Antrea Community, 28 Mar 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Antrea Community Meeting 03/28/2022

Description

Antrea Community Meeting, March 28th 2022

A

Good morning, good afternoon or good evening, this is uh the andrea committee meeting today is tuesday march 29 6 in the morning uh central european time. If you are instead in the pacific west coast, it will be still monday for you and, let's start with today's meeting. So today we have a very nice agenda.

A

We will start with an introduction on with a discussion from grayson about icmp, supporting network policies, and then lan will provide also a discussion of datapath for multicluster networking. So since we have a very packed agenda, I think it's time for me to stop talking and let's start with the presentations uh grayson. Would you like to go first, yeah sure.

B

uh Thanks doroto, let me okay, you guys hear me.

B

Yes, I can. Okay, let me share my screen.

B

Okay, you guys can see my screen now the slice okay. uh So today I will show you the icmp support in entria network policy, and this is today's my agenda. First, I will go through the motivation and then the api proposal and the controller side, change and agent side change, and also I have since the development is uh almost done. So I have a demo video for you guys and then it's the q and a section so for the motivation um we all know.

B

Icmp is a very commonly used protocol and uh especially for user use, for use it for debugging and also we already heard some complaints about uh we're, not supporting icmp, and this is the github issue about the requirement to have the icmp support and the another reason is some cis, like calco. They support smp in their network policy, so we want to support smp in hours for api proposal. This is our current api.

B

If we want to define a policy on the some specific protocol, we have a field called ports and uh we can define the ports uh protocol. Ports and import uh currently only support the tcp udp and the sctp yeah. And if you want to, for example, matching or tcp traffic, you can define a policy like this only define a protocol without ports, and I guess we are familiar with this, so I will go to the proposal.

B

So we have uh some discussion about this. There are several options, uh for example, this one is: uh if you want to keep the backward compact compatibility, we add a field called icmps and uh it contains the several fields called like match, or icmp type and icmp code.

B

In this way, the user use currently user won't be a fact, since the ports are still here- and this is the network policy port struct, we didn't change this struct. uh Let's see the example. If we want to, for example, match all icmp traffic, uh the the rule will look like this and, for example, we want to match the ping request. The rule look like this and if we want to match.

B

Oh sorry, basically, the ports are still the same usage as before, but this way it's not that extensible, since, if we, for example, want to add igmps in the future, we will add another field under the rule.

B

It's not that good. I guess so. There's uh another options like we change the name of the ports to services and add this spec for different um different protocols under this network policy service struct.

B

But this one like if we name this as services, it's kind of like confused since the user might think it is someone something related to the kubernetes services so yeah. This is an example, but we also um like give up this proposal.

B

And finally, this is a the current one. We want to pick we we change the ports to to another field, name called protocols and under the protocol you can add the protocol that we supported. If we want to like support igmp, we can add another field in this struct and the different struct may have different specs. They can use different like their own struct, to define their uh parameter like s p type and for l4 protocol.

B

They have port and port, and since this will change the like the old api, so it will require us to bump our network policy version to will offer two and we add a convert function uh to translate the uh to convert the web alpha. One policy to the vr alpha two policy mainly change the ports to the protocol.

B

uh In this case uh user using the older version api are won't, be affected, and this is like some uh example like. If we want to match all tcp traffic, we can define a a policy, a rule like this, and if we want to specify the specified port of tcp, you can define a policy like this and for icmp. You can do things like this so yeah. This is the api proposal.

B

So if we go with this one by the way, if you guys have any questions, feel free to interrupt me at any time um yeah. So if we go with this api proposal on the controller side, we bump up the api version and add the conversion function. As I said similarly change the ports to protocol- and in this case there will be no impact and also for the internal mp, we can add the icmp type and icmp code here.

B

When the agent receive the this internal network policy, it can have a corresponding like action um uh on these two fields. So it's not too complicated on the controller side.

