Gert Drapers, Aserto | KubeCon + CloudNativeCon Europe 2023

This is texturing TV. Hey everyone. All right, we're back here last hour hour and a half of cubecon.

People are mulling around the show floor, I guess for their last kind of tour of the of the of the stands and talking to people of course, for those of you who don't know. The next cubecon is in American North America. It's in Chicago.

I believe it's a I think it's November actually in Chicago and then they've announced next year's cubecon in Europe will be in Paris. So if we didn't catch you see you can catch us there. Also.

Just a quick reminder. We are going right from here to San Francisco for the RSA conference and we will be streaming and broadcasting all week from there. So catch us next week on the road again as this Roadshow continues for Tech strung TV my next Guest at cubecon is Garrett Drapers or droppers?

If you're here in amsterdammon, you're Dutch. You might pronounce it that way Gert is with a surdo and Gert. Welcome to Tech strong TV.

Thanks Ellen. Thanks. Thank you for being here so dirt.

I said droppers is the kind of Dutch pronunciation. You actually happen to be I'm happy actually born spitting distance away from the really Convention Center. Yeah, it's coming home.

It's like coming home after 25 years. Yes. It's been 25 years that you moved out of Amsterdam.

Yeah 96. It's like we moved and and you live in Seattle now, right? That's correct.

Yeah bit of a ride away. So I'm glad this gave you a chance to come home. Tell us about like what brought you from Amsterdam to Seattle and to assert.

Oh yes a little story. So well relational database has brought me to Seattle. Oh, I'm a database guys.

So I joined the SQL Server team at Microsoft. I worked at Microsoft here in the Netherlands before. And so spent 24 years of my life.

There is like I'm actually not officially Seattle. I'm on the east side but it's like, okay. So I'm a data guy and I interchange data was developers and identity when I was in my my various roles that I had in the 24 years.

And so do two and a half years ago. It's like we started our own startup was an old colleague. It's like it's the first time we're doing this together.

and focused on authorization because we think that's a problem that it's like it's not really solved yet. No authentication very much soft reasonable good standards practical standards authorization, not so much. so two and a half years ago we started on that Journey building embracing at first Opa as an engine sure and then quickly figuring out that it's like it's a data problem.

So is the data problem it's always a data problem. And so the challenge became it's like how do I bring the data to the the authorization endpoint effectively three years later when we started I think there was a paper from Google at the time, but nobody was doing anything was it yet. And now of course the whole industry is rallying around Zanzibar.

because realistically customers or users It resonates better. Yeah, it's it's way less friction. So we turned the model around and said it's like all right, we're going to be data driven.

but for these tail end calls that need to be attributed specific we can still leverage capabilities that Rego has but then it's like as it was in payload. So let me let me ask you I'm gonna ask a favor of you because you know, not everyone in our audiences is Savvy on this as you are. when we talk about the difference between Authentication And my name my mind just went on me and authors and authorization.

What's the difference? the key difference very simply sad authentication claims Who You Are So it's a statement about who you are and and who the actor is in a system authorization is what you can do. Right and an authorizer.

I always it's a bouncer standing at the door. The door is open. The door is closed sure and by default, hopefully the doors closed.

Well, I'll be at RSA next week. I'm sure I'm gonna hear all about zero trust in all of that stuff. But you know in my mind though, this is always good discussion.

So I am right. Yeah, I've said for years I am is kind of the killer app of cloud security identification. excess North and access management, but In your definition the identification piece is the authentic or authentication right?

So I know Gert is good. Yes that just because guard his guard doesn't mean guard can go wherever he wants exactly right and that's the authorization piece of it. Exactly.

Yeah, of course you girl you could go here but not there or you could go here now but not later and when you go there you could do this, but not that And that's really what we're talking about here. That's what that's what we're talking about. And then also it's like bringing that into context of like companies.

Who deal with evolving business requirements regulations compliance needs? Kind of a trail. It's it's no longer.

Well, that's It's definitely you need to have a trail. But you also need to be able to evolve. Yeah, and so far.

It's like most applications have been building it inside the application. So separating these two concerns that is like you have an external authorization engine. where it's like you can manage that separately and evolve it separately allows you to decouple these two aspects which are very useful for companies to be able to deal with these compliance kind of Regulation changes Etc that our constantly being adjusted and they have to comply and so it's it's a means to actually remove some of the pressure of those application teams.

