be interested in. We have stuff in the discussion forum, which I was mentioned earlier. And then there's the user stories and use cases would be another area that I would check out. And those might be useful in and of themselves. And maybe you'll see some areas where you want to come back and talk with us about. Yeah, definitely. I mean, this is kind of heating up in motor phone as it is. One of the objects is just trying to work out how we align our own internal organizational model as well. All right. Hopefully. Hopefully, Tom's a bit more on the ball on that one. I'm kind of getting pulled into it. I come more from the network side than I do from the Kubernetes side. Is there anything else that folks would like to talk about? All right. Well, I'll give you the rest of your hour back to do with as you please. Thanks, everyone. Thank you, Sarah. Have a good one.