Antrea Community, 14 Aug 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Antrea Community Meeting 08/14/2023

Description

Antrea Community Meeting, August 14th 2023

A

Together: okay, everyone thanks for joining uh today is a national public holiday in Italy, so I am replacing Salvatore and I. Think today is also a national holiday in India and so we're missing. Quite a few community members. Today um there is only one topic on the agenda that I am aware of. I. Think Len wanted to discuss um um feature great graduations for entria v2 release.

A

um So then do you want to cover the topic.

B

Yeah sure, let me share the screen I just like to share the issue which I listed the official gate. You know that we are preparing the two-door barrel and uh in the last release we already covered the API promotion and for now I think it's time to you know, promote the feature Gates, and here uh at least I think this is a actual copy from an issue which created by the trend and I, just uh update a few comments, and some of them has been promoted and which you see this is checked.

B

Then we can ignore them for now. I think we have two features. We think I think Antoni replied in the comments and uh also think this is. They are ready for GA, so I'm, hoping that there's no objection in this meeting if we plan to promote them to the ga stage and the next uh actually I like to I, just like to you, know, show the features which we like to promote. But we need more discussion before for more than, and there are also some- uh maybe uh we are not so sure about them.

B

For example, this one and we have already promoted the API to better I think, but if we promote the feature gates to jury, it might be confusing for the user. So this is a one thing we may need to uh our maintainers and the community members to read their your thoughts or any ideas about this and the truthful I think there. There is a one ongoing task about to add the first and sampling feature so I'm, not sure.

B

Maybe it's not good candidate for GA uh yeah for other future Gates, most of them we like to promote them to better. But let's see, what's uh what team's suggestion or any sort for this.

C

Method is that I'm, confident, confident to a job policy of azure, proxy and endpoint and point slides could be graduated to GA because they have been used widely and have been enabled by default and uh for any newer future. Like for uh uh DSR support, we have a separate feature gate to control its enablement, so the core features of financial process think it's relatively stable and uh and the way in the last few releases.

C

We have fixed significant number of bars and normally just Corner cases, so um that that promotion would make sense to me and for or endpoints tonight, because the Upstream API has has graduated to J already, and we have also enabled enabled it by default for several releases and most of the code is copied from the option, one so I'm confident about that too, um but but for the others.

C

I I I I, don't have enough confidence to promote them to their next stage for services tonight. Here uh I think I just met uh an issue that external IP was not released after I removed the annotation uh when I was testing something else, but I haven't found an issue, but my my point is this was not really well tested and verified in production, so I uh I'm not confident to promote this feature and I do have another requirement uh from users that they want to make.

C

The Eastern IP will be shared across multiple services and I'm still working on it.

B

C

For other features, I'm familiar with level, seven policy I think it's not time to graduate to Beta, because we still have some knowing issues like when using the feature user must disable offload uh check some offload checks on offloading, which may impact how we impact on the performance of data plane. So before that program was is resolved, I think, maybe perhaps just a cable it as Alpha I'm, not very familiar with the others.

B

Sorry, the last feature you are talking.

C

B

C

Yeah I I think perhaps we could create one or we use the original issue which uh which uh introduced the future to track the preconditions to graduate. So we can, we can add our appearance and attract the how they are adjusted and whether they meet the preconditions.

C

uh To to graduate separately yeah an emulator.

B

Okay, so I think uh we we all agree that we can graduate these two to the J stage and the following items. Maybe we need more discussion and they'll also need to resolve this box right.

B

uh Okay, thanks, chair I think we still have four items which we are not covered. Any other team members like to you know bring up your thoughts about these features. If you are more familiar with this.

A

uh Island, uh so yeah I feel the same way as a Chan about the first two entry, proxy and endpoint slides uh I also agree that for the others, I'd rather be a little a little bit more conservative, I guess one. That's interesting is a flu exporter, because flow exporter has been around for a long time and we've been talking about uh creating graduating it to Beta a few times.

A

um I do feel like. Maybe there is no Rush uh necessarily, um even though there isn't a lot of risk because it can still be a disabled in the config. Obviously I feel like we're still working a lot on the flow exporter. Recently we added support for TLS.