That is like they don't have to update their app. Is like if they can just update the policy definitions to to reflect the requirements. Yep.

Let's Source projects that I want to just make sure our audience understands one was Opa open source policy agent folks. It's Steyr and other exactly and that I believe covered that a lot on Tech strung TV. We covered pretty regularly the other one was apart.

Zenzi bar is the name of the paper Okay. So Google wrote a paper of how Google implements it. s relational driven authorization for all their key assets Google Drive YouTube and word docs all the all the prime assets.

And driving it through data. So they Define what they call a manifest which is simply these are the entities that you talk about. So I talking about a document and a folder.

And there is an actor which means most of the time called the user. Which can be grouped. But all these aspects is like our managed to data definitions.

And it's like the work that they did is like and the scalability in which they can do this at Google scale. Effectively proof to the outside world. It's like this is a feasible model.

And it's understandable. And since it's based effectively on set calculus right is like you can prove it. You can prove that Allen has access to this and you can turn it around.

And say who has access to this objects or who can walk through this door and who cannot? And that's very powerful because that's what people want to see when they create an authorization model. For who is who can do what?

I understood and I I actually understood it before but I wanted to make sure we laid it out for the audience that we are they are right there with us. Get a few minutes left. Let me carried.

I want to change the change the conversation a little bit talk about why you're here at cubecon. So first of all We're Cute we're seeing CF member. So we have sandbox projects in the authorization space.

So one for how to develop policies and how to distribute them in the secure supply chain. Yeah, so that was one of the reasons the other reason is like to see where the rest of the open source ecosystem is going and particularly wasn't. As like there is a huge momentum building up.

It's like we had wasom day at the beginning of the week and it's like it showed it's like a tremendous amount of progress like way more and it becomes really To its states where it's like you can start to build up on it. And that's exactly what we're planning to do, but that's so those were the two reasons for at least like we just did. I'm sorry good.

I cut you off. I apologize as that we just did a session. It's like a bird since the fact it was all the other authorization projects inside cncf.

So open it open open fga. So that's the oh the oxalo zonzibar version the sky ref folks with Opa ourselves and it's like we had an audience is like who actually is like we had to discussion with about what they need and one of the questions that's or things that came up. It's like can we have a cloud-native authorization work group at the cncf level to get us these best practices?

Yeah, and maybe even a standard because there are no standards. And you know what? It's funny.

I was telling you early. We had Matt Butcher on earlier from fermione and he talked about sort of how awesome came about as part of cncf. It's a very similar thing you start off when the group is very small.

Yeah, and you kind of know everyone in the group because it's that small but it it grows it builds and and that's how you get standards and that's how you get exactly to where you going so it's the That's the path right? From what I understand the wasm on Tuesday. They I forgot there wasn't Day Zero events.

It was whatever it was Tuesday. Yes. Tuesday was all the different events.

The wasm sessions were standing room only. Yeah, and they were packed but it started it's that very small group of people. Just talking about webassembly.

Yeah. Yeah exactly. And it's there is so much diversity was in the cncf portfolio.

That is like it's very easy to build to connections of the building blocks. Right in terms of we brought oci open container images together with policy bundles. Yeah, and and so built a Better Together.

I see spiffy Inspire right for authorization between our authentication between machine to machine is an integral part of somebody's authorization structure because you need to be able to do that. Yeah, so that's why we're interested in the cncf as as a common grounds where we can come together and collaborate. Because it's like you can bring these things together at an open source level.

I agree with you 100% And I would be interesting here. We're almost out of time. If you don't mind.

I'd like to ask you a favor. Look into this camera here let our audience know. What's the best way to engage with a Certo?

the best way was to engage with the Certo is like go to our open source sites. Don't pass don't sh. And you will find there a cant authorization solution that you can download in five minutes and get started.

Experiencing. It's like how you can actually break up your authorization problem into smaller pieces and started integrating it. So that's the my call to action.

Love it. Pleasure meeting you guys ready for you right here in Amsterdam boy makes good comes goes away comes home today. Yeah.

Anyway, Amsterdam fantastic story. We're gonna take a break here on Tech strong. We'll be back in a moment.