B

C

Reason I have a question here: yeah go ahead for the second item. Does this convert function means a column, function or some conversion book in kubernetes.

B

uh I guess it's a same like the: how we, how we do the cluster group convert, it's uh it's written in golan and I guess it's a it's a web hook. So the controller when the controller receive uh go ahead.

C

Yeah yeah: please go ahead. Yeah.

B

Yeah, when the controller received is already being translated to the viva alpha 2 uh policy.

C

uh So, which component is responded for this conversion? The kubernetes api.

B

C

Okay, so I don't I don't. I don't remember the implementation detail, then, which version it will store for this api and aviva alpha 2. and then what happens to the way one the existing. We want alpha one object where they.

B

Are um this is a good question question you mean like it has already have some even of our policy and then then the user.

D

For example, update.

B

The updated update the andrea right, you mean what.

C

Happened to the existed, I guess: if user updated it, maybe the api server could convert it to new version and store the new version, but what if user, doesn't update it? What will happen.

E

um If I may answer this question from what I remember is that it doesn't really matter because in the in the internal storage, it will always be your alpha 2., and it was only when user tried to get the object specifically using v1 alpha 1. Then the reverse conversion will happen, and uh you know the developer. One object will be returned to the user, otherwise everything will be basically converted to an alpha. Two, and uh just I mean the storage um on the wire to the controller. Everything will be really awful too.

C

C

My question I have another question is when we can remove the we want after one question: if the objects, if the existing object.

C

Is not changed after we have this version too.

C

If that does that means it will have to support alpha one forever.

B

um uh I'm not sure if I understand your question, you mean like we.

C

You mean, like example, I create um we want alpha1 object and upgrade to new android version.

C

Now I can use we alpha 2 and we were alpha 1, but if I don't update the the objects I created before upgrade, I guess the the existing object will always be stored as we want alpha one in storage right then, when we can remove the support for we want alpha one I mean if we just keep them uh forever, but it might be okay, but what if we bump another version later, do we does it mean we need to support three versions and perhaps perhaps better, which beta wish washing and gc version?

C

Gta washing? I mean.

F

C

Maybe this is not specific to this. This pop-up, I just want to understand how we handle this api, watching change and duplication policy.

E

I I do. I definitely needed to double check this, but from what I remember uh the scenario you just bought up when we have you know the entry upgrade. I would assume that, after the upgrade, the original created object will already be stored in beyond alpha 2 in storage, nodding bill or not, but.

F

E

F

The we want alpha one. uh We should do this mirror controller approach we did before.

F

C

F

E

You don't necessarily need to do that, because the mirror controller is in place because we have two different entirely different api groups, but for virgin bonds. There there was a. There was a um common practice where kubernetes imposes on and it was specifically used to handle cases like this. So from what I remember is that you know we can specify a specific time period. We can just warn people that you know this is supported for now.

E

You can continue to use fiona for one and when you upgrade it will automatically internally be one run up for two, but at some point we'll be dropping. um That's a perfect one for one and it shouldn't basically uh uh affect the users in any way.

E

So for the new resources, you can no longer create ui enough for one, but for the old resources internally. They are already converted to an alpha 2 based on the conversion function provided to the api.

C

I remember in kubernetes talks you mentioned some.

C

Some standard long program could have to list to handle this scenario.

C

I remember it list all existing objects and then make a dummy update to make the stored version to be upgraded, not sure whether it is improved no or it can be automatically converted to new version, as young said how you check it or you you just guessed, it.

E

Oh did, are you asking me yeah yeah yeah.

C

You this is, this is from.

E

The this is from the my memory when I, when I did, the cluster group version update. I I I remember uh this being the case but, as I said, I needed to double check this.

B

Yeah yeah, it will be convert to the to the newer version. If you, for example, but young, you just said, you can, for example, get a specific version. I'm not sure if this I don't know how this works.

B

But currently, if you apply a viva, offer one policy and when you get it, it will return you uh via offer to policy. That's exactly what.

E

B

Saying that's because internally.