A

um There's still a lot of changes going on in the flow aggregator and um I know that Yoon Tang is working on a different mechanism to collect Connections in the in the flow exporter on on the agent um I also feel like I know, we did quite a bit of I think there was some scale testing done already, but I feel like I.

A

Don't know if I'm 100, confident that we should graduate it to better at this stage, because I I don't know if we have any stories of anyone using it uh uh really successful in in production. Yet.

B

um Okay, so your suggestions, we may keep this at our first stage.

A

Oh yeah, unless someone disagrees with me, I think that uh we should probably keep it in in Alpha a little bit longer.

B

Thanks: okay, anyone has a comment for another three items: I think uh yeah I saw Wayne on the core. Maybe you are more familiar with external node and support bound look lecture.

D

Yes actually, for external nodes, we have two issues reported about the integration on the cloud especially observed on the Azure platform. It is because of uh some customization uh on the obms on either Cloud. So maybe sometimes the external features are not working as expected. So um I think that's, maybe for external node.

D

We still it should be better if we still keep it in the other patch other stage before we can make it the most stable or more visible to to to be customized for different special configuration, sound clouds and the source power bundle, collection, um I, don't I, don't think the crd needs more changes, but by now, when to support SFTP as the plot code to upload the bundle files I'm, not sure if we have any plan to support other protocols like uh S3 or some some other other storage, if so, I think maybe we still need some code changes for spot bundle collection, but if we we think that if the maintenance think that SFTP is enough for this feature, maybe we can.

D

We can bump up the work. The stage.

B

Okay, do you see any requirements for other protocol or SFTP meet customers, research.

D

um By now you, you may know that the spot bundle collection feature is proposed because of the external know, the scenario and we obviously use the external at least some some users may use external to manage the cloud VMS. So on from the cloud perspective, I think some Cloud specific storage, like S3, is more popular, so um I I previously I have thought that. So maybe we could think about other supports for such storage protocols and like S3, but we don't have enough time to implement it.

D

So I just think that from the feature itself, maybe it should be better if we can, if we can support many more protocols as the uploading solutions. That is my thought.

B

Yeah, okay got it thanks. Maybe we can have more discussion about this, since uh we think that we may have more enhancement for this one.

D

B

Okay, thanks uh ip6 search, authentication, I'm, not sure.

B

Thanks, okay, sure, uh are you going to yes.

E

Yeah, so for the abstract certificates feature I, don't think it is widely adopted. So uh is the default integration mode used to the previous chart key instead of the episode certificate, so I think we might need to switch the default mode to certificate, and then we can consider to promote this feature to better yeah.

B

You mean change is a default search certificate to this one right.

E

The default encryption mode is psk, pretty short key for the moment yeah. So so.

A

E

That this, this feature is not enabled by default. Okay, yeah.

E

So that's I think this feature is um but widely tested.

C

If psk is always preferred, uh authentication way of hybrid set, maybe uh I'm gonna first I'm, not sure whether it is which one which one is the far away but uh I mean graduating. This feature to Beta doesn't require the uh before the way to be changed in until because we we should always make it the the rarely preferred way in production in the industry, industry and uh I I feel if this feature doesn't have scale, concern or doesn't have complicated logic.

C

Maybe we could just consider his mission and majority uh to to see if it can be graduated or we could do more testing about it. No need because it's not enabled anyway so, but it if you were not enabled anyway in the future. Then, if that we don't need to have this condition. Yeah I.

E

C

Have many features that will not be enabled by default.

E

Okay, okay, got it: okay, yeah.

E

Then consider too prominence to better yeah.

C

Yeah yeah I think you can lose any issue and to uh to to to to secure what you your test, what test you have done and uh how? uh What what's the risk you think there could be, or there is no risk if we promote it to Beta, so we can yeah.

E

Yes, thank you.

B

Yeah, okay, thanks I think she please help to create an issue for this, so we can follow up after the meeting.

E

B

Okay, thanks I think that's all for the future. Gates.

A

Yeah quick question about the entry of proxy feature gate, so that's something I I commented in the issue as well. I was assuming we would add, like a configuration toggle as a fallback to disable entry a proxy, or is that not something we plan to do.

