Antrea Community, 15 Mar 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Antrea Community Meeting 03/15/2021

Description

Antrea Community Meeting, March 15th 2021

A

So now that several places in the world are switching at all uh dst, we are seeing uh meeting times changing for some time zones, uh for we on a week-to-week basis. So.

A

I have here in my calendar that the meeting seems to be based on on gmt time, which means that at least from what I can see from my calendar, that I'm sharing now that maybe I can share it now, uh the meeting time for today it's this is a in the european time which is six am which will be then.

A

It's 10 p.m, u.s time, but the next instance that I can see here it's falling at 7 00 a.m, european time, which I believe I'm afraid it might still be. 10 p.m. uh 10 p.m, uh u.s time right, because that there will be still nine hours after that and uh for china it will switch at one pm. It will be then one it should be one. It should be 1 p.m.

A

So maybe, if you can also review how the calendar is showing up in your in your time zone that we can make a call on whether we want to change or not uh the times for uh for the say for the summer season, so that uh it's a fairly comfortable time for everyone.

A

Let me see if it is 30. Is it just a one-off.

B

It shows up at uh as 10 p.m, for me on the google calendar, but 9 pm on my vmware calendar for some reason.

A

Yeah, those are two different invitations. I believe, okay, I believe that those are two different invitations, so uh I let me see the imitation on the vmware calendar. I don't even know if I own it, if I own it or somebody else owns it so, on the on the vmware calendar, the invitation is based on utc plus one which is not utc. You know it's. The utc plus one is pc branch, berlin, berlin time and that's why it switches on the on the google calendar. Instead, I don't want another meeting on the google calendar.

A

The invitation is is in in coordinated universal time, which means it's always 5 a.m, regardless of the time zone, and therefore, when we switch to daylight saving time for central europe, it becomes 7 a.m and from the u.s it becomes 10 p.m, whereas for china it stays always at 1 pm, um I believe- and then you know you can give me your feedback here- that maybe we should try and uh restore the 9 pm. 6 a.m.

A

Cadence, and this will mean that the meeting for china will go from, will go to 6 00 to 12 p.m. From 1 pm, I think that might be the best approach, but anyway we don't have to finalize it now we have two weeks. I just want to hear if you have any feedback on this.

B

I'm moving. It sounds good to me, yeah, okay, so.

A

No, no, that's! Okay! Oh no! I got used to this 6 a.m. Meeting and, uh to be honest with you. 7 a.m will probably conflict with the time for getting kids ready to school, so yeah, all right, so that's, uh that's! All I'll uh will I'll make the proposal on the slack channel so that, uh if you have any any feedback on that you can, you can provide more feedback on the slack channel and we'll finalize the meeting time change by the end of the week. The said this we can go back to our agenda.

A

The only topic that we have today for down the agenda, um a of the design for the reject action in anthria policy that will be given by grayson.

A

So I don't think there is any other topic agenda for today. Is it.

C

Sabato, I think we are going to talk about the windows code, proxy removal.

A

Today: okay! Yes, uh yes, that's right! Because uh yeah, that's a that's a good point, because wiki told me that we might be ready, but uh she didn't confirm whether we were actually ready or not. So that's great that we also have the windows cube proxy removal.

A

So I think um um how much time do you think you need for the windows cube proxy removal.

C

uh I think um maybe less than half an hour.

A

Oh great and grayson will, like uh 20 minutes, be good enough for you as well.

D

A

Okay, okay, so maybe we can start with a cube proxy remover for windows, and then we can move to design for the reject policy um in. uh Is there anything else that you would like to bring up for today's meeting any other demo topic design discussion complaint around.

C

A

Yeah guys sorry.

C

I saw the only I have some uh leftover things to talk about about the q product removal for linux.

A

Okay, uh so is this like follow up from the from the previous discussion that we had done uh two weeks ago? Yes, I think, okay, so it might make sense to start with that, uh so that we conclude that discussion on the on the linux key proxy removal. So maybe hong kong, you can get started, then injection will follow with the windows cube proxy removal, and then we will conclude with the reject policy for andrea.

A

Okay, so since we have quite a few topics to discuss about, I guess without I guess you want to stop hearing me and maybe we can hand it over to han liang.

A

E

E

E

Okay, it's a presentation about the design of replacing could be privacy, and there are some other items in last about this last meeting.

E

First, is the masquerade accent necessary? The second support for out of cluster endpoint, certain country and controller, rely on entry, proxy's service.