E

It's translated, but what you can do is you can do coop cuddle, get uh entree cluster network policy dot, uh something like crd dot, v1 alpha one. When you specify a specific version of it, then the.

D

E

Of the conversion function applies and the api server will return. You are not for one resource, but I think trans question is more like in. If we already have a resource in the api in storage, does the upgrade bump uh automatic converts? What's in the storage, to a newer version? And if my memory serves me correctly, the answer is yes, but I'm not 100 sure.

E

B

Is environment probably.

E

Needed to follow up on grayson.

B

Yeah, okay, uh so I didn't check this like specifically, but uh during my development I think it will do the convert it kind of like will.

C

Really convert to the api yeah. My question is more for storage and it's more for how, when we can remove the word in the support of the old washroom yeah, I believe both case. It can work by getting the old washer and by getting the new version regardless, which washing the resource is created.

C

I believe it was okay.

F

Actually, I was thinking, should we just keep the older ports fields there too?

F

Even that means we have two way to define the level 4 protocol, but that always something more familiar.

F

By combat's customer who has university.

B

Do you mean like we still have ports here.

F

Yeah, that's what I was thinking. Origin, um I'm not very certain. I also have to learn your.

C

Thoughts that may mean we need to maintain redundance right and which field will will be higher priority.

F

They don't complicate right.

B

F

B

Conflict since the poorest can define like. um Oh, oh, no, no yeah. I know what you mean.

E

uh In that case, we'll just do what we have in uh right now in the acmt, where we have the namespace selector and the namespaces field, which they're essentially doing the same thing in some senses. But there are slight differences, so we decided to maintain both of both of them, which I personally didn't think is a good idea, but for for transition purposes uh that can be there so that we just tell you there that for the ports and protocols you can only specify one of them, but not both.

B

F

I think it's more like you have a you, have a simply simpler and the more convenient uh inspiration with the ports. What do you want to do more than once? It's first thing you can go to a new political structure. That's my thing.

B

To avoid the bump up version.

F

It's not for that. uh I just feel pretty many people are more familiar with this port's definition. That's my opinion. If they don't have a while gmp this uh more of the worst.

A

I think the approach can be suggested, summarizes, let's people that don't need the icmp configure ports as usual, and let's give people that need icmp and your way to configure policies.

C

So their relationship is will be much right.

C

People can either set port or protocol, and if they don't conflict, uh both part, both ports uh defined in ports or protocol will be effective. If they they duplicate, then it doesn't matter anyway right.

G

Yeah, I think it's pretty easy to to fail the transaction. If, once someone specifies dc like conflicting tcp data in a policy, it's not a big deal and usability wise. It's maybe better.

A

Okay, can I just ask uh if we can defer this conversation to github and continue with the presentation? Otherwise we might not have time to complete the program that we have for today.

A

F

A

Good to me, okay,.

B

Okay, so okay, so for the agent side, um it won't be too hard, since the ovs already has has the icmps support and also the on the of net and the label. Print flow also implement the interface for icmp protocol.

B

The only thing we need to pay attention is our conjunction match, as you can see our conjunction match.

B

Currently, for example, you have um you have uh one kind for the source one can for the destination and the one kind for a service and the the relationship between those kind is end. You have to match the source and destination and the services, but the relationship within each kind, for example the tcp port, 80 and tcp 443. The relationship is ore, but we need and relationship inside each kind, which means we should support a multi-match key and value pairs to support icmp type and the icmp code.

B

um As you can see, if current implementation, if we do this, it will match the icmp type, is 8 or icmp type is code. Icmp code is a zero, but what we need is uh we need icmp type, is8 and, and I think code is zero.

B

So in this case we need to change our conjunctive match struct from.

D

B

Key value pair to to uh multiple match pairs like we have, we can input like the first ones match keys. I can be type. The second pair is smp code, so we can have a multiple match pair. This is the main change on the agent side is uh required.