C

A

C

I also had a similar comments, uh but I I talked to learn directly then left that comment. Yeah I agree that we should have a future. We should have a configure toggle to disable Android proxy completely for users who prefer Q process, especially I could proceed accused mode, which has some more a lot of balancing are grazing I. Think.

A

Well, it's not the feature gate toggle, it's a Boolean parameter in the um okay.

B

A

You know you know, we have I, think we have the entria proxy configuration section and under that we have like a Boolean parameter for proxy all and we have different uh parameters as well, so it would be a new parameter in that section.

B

Okay, so uh so is there already a toggle for entry proxy or we need to add a new one? No.

A

We need a new one, but there is already a configuration section in the.

B

C

A

Map yeah, okay,.

C

Yeah I remember. There was also in issue that if a user use using an older kernel version which doesn't have net module support for OS uh and the process, it will not work and the user was make was using Angela without enterprising, enabled here.

D

C

Even it is enabled by default we will had an environment variable to disable it I. Remember.

B

Yeah, okay, I think that would make sense in this case to keep a talk or add a talk for the features so I suppose for all the GAA features. We should have one toggle for this or uh we treat them the three different features in different ways.

A

Well, I think it depends, for example, for endpoint slice. We don't we don't need to toggle, because it's just an API yeah.

B

C

Yeah just seems no point to for for user to prepare for endpoint API. Anyway, we have fallback logic if and points last API is not available. You will use an an important API instead, so you you should not care about in.

B

This this table.

B

Yeah, okay got it thanks: okay, I think uh that's uh from my side about the topic, I'm, not sure. If the any other topics I will stop sharing here, uh any others have any comments or suggestion for this topic.

B

Okay, if not I will stop sharing uh and Tony I will hand over to you.

A

Yeah thanks Lynn for the presentation and walking us through this topic: um yeah I, I I'm, not aware of any topic on the agenda, but if someone wants to discuss anything, uh please uh bring it up now. If there is nothing, I can give like a a couple of like very quick updates. More General updates.

A

um So One update I'll give is that uh go. 1.20 has been released last week and so uh sorry go. 121 has been released last week and uh currently in entria and the entria sub projects we are using, go 119, so go 119 is no longer maintained because go is maintaining the most recent uh two minor versions, so 120 and 121, and so we're transitioning to go 121 for entria and then all the entry as a project so see uh NFA, entry, IUI and so on and so forth.

A

um It's not a very uh disruptive change, but there's been some uh a couple. Notable changes since go 119 and there are some nice to have as well. For example, um they added new functions to the Google standard library to operate on on slices and and Maps which leverage Google support for generics. So it's very easy to look up a value in a slice or compare slices in go 121 and you no longer need to write custom implementation for this.

A

So that's one update. The second update is not something that is affecting us right away, but you guys may have heard that ashicorp has decided to change the licenses on the most popular projects, uh most notably terraform and vagrant. So the cncf is currently discussing.

A

uh What's going to be, the impact um on on like cncf projects and VMware is also looking at and other vendors, also looking at the impact of the license, change on their products, and so uh I believe that we use a little bit of of terraform scripts in entria I think they used terraform, possibly in nephe as well to provision Some Cloud infrastructure.

A

So we may need to look for Alternatives in the future. um We'll see what the cncf guidance is when it becomes available.

A

I will note that there is no change. Fortunately, for us there is no change in the golang libraries which are provided by ashicorp, for example, in entria. We rely heavily on the member list, library from ashicorp for features like egress in particular, and so the license for that library is uh remaining as before. It's a MPL license, which is a Mozilla public, license, I, think, and so there is no implication for us there, which is good, because uh if they change the license, we would have it to remove our our dependency on on member list.

A

Probably- and that's uh that's it for my updates, any questions or or comments on this.

A

All right and uh any other topic that anyone wants to bring up.

A

All right so I think we're gonna end the meeting uh 30 minutes early here and give everyone some time back. Thanks for joining everyone uh have a good day or have a good night and I'll see everyone. In two weeks.

C

All right, thank you for hosting the meeting bye.