E

Let's review the overall design, what do we? What are our design? First, we add an ip site to store the ip and port of services in mango table. The traffic on my cnib side will be marked with 0, 0x, f2, third other ip rule, and this rule is used to route load. Traffic marked with 0x up 2 to a specific routing table and the traffic is routed to oes, aware and shared until it is up 0 and masqueraded on table on table. 9 trim poster routine.

E

And the first question is a masquerade accent, necessary.

E

For example, we run the commander. We run this commander on the wholesale node as the source.

E

The source is if the source is dependent on the main default main means the main road table and the main road table is used to master target ip.

E

If there is not an actual maximum distorted ip and the package will be dropped here, only the default route matches the cluster ip, which is a target ip.

E

Next, we can say that the source, the package, the source of the package and is the this ip address, is ipo, drag from the default.itum.

E

The source the destination is the cluster cluster ip next next and we can see that we can see that we can't we can't decided the source I can address of the package as we don't uh as we don't uh as we can. We started the with. With robbed item can matching the cluster ip.

E

uh Here we can see that the source here and the destination then don't go out. The source is much the masquerader with the anti-double zero and the definition is also the cluster ip.

E

E

Support for out of cluster and pointing we'll continue with the scene on the peruvian space.

E

We cannot let the package, though we can. We can't let the package with the sauce. Oh sorry,.

E

We can see that the packet which draws with this source under this destination it will be processed on table 41.

E

And then it will be prioritized on 42.

E

Is that this statin, this destination will be, will be changed to this row and point.

E

On this on table.

E

70. well normally, this should be packaged should be messed with.

E

For the crdr and then if the endpoint is not impossible, it will be messed up with these items.

E

The most important before leaving oes this source should be modified to a virtual ipo address.

E

Why why we do this? Because we can't let the package that source is?

E

Is this 10.10 0.1 build the oes and it will not come back again so before leaving os, we modify its source ip to this, this waterfall ip, but and it's not a it's, not net.

E

Next on the host node on the wholesale node.

E

If the endpoint is not on localhost, we need a masquerade again with. This is a physical happy address, because this roswell ip can't be rotted back on the physical network.

E

And the source is modified to this one. The host this is the ip address of the of node one.

E

Okay and the traffic will come back from node two well now and as not at the current resource recover the destination. To this virtual iq address rotten decision. We need to rotate the traffic into oas again and we need to add this unlinked road item to main road table.

E

And then here well, we also need to recover the destination ip address to the entry disable 0 on os.

E

And it will be and denied os to the the source will be modified to to the cluster ip address.

E

Next, the traffic will come back to node one with a as a ice net with an ice net. Now the destination will be translated to the to the ipo device of original.

E

Under then this, and then the process is done, and the third question can actually controller rely on to proxy service.

E

The entry control and two controllers and to client will will wait, will wait for the entry service until the anti-proxy is ready.

E

Okay, that's all the problem, any questions.

D

Now I just saw the one one problem here: I think your designer put down work for like the policy only mode right, because I think you.

D

um Since one is one one flower, you assume the ip, the untrained, gw0 ip.

E

Oh, you can tell me which piece we should jump too.

D

In the police only mode, we don't have any ipr and gw there really.

E

D

um Just scroll down, I think it's in page seven, you pay yourself, you mentioned some flow.

D

E

F

D

uh What what does that sell field uh 10.10.0.1.

E

We need to for the the package the package, the package or not with the destination with this ip address should be modified to to this one as we as we modified as we modify them here as we modified here.

E

We can't we can't write the package also being oes with this ip address, because this reply traffic will not be loaded into obs. As this, this ip address is the is the is the actual address of the network adapter on host on node, one okay,.

D

That is uh that that is, the ipl must created by your table sub as creator sure right, but um I mean nether police only mode. I think we don't have any ip on gw00.

D

So in that case, sorry, um maybe you you don't know that policy only mode. uh So.

F

You see, we have.

D

A traffic we have three traffic modes right uh in time; mode: uh sorry, four mode, income mode, hybrid mode, low income mode and there's another connected policy. Only mode in.

E

Which we don't.

D

Encounter traffic and we don't resolve traffic, but we mean that some some other signal plugin uh some quality plug-in too for the traffic and the road traffic. So in that case we we don't have any ip on gw0.

E

D

Let's talk now, I guess you didn't pay attention to that. One.

E

I didn't take it into a considerable before maybe.

A

Sorry is there any additional comment on the linux cube proxy.

A

Removal only young is there anything else that you like to add on your presentation.