B

uh Was somebody else questioning the chat anyway? Okay, so uh I have a demo video to show you guys how this thing is.

B

B

So we have like a client and two server server part here. If we use the client server to code, the server it can work and ping, the server also works.

B

So let's see this is a viva alpha. One policy looks like the version is uh still the old version applied to the client and egress to server, and we defined the ports 80. Since we, the default protocol, is tcp.

B

If we apply this policy, when we try to get it.

B

As you can see, it has already been converted to alpha 2 policy and the porous is converted to particles.

B

Let's see so after this policies is applied. The uh oh, let's see the uh and the quick quest uh quick note here, uh since this video is uh made before flexible pipeline, so the uh andrea policy grass root table is still in the 45.

B

So you can see the the service conjunction match is here, and the core traffic is uh has been dropped.

B

So let's delete this policy and try to apply a viva alpha 2 policy.

B

So this is a version and protocol. We defined the icmp type 8 code 0, which is a ping request.

B

So yes, it's already revolved to no convert here and you can see the obvious flow is the icmp type and icmp code here.

B

uh So curl is not work and.

B

Things also not work.

B

Yeah, so this is the quick demo video uh so.

A

B

A

Thanks a lot grayson uh that was a very nice demo, and uh so I think now the next step is to finalize the discussion on the uh on on the shape of the api.

A

I do not think that these uh imp has any impact on the remaining implementation is just you know about out exclusive feature to users um in terms of roadmap. Is this something that you are planning for 1.7? Is there still any open uh technical item on this feature?

A

uh Open technical item yeah? I think something else that is still being implemented or is the uh is the plc code that you have like, uh providing all the support.

B

um uh The the poc is already in um uh I, I guess just the whole developments in uh quite shift uh good shape. Only issue is if we use reject action on the icmp.

B

The reject response returned to the client, but the ping.

B

According to the tcp down, the reject response has already arrived at the client, but the ping doesn't know. This is the rejected response for my request.

B

I have tried to use ip tables to the to do the rejection, but still cannot pair the request and the response I'm still working on this issue, uh since the ipt both reject is also work uh cannot work. So I guess it's not a rejection implementation, um I'm uh yeah.

B

I guess this is the only thing left on the development side here.

A

Thanks grayson uh is there any question for grayson and uh any com comment regarding icmp support in general.

C

uh I have just a quick comment that if we go with the approach that engineer proposed that we may add a pulse here, yeah then we maybe we don't need to bump up the version, because we we can convert the new field uh in empty control anyway, but when it can convert the protocol field to port field in control, plane api.

C

So I guess there is no need to bump up. Yes, the idea washing.

B

E

Also quick words: I've looked it up and I do apologize. It seems that uh the for the originally created resources. If they were ever created at the some storage version- and you change the storage version, it will never be automatically converted to the newer version. It is only when you update the resource, then it writes it in the in the storage uh using the newer version now the the norm of deprecating. It, I think, is for a really long time.

E

You mark the resource as served equals true, but you put the deprecation notice on it, so that whenever people you know, update the resource or try to create a resource using the old version, they get a deprecation warning saying that this version is deprecated and you probably needed to wait long enough for all people to trans uh to to uh migrate the resource to a newer version. Then you basically remove the diversion for uh for real. So um it's going to be a a long process.

E

Yes, that's. Okay!.

E

Does that does that answer your question trent.

C

Yeah yeah, thanks for coming confirming yeah yeah.

A

C

A

Checking that thanks a lot and if there are no additional questions for griezmann, I will move to to the next topic in today's agenda.

A

Okay, then, it seems that it's all for icmp network policies, so we'll follow up on on how to uh shape dpi for including these on github. Now.

B

uh I will post this update on the github yeah.

A

Thanks a lot grayson now lan up to you for multi-cluster network policies, thanks for waiting.

H

Sure no problem, uh let me share my. uh Can you see my uh screen? Yes, yes, we can okay, great, uh I'm not sure if everyone know that you know that we have a true multi-cluster support since 1.5, and this is actually advanced feature. It's about data paths, connectivity and I'm working on this design and the implementation.