E

A

Okay, perfect! So thanks for presenting this and thanks for the feedback from zhangjun, and we can move to the next topic, which is uh same thing but for windows and which will be presented by chang.

C

Okay, hello hold on. Could you turn off the sharing screen, sharing great okay.

C

Okay, oh, can you see the screen.

C

Yes, yes, I think I should send the send the link to you. Yes, yes, so today, I'm going to talk about the cube proxy removal on entry windows. Now, first, I need to thank ray for his knowledge, transferring and uh his his effort on the design, and he offers this chance to do the representation today and all this credit goes to him.

C

Okay, then, let's get to the topic uh currently on android windows, the class ip service front port is supported already, there's a service lp to the endpoint selection in obs, and there are some other uh services like non-pro service and class ip service from host. These are still uh depends on the field proxy and we want to remove cube proxy. So we need to support these services by our design.

C

The reason to remove it is by using actual proxy, we can have the full control of the pipeline and we can make it more efficient. Basically, there are three several tasks here. First, we need to broadcast ip service access from host. Second, we need to support node for service access and sir, which is a working progress issue.

C

We need to rearrange the bootstrap order, but it may be the same as the linux case, but we will need to investigate more and on windows before actual agent is stored as a process, uh the queue proxy needs to be installed so uh to remove it, we need to stop the pure proxy process and we need to remove those servicing interface introduced by the cube process.

C

Yes, so let's get to the first task here, you can click on the link here.

C

Yes, so the first sub task is support class ip service access from the host.

C

Currently you can see that we have a queue proxy here, so if a local process, if a local process on windows host, sends its package and q policy will receive it and it q process will take all just take care of the packet and send it to the uh to the selected endpoints. Yes, cool policy will do this endpoint selection as well, and now we want to remove the queue proceed and since we already have the service load, balance user endpoint selection, we just need to do something here.

C

We need to make sure that the packet from a local process can go to the android sheet of zero. So here's the solution.

C

There are three things we need to do: we need to add a route for the service ip, which is the destination to redirect to the traffic into the oes bridge through android 0.. We need to. We need a route here. Also. We need aip responder in obvious for this service eyepiece and sir. We need some additional follows to make sure the path is expected.

C

You can see that there's two routes here. Of course we want to limit the number of arp responders in obvious, because if we have, uh if for each service for each service ip, we add a new arp responder, then this there won't be too much and we don't want it. So we want to use a virtual ip to uh to represent all this service ip.

C

So this uh that we need only one arp responder here and so with this two routes, the the local process can go to the correct endpoints and once and wanted when the packet was sent back. The logic is similar here and here are some example: command on windows.

C

To do the job to add the route and to add the ap responder, there's some possible improvement here that, since uh about this route table on the host, we have this service ips destination this route, and if you have another service service ip, we need to have another route here.

C

As you may remember, in linux we have a ip set to collect all these service ips, and it is a very, very fast speed in time in terms of time complexity. So we are, we are going to investigate if there is something like ibset on windows, so that we can let the number of routes in the route table uh to be just the one to be just one route here.

C

So this is basically the class iep design. It is very simple: we just need to add route and a relatively awkward founder and the service. We will do the rest of these jobs. So is there any question about this part.

D

uh Certainly, I'm just thinking uh that will assume that it can be multiple physical interface on the node. If not, then any with the traffic, even you don't add results. The traffic anyway go from br into os bridge right.

D

If we, if we assume, there's only one interface and only one ip on the.

C

D

For example, if it's just, uh let's assume it's a virtual machine.

C

D

They only have a single we need, and since we move.

C

D

To os bridge, then the water traffic, even don't add any results and any static adults.

D

By default, the traffic will go out from br internet.

C

uh uh Are you sending the package from the host on on the obs.

D

uh Sure I think about some local process to access class ip service right.

C

uh Yes, so if this is a process on the host, it must go through android zero to get into the bins to the obs. So.

D

Not really I mean uh if, if, let's assume you don't do anything on your host, but you only have a single winning then the default result. There must be a default. I think point to br internet.

F

C

F

If you exercise, for example, the external eyepiece from the from the host, the traffic will go through the vr interface fort.

D

And here we are because you guys want to assume we have multiple multiple interface under under node, so default is not behind. Is that or something so we we need to add the static dots to read right traffic.

F

uh Yeah, that's one of the config considerations, another instance, uh because our linux we use and 200 for the cluster service traffic. So we want to keep the same behavior psc.

D

As I thought this for that one, you have a way to redirect traffic from behind the director to gw0, using open flows.

F

You'll be send the simpson reply, packet back.

D

uh Maybe what I'm saying wrong so so I I I guess you mean you want to keep the open flow, the to be the same between needles and the windows.

F

uh Yeah and uh uh and if if the traffic goes through the uh until uh gw0, uh the source apps here will be, the getaway will be the ipo of the entry and double zero. So it's easy to be sent back for the for the reply package.

B

Okay, but the engine don't we also have flows in the pipeline that treat uh packet going through vr end and packets, going through the gateway differently. I thought we had such flows on on windows, where we classify the packets differently, whether they come from the host gateway port or through the the bridge.

D

Port um for the four flows from br enticing, mostly, we just redirect to uplink directly.

B

Yeah and that's not really what we want to do here right right.

D

Okay, uh hopefully I need to think about a little more all day. I saw the windows, it can be simpler, but I mean, if we have to hand results, then it's not releasing.

F

Yeah yeah, I got your idea so just so, we can consider if we can leverage the bearings to avoid introduce additional routes.

D

F

What I'm thinking.

D

Of but uh if you want to solve the case, you have multiple interface, maybe maybe it doesn't work.

F

uh Yeah, so I mean the current price is very easy and uh because it then the design is also wrong on the linux. So uh we we are completely confident for this design, but we are. If we move the traffic to upgrade, we may need to consider more.

D

F

But it's a good idea.

D

Okay, yeah, probably I think yes, thanks.

C

Okay, is there any other questions?

C

Okay, if there's no, let's move on to the next part.

A

uh Do you think that the your question should do you want it to answer it here? Oh no,.

B

I was just writing down, but we can move on. I just want to. I don't think we can assume really a single uh public, ap public interface.

A

C

Let's move on then okay, so this is about class ib service access for host, and the next step task is to support notepad service access.

C

So, as you know, there's no ip tables on windows, so we can't do like the linux that we have sounded on the on the host and do most of the logics there. So I uh we can. However, we can have some other third party network drivers, but this these are extra efforts and we don't think it was it. So we are going to have all these nasty net s-nuts into the obs, and we hope this will.

C

uh By removing the fuel proxy, we are going to have a better efficient uh workflow and uh yes,.

C

So if, if you want to remove the cure proxy and support the node for service, there are three cases we need to consider uh it's about the source.

C

If this is the traffic source is uh from the external host or it's from a local host or it's from the local port, and you support this, we need some extra flow tables. First, the uplink table. We already have it and we need a new filter tables.

C

The first is to filter the node for the eyepiece and the second one is going to filter the ports. So after these two tables, we only have those. We only have those uh traffic related to the notepad service. And after that, there's two nut tables. One is the dinner tables and it is going to set the destination ip to your virtual ip and the s9 table.

C

It will do the s net change the source ip to use the gwip. Now, please attention peer penetration that it will happen only when the external traffic policy is clustered.

C

So let's take this graph to expand the pipeline, so we are going to first talk about the traffic from external host, so on windows, you can see that from uplink there's external ip as a source and the node ip as a destination comes in here and it goes through the filter tables.

C

And then only those traffic related to the notepad service will be left and it goes to the dna tables. So then the source isn't changed and the destination is changed to a virtual ip. Also, the number one is set to the register 8 to show that it is a request and after that we are going to go through the snap tables and it changes the source change it to a glip.

C

And now we have a packet from gwip and the goes to virtual ip, and it will will reuse the service lb tables into the endpoint elections.

C

Then its destination is changed to the endpoint ips and now, through the iot folding, our tables, the traffic go to the endpoint and this over the request, and then how about the reply? It is the symmetry of the request process. The packet comes from the endpoint ip and it goes to the gwip.

C

It runs through the source, lb tables and the source is changed back to the virtual ip then adds aot folding out tables. It will match the the package whose source is the virtual ip and it will set 2 to use the register 8 just like before we set 1 to the register. 8 the 2 means that it is a reply.

C

So then it is very similar to the flow before and it's at the snare table and it does nsnet and its destination is changed back to the external ip and then the dna tables and the source is changed back to the node eyepiece. So it's a so far. You can see that the source and change source and test and the descent source, so this is changing back and going to where weight conference.

C

Please pay attention that you can see that this is. It is from the uplink, and it's out is a android gta 0., it's kind of different, but actually after it, uh the truck the traffic goes out, enter gw0 it'll go back to your host, since it's the external traffic and the only host knows where the route is, so it needs to go back to the host and it goes back to the brings, and then it goes to uplink.