H

You know that because we already have something in 1.5. So before I jump to this connective design, I like to show you that some basic idea basic idea, so we used during the data paths connectivity and here you know that we have a talk about the subfolder mod cluster folder and it's all about uh matte cluster and in multi-cluster. We in we have some basic pipeline, which we will introduce.

H

uh Those different results between uh cloud between the member cluster in our class sets, and this is a basic uh which we will also reuse it in the data paths. Connectivity yeah I'll just uh remind you that if you are not so familiar with the math cluster architecture and the song terminology, I might be used in following a demo and showing meeting, and you can check here and to see what kind of thing you you can learn.

H

Okay, uh sorry, let's go back to the data path connected design and the the first thing is that you know that in 1.5 we allow user once they set up the class sets and the joints on different member clusters and they can share or they can export and import a different service in our class set. Then they can communicate and access the exported service for other member cluster.

H

This is the original purpose of this mud cluster feature, but you want to find there is a limitation that you know we need. We need to the on the underlay network to make sure that there's a pod port or network access or connectivity is supported in underlay, a network which means, if there is not supported, then actually our multi-class feature will not work. So in this phase we are going to support the data connective data paths connectivity. So even the underlay network cannot support the part ip access directory.

H

We can use this data path feature to allow the mud, cluster service or powder access here uh in our database design. Actually, we introduced a new uh idea about that. It's a giveaway notes, this gateway node is actually you can sing that so uh one general node in a cluster, but you pick up you assigned you assigned and treat it as a gateway note this this node will be responsible for all uh cross-cluster traffic.

H

uh As long as the traffic will be forwarded to the other member cluster, then the trafficker will go through the go. We know the first, then it will be forwarded by this gateway note to other uh member clusters, so you will see that we have gateway node, and you know that uh during the datapath's connectivity we need to make sure that uh the member cluster know each other's uh network information like the portsider, the service class ip slider.

H

So we need to exchange this kind of information between uh different member cluster, so we will use the uh result. We call the resource exchange pipeline, which we introduced in 1.5, and I will give you a common idea about this later and in this design we have two new c crds.

H

One is turn up a tunnel and points. This actually represents a gateway node, and it will have some basic information about this local memory. Cluster, like the pod sider uh used in each node, and also the service class ip slider and another one is turner and boy imports. You know that's once we have a channel endpoint resource in our local memory cluster.

H

Our multicast controller will be responsible to do the exporter role and it will export the tunnel endpoint to the leader cluster. Then other member cluster will watch this kind of resource import and import it as a tana airport import in another map, cluster. Okay, let me move forward and you know I just mentioned that we are reused. The extra resource x for impulse pipeline, which we introduced in 1.5.

H

You can just uh you know that we have uh besides the class member cluster, we have leader clustering in our class sets. You can consider that leader cluster is responsible to exchange information between member clusters. Once we have the information being exchanged in each member cluster, the data connectivity will not be impacted by the leader cluster. The role of leader cluster just helped us to exchange those information like the tunnel, endpoints resource and uh another resource yeah and okay. Let's move over the data paths connectivity uh here.

H

I just mentioned that we introduced a new concept about the gateway node, it's just a general node, but we pick it pick up it as our getaway node. It will be responsible to transfer to forward all the cross clusters traffic to other member cluster. Here, as you can see uh in cluster a there is a gateway node and in class c. All of the member clusters will have a gateway note and all other nodes will be just a general node and it will not. It will not talk to other member cluster directly.

H

You will see that any traffic cross cluster will go to will go first to the gateway node and then it it will be checked by our uh enter agent and decide if it's a cross-cluster traffic. If it is that material forward to another node, the remote gateway node, based on the uh based on our open flow rules, yeah this one you'll see it will be forwarded to class c, and if the party is trying to access some uh ipo the service in cluster b, it will forward it to class b and gateway node as well.