C

So you can see the process is very similar to the current current uh design by q proxy. So at this time the traffic goes back to the external host or pod. Maybe- and this is the this is part for the external faces and then I'm going to talk about the traffic from the local host.

C

Actually, this is much simpler than the case before, because we are going to reuse the service lb to the endpoints endpoint section and the job. What we need to do is have a user space proxy here with this user space proxy.

C

This user space proxy is different from the cool proxy.

C

Before we have a few proxy here, where just the user space proxy only does simple job like it takes in the packet from the local process and it it have a certain new traffic with the source as a grip and test as a virtual ip, and we need a new route here in the router table to let the traffic goes to the android g double 0 and once the traffic gets into the integer 0 in obs, we reuse the service service that we do the endpoint election, and this part it has already been down and the traffic goes to the some port.

C

The traffic goes back and go back to android 0 and without it go back to the user space proxy, and here it will send the results back to the local process.

C

So the support for the localhost is very simple. It's just on the host in some route in some user swipe proxy and that's enough, then the the last one is about the local platform.

C

D

For local process to access the port, uh so whatever will be the source of the source, ip nodes right.

C

Yes know the ip, yes.

D

D

So you, actually you guys, mean within the user space proxy.

C

D

C

Is going to translate the source and test like uh doing net jobs?

C

G

I guess that's erectable, because on windows there is no magnitude to steal the packets, whose destination is the local host to os.

D

Right, probably, we should look as we have a piecing like. I guess.

G

You mean windows, okay, yeah,.

F

Maybe yes, yeah yeah. I have a look at the vip vfp, um but there's uh no uh no framework like net filters in vfp.

F

So if we yeah, if we want to understand like netflix and have tables uh we need to, we need to develop our own uh driver network driver.

C

And we don't think it is worth the effort.

D

Okay, the local local process to access, not the polling, not common right. Do you guys know any upstream test cover that or any use case for that.

F

I'm not sure I can check the the current ladies test, but I don't remember we have this kind of ties, I'm just thinking. Should we just talk to them.

D

If it doesn't make much sense to support this.

C

Kind of support from local node.

D

Yes, the the usb policy. uh Do you have any other requirements for that, or it's only for localhost to access that port.

F

uh Did you, I think you just mentioned that there their case that user may access the network from another interface right and not not from doubling sure, but I think even.

D

Sorry uh you're talking about another case right: oh, you still have.

F

Something: okay! Yes, if the connection is from another interface uh instead of variant, so I I think the uh uh the user proxy can handle.

D

F

Kind of traffic.

D

Okay uh for the this user, specifically only follow the point right, at least only for yeah the load port accessed by a local processor or buying line investment.

F

uh I know uh actually actually no not only for another product uh session, we'll talk about later later: okay, okay, four or less yes,.

C

F

Let you guys continue.

D

Then we can see.

C

Actually, the local poll cases is even more simpler because it is going to reduce the logic here, the the traffic from the local port. It goes. uh It goes out to the host uh surul and churchill zero with with tables in obs and uh after that, since the traffic is now host, then uh the rest is the same as the local node situation, with the user space proxy and the route goes back.

C

Maybe it's not so efficient, but this is going to work, and maybe we can investigate some better solutions later. But this time we are going to have the traffic goes back, goes to the host and do the rest the same as the local nodes case.

C

And yes, this is all for the node port service port and all for my presentation today.

D

Okay, so still uh user space processing only follow the port right can be a local process or local portal.

C

Yes, they all use it and no other use.

D

Okay, I'm just talking about my thinking. uh I I don't use this proxy. I mean we are.

C

Saying we want to simplify.

D

The folding button.

C

Yes, but maybe some traffic may happen for some reasons and be prepared for them.

D

So so probably I probably need to think more about the so far. I'm thinking probably no need to support a local process to access another port and therefore for local port. uh You can you can handle an open way switch if you want beautiful.

G

Case, like some in-cluster loan balancer, do you think they will access the loan, not notepad from from the host itself, like a metal beam.

D

It's never light matter; they typically just use.

D

Let me know, I think it will just use it matter. Be that yourself, don't they need to do any forwarding uh you just use could be promising.

G

Which destination you use when you need that.

D

uh Sorry, what do you mean by that.

G

I mean when, when we need to access when you access.

D

It this doesn't mean.

G

And it is translated to the the endpoint directly, not while the null part you mean.