H

All the cr, all the traffic cross cluster will be go to the gateway node first yeah. Okay, uh here is uh some trd details and the tunnel endpoint it's actually it's not it's not a complicated.

H

The basic information is about the local class ip sorry id, and then the name is actually usually it will be the node name and the subnet it's what we talked about. It's a pod, sider uh used in each node and uh and also the so it's a cluster ip slider and this private, ip and public ips represents gateway. Nodes is ip, and this we used to you know when we set up some tunnel open flow rules. We need the target ip right, so we will choose private ipo public ip to do the rules.

H

Okay, let's condition. Another part is another: crd: is the tunnel endpoint imports this? uh This resource is actually almost the same as turner endpoints, but the, but the purpose is that it tells the user the mean that is some china endpoint from other member clusters. It's not a local thailand bond and it's also almost the spec, is almost the same.

H

We sorry we just reused the tanana prospect, because all we need to know is remote, uh the other member clusters uh polysider and the service uh ip slider, so we can use it during our open flow uh to set up our open flow rules.

H

Okay, uh the tunnel endpoint export input process. This actually is almost the same as the service expo import process. So it's not uh it's actually quite straightforward. It's just! uh Let's! Let me simply go through it. You know that so once the user chooses a node, that's giveaway node uh here uh the way to choose a nodes gateway node, we just simply add an annotation uh here- is a gateway annotation and to the node them.

H

Then our multicast controller will watch this kind of node event. The update is event. Then the member cluster, the member clusters controller, will create a corresponding channel endpoint to local, and you will see a local china endpoint resource being created and including just some necessary information and of course it depends on the uh what kind of a node change. If it's a gateway node do.

H

I have some uh basic uh steps to create a ton of endpoints if it's a general node, it means, for example, if there is a new node coming, then we know that there is a new part of cider will be used in this member cluster. So so it will be also reflected in our china, endpoint subnet and okay. When the entire endpoint is created locally, then the multicaster controller will watch these events, and you know it will follow the resource exchange pipeline rapids into our resource uh exports resource in our leader cluster.

H

uh Once leader cluster saw this kind of uh new creation event. It will convert it into the resource inc import in the leader cluster. So actually, when the new resource import is created, then the member cluster, the other member cluster, will watch this kind of events in leader cluster. Then it will convert it and write a new channel and tana endpoint import locally. uh Maybe if you're not familiar with a framework of multicultural might be not so it might be, some can be confused.

H

I will show you in a demo and it will help you to understand it better. Okay, you know that so once we have, that has changed.

H

We have to do something in the entire agent, so we introduced my class feature and uh in the android agent configuration- and here I just uh add a new feature here- named mathcaster and also unnecessary- a new global virtual mac- it's it will help us to distinguish the cross cluster traffic and in our current design, you know that we plan to support the in-cap mode only at least in first release. So we will reuse the existing china interface interface and uh it's so we don't have to create a another new term interface for cross-cluster traffic.

H

uh Here here is actually some sample. The open flow sample, which is uh working in the it's uh some snapshots from my poc codes- and I think maybe we don't have to jump to the detail or my one thing might be highlighted- is that there is a new field, this uh about the import that will be used because once we reuse the existing tunnel interface, it means some traffic will go this tunnel and it will also be forwarded in this through this same tunnel.

H

So we need to use this field to make sure that the send traffic can be forwarded in the same channel interface. Yeah.

H

Okay, I think that's all the uh this uh simple open flow rules, but, uh okay, there are some roadmap. You know that uh the uh there in this design- actually there are also a limitation. We didn't support the ip overlapping.

H

So once you have overlapping, I think the behavior is not ex will not be supported and we want to. Maybe the network communication might be broken, and so in the future we may support ipo, lapping and also you know in first in this design. I just reuse the tunnel interface and we will use the default uh in-cap mode. The geneve so in the future, maybe we can introduce ipsec and also the class set dns, because even we have the database connectivity, we can communicate between each part or service.

H

But you know it's not so common use to use ip directly, so it might be better to have dns in class set wider uh yeah. Okay, let me go and uh sorry let me start here and let me uh share my demo screen. uh Let me know if you have.

F

Any questions so far so long for I will ipo overlapping. You mean the the product. If you know that.

H

I think I think both why we cannot.

F

H

First, I'm not sure I haven't think about the node ip, but if it's not ip, if they're the same, I don't think it will work.

F

You know I mean, what's the use with overlapped product.

H

Oh, you know that, uh uh um let me go back to there.

H

Sorry, let me go back to that. Can you see my screen, I'm not sure.

F

So it's I can see your console, but not this like not the dog.

H

Okay, uh actually, let me stop here. Let me show my screen: okay,.

F

Steal the concealer, okay, okay,.

H

Yeah, the the reason is, with these extreme part, information, so in open flow rules. We just use the cider to decide if this part- if this belongs to belongs to the remote cluster or not.

F

This is a class ip.

H

And also protocider arch.

F

Why we have a traffic during support, I think for molecular service et cetera.

F

D

H

F

To support the direct chemical, inhibition, chords.

H

Yeah yeah this, actually they can do the same. The magnesium. I think it's almost the same, so we can remove this or we can add them.

F

Okay, yeah, okay,.

H

Okay, let me go. I have two cluster ones. uh You can see it's a c1 and another one c2 and the c1 we allow to deploy both leader and the memory constant in one cluster, so in c1 it will play as a leader and also member. Let's go.

H

You'll see that in a leader cluster or leader namespace, so we have a one multicast controller and the input system. We have another uh controller, it took place as a member. This one is leader and it will watch the our annotation uh for the note and to create hana endpoints for now- and I already have some I already already created or not pick up- one node as gateway in c2. So you will see.

H

Oh sorry, you will see there is already one tan endpoint. I choose this node as the.

D

H

Node and the in cluster y, you will see that.

H

There's nothing so I will choose one. Let me show that we have three nodes in this cluster. I will choose this one as another cluster just simply run and rotate it and and uh add a new annotation. Then our modplus controller will watch this kind of no change and it will create a new channel endpoint.

H

So you will see that we have a new uh time in the member namespace and let's go to see the export resource, export and imports in our leader, cluster or leader namespace. Here in our leader name space, we have one new resource.

H

This actually results new resource exports a few seconds ago, and this one is new created one and let's go to see the.

H

Yeah, you can see that uh it's actually a sim, it's a sim, almost the same, just a different result, a different resource, but the the content or the stack is the same because we only want to get the outsider and the suicidal right and eventually the member cluster. The c2 member cluster will get the notification of this creation, this resource information and that gets a new uh endpoint imports.

H

It will create locally. Then, once we have this being ready in local, then the entry agent will watch this kind of change and let's go.

H

Let's see that.

H

You'll see that the critical information is wiser, of course we're not critical, but so we all we are more concerned about the private ip for remote tunnel setup and also those subnets used in in a c1, a member cluster. Let's go and let's see, go back to see it's actually almost the same you'll see here, it's a private, ip and the subnet type to be it's being imported in c2.

H

Then let's go and try to.

H

Here and let's pick up one, uh I have a few parts which can help to.

D

Try some command.

H

Here, yeah, okay, this one is in c2 and let's ping, another okay.

H

Okay, now you can see the ip here we have, the slider is totally different and there is no overlapping. Then let's go and pin this yeah. You can see that so we can pin polar successfully. Let's go, and I guess.

H

Okay, this is uh ngx, let's go under.

H

Yeah, you will see that we can communicate to the service directly but, as I said, we use ip rights the ideal way. I think it's better to use the dns, but for now it's uh it's not so ideal, but the datapath's connectivity is working now yeah. I think okay yeah. I think that's all for my demo and the design presentation. Let me know if you have any question.