D

I think spy could be proxy, uh could probably translate.

D

G

D

And uh actually I I I I'm thinking on windows. Probably we made lots of assumptions that uh traffic should go, go to the uplink, I'm not sure we can keep the same as something for now. I I know it's not ideal. I mean you, you just completely right. They can be multiple interface.

D

Sometimes the defaulting phase can be another interface, but I'm thinking if we uh and it's our current implementation, assume lots of traffic should go up in, uh for example, s that right. um So I'm just saying: should we just keep a simple assumption for now until we have a better song.

C

We can support from the external cases first and maybe decide later about the design of the rest.

D

C

Okay, is there any other questions.

C

B

Think we should check with uh gke folks that the assumption is uh correct for their use case, at least.

D

Sure we can assemble, I think so right do you know the supermarket? That's not.

B

Maybe reno's since he's been working with them.

F

Actually, I'm not sure about that. I just think that it should be common to have multiple interfaces um in one node.

D

uh You you can be right, but I think it's not common for service. For example, if we look at water at least all the digitals, I never like a tkg or pks.

D

I don't think they support my colleagues.

F

And uh and it's especially for ensure, because we will take to control the uplink, so I think it's better to have additional interface for management, because uh if entry os is crash, the connection may be broken really. I think you guys have a way to restore the traffic right yeah, but it do have high risk.

D

B

But as long as the default, uh a default interface is jump links and it's still, okay,.

B

I mean for a genjun's assumption, at least.

F

Yes, but uh if uh what if the, if we install some uh from increments flow or our user or anything change,.

E

F

Yeah, I don't think that's.

D

F

D

F

Okay: okay, okay yeah. What.

E

F

F

A

All right is there any other question on this.

A

Topic, okay, all right, so I believe that we can, uh I mean my only curiosity, was about uh whether we have to enforce uh we. I mean, I think we want to enforce the network policy, so some traffic coming from the node port right- and I was wondering in that case, if one wanted to configure such a network policy, uh what did it be evaluated before or after we do uh snap for the source ep? I just want to figure out.

A

If uh you know normally one will configure a network policy by allowing only, for instance, a given set of ingress.

A

Of english ciders, and I wonder if that case, the network policy will work or whether instead the network policy for another port should only be specified on the on the node ip.

A

Itself, I don't know if my question was clear. Probably I didn't, I didn't expose it very well.

G

Sorry can you repeat, I didn't get.

A

The last lesson I in uh we did we did not deport design that has been just proposed by gesheng. I want to. I want to understand whether we can uh for traffic coming from, let's say from the outside world, if we can enforce uh anterior network policies on traffic that goes through the motherboard or whether we need to do some special treatment for andrea network for for filtering traffic. That goes through the network, because I think that we are the surcipi.

A

So I don't know if, when entry electro policies are evaluated, we see the actual client id or we see. This is not edip with the snap to the node ip.

F

Yeah, so I think it's a good question. That's uh that's also what we are we are. We are considering now because currently we just can confirm the traffic. uh Can we go through the right path, but for the policy by policy? Actually, we we're not sure if some some policy rules may be broken currently.

E

F

The year currently, we end the tables before the existing policy tables and after the tables. So you see our necessary.

F

The flow will uh will go through the existing existing policy tables also as well, but we still need to investigate kids if they are and there's an issue for the policy.

G

F

G

To enforce on the external client ip as the end point, the selected endpoint might be on another node right and we don't reinforce nano policies on this ingress. Node right will only enforce ingress, narrow policy on the nodes that the ports are running.

G

So there is no.

F

G

To enforce policy uh on the original society.

B

We could add the original ip as a genie's metadata right. That would be a cool feature. Yeah.

G

That could work.

A

Okay, so thanks for addressing my question so now we have another topic to discuss, but unfortunately we only have a little bit more than three minutes left in the meeting uh which I believe uh might be. I might be better to defer the discussion of the entry reject policy to the next community meeting.

A

uh I don't think that three minutes will be enough for reason and also it's already 11 pm for people dialing in from the u.s west coast. So uh grayson are you? Okay, with uh presenting these uh in the next community meeting.

G

Yeah, I'm fine.

A

Okay, so sorry about that, uh the conversation on cue proxy removal took a little bit longer than expected. Is there any final question for hong yang and churcheng and ray about the q proxy removal.

A

Waiting 10 seconds.

A

And therefore, it appears that it is all for today and thanks everyone for attending I'm going to stop the recording now.