A

Yeah thanks a lot lan. uh We don't have a lot of time for questions. uh There are some comments from june on the chat chart that maybe we might want to discuss.

A

The only thing that I wanted to check with you just out of curiosity is that whether we need then another controller for managing gateway, node failures and doing a gateway failover or whether there is already a solution for that in your in your implementation.

H

uh Yeah that that's right you mean that when the gateway node is field, how we handle this case.

A

H

Actually, uh for now, we only support one gateway node. So when the gateway node, it's not work, it means the traffic will not be able to change forward to other member cluster, but in the future we may consider to support active active mode. Then we can maybe have a two hit.

A

H

Node, we may have a robust uh case.

A

Cool so let's say that at the moment, once a gateway node fails it's up to the user to designate and navigate to another restore communication.

H

Yeah, I think so, but if it's not accessible, the getaway node is not accessible, then I I think maybe we can update the the china endpoints resource to reflect some events or the status, but indeed at least there's no uh automatic way to recover the traffic.

A

H

A

Yeah any other question: maybe we can spend a couple of minutes more. I think zhang has a point about the needed, support and non-in-cap mode to uh to cover cloud management scenarios. uh Maybe genji you want to elaborate a little bit on this comment.

F

Yeah I just mean uh later probably, we want to also support uk gke. In this case they don't do income mode inside the customer, so we need to assemble how to support it.

F

Okay, sure, thanks and by the way for gateway mode. I think. Finally, we need to supply here active, not just ideas, since uh if the single node can become a bottleneck.

H

Yeah, okay: I will check that if we can support this in the first release,.

F

uh I I don't mean we must prioritize it, but.

D

I just feel fully. Finally, we.

F

Need to we need to think about the idea here. I do standby story.

H

Okay sure yeah, that will be our multicast two items.

A

Okay and uh just to finish today's meeting, what we're seeing today is currently planned to be shipped in andrea 1.7. Is that correct.

A

Hey, uh I don't know, okay.

D

You know the release note has been yeah submitted for review, so I think maybe today, tomorrow we can announce entry windows, 6 is released.

A

Oh okay- oh sorry, I so this is uh this is for uh andrea. uh This feature is available in anterior 1.6. Then then I.

D

Miss them you need this.

A

D

Oh, I just uh maybe a misunderstanding question yeah. I just how I said is an entry window six and though zero police do this yeah. But this feature I think, um yeah the plan is to to to support it in 107, but um but not sure that I think it is a strategy.

A

All right thanks a lot to vicky thanks for the clarification and uh do you have any.

I

Other yeah yeah ellen quick question: can you clarify the difference between public ip and private ip? The tunnel endpoint specification.

H

uh It's actually from the nodes back or no status. I think it's uh from the node information, not uh any specific meanings.

I

Oh, I see, but it seems to me that you you, the private ip. Maybe it's only routable with a within that cluster right, so I'm not sure how you could use it to create a tunnel.

H

Right, yeah yeah that that's actually a question, a good question. You know that uh I in my local cluster, I tried that so I didn't see any public ip. So I have to set the private ip uh here, but I guess we can pick up the public ip first and so make sure that they will use the public ip yeah.

I

Because I think.

H

If you're in the.

I

Public cloud, for example, if you're in the same vpc, maybe the private ips routable. But if you are, if you have clusters in different vpcs or even different clouds, and you would have to use.

H

I

H

Yeah yeah yeah, thanks for reminding I will try that. Maybe I should try that in different environments to see what will happen here yeah. Thank you.

H

A

We are already a little bit over time, but nevertheless it's been a great discussion uh before we finish today's meeting. Do we have any final question for land? Any comment on the whole multi-cluster data path story.

A

All right, it seems then, therefore, it might be all for today. I would like to thank as everyone for attending and, most importantly, many thanks to grayson and lan for providing two very nice presentations and demos. So thanks again for attending- and I wish everyone a good night good afternoon or a good day.

C

Thank you. Thank you. Thanks, bye.

B