►
From YouTube: BoF: Introduction to Contour, A High Performance Multitenant Ingress... Michael Michael & Nick Young
Description
Don’t miss out! Join us at our upcoming events: EnvoyCon Virtual on October 15 and KubeCon + CloudNativeCon North America 2020 Virtual from November 17-20. Learn more at https://kubecon.io. The conferences feature presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
BoF: Introduction to Contour, A High Performance Multitenant Ingress Controller for Kubernetes - Michael Michael & Nick Young, VMware
This session will show how to leverage Contour and Envoy for Kubernetes workloads. Contour is a high performance ingress and load balancer solution for Kubernetes, offering a richer feature set than some common alternatives. At its core, Contour is providing the control plane for the Envoy edge and service proxy. We will also present an introduction into how Contour plans to leverage service APIs (also known as Ingress v2). More information at https://projectcontour.io/
https://sched.co/b6H3
A
Hello,
everybody
and
welcome
to
our
presentation.
Today
we
will
be
talking
about
contour,
a
high-performance,
multi-tenant
ingress
controller
for
kubernetes
we're.
We
are
your
presenters
today.
My
name
is
michael
michael,
I'm
one
of
the
contour
maintainers
and
a
product
lead,
I'm
a
director
of
product
management
at
vmware,
and
you
can
find
me
as
ad
m2
on
the
kubernetes
slack.
A
Thank
you
nick
all
right.
So
what
is
contour
so,
if
you're
not
familiar
with
an
ingress
controller,
essentially
an
increased
controller
is
a
kubernetes
object,
type
that
enables
you
to
basically
send
networking
traffic
from
outside
the
cluster
to
some
of
your
deployments
and
your
pods
and
your
containers
running
in
a
kubernetes
cluster
and
now
contour
is
really
an
open
source,
ingress
controller
and
it
provides
a
control
plane
for
the
envoy
edge
and
service
proxy.
A
Some
of
our
key
advantages
is
that
we
support
dynamic
configuration
updates.
We
are
actually
very
secure
and
we
enable
a
multi-team
increased
delegation
out
of
the
box
and
essentially
maintain
a
very
lightweight
profile.
The
way
the
way
and
the
reason
that
the
build
contour
is
that
it's
a
very
simple
ingress
control.
A
That
does
one
thing,
and
does
it
very
very
well
and
that
http
layer,
7
ingress
for
your
kubernetes
deployments,
contour,
was
started
at
hepteo
back
in
september
of
2017
and
last
november
we
released
our
version
1.0
signaling
to
the
community,
that
we
have
a
stable
api
and
we
can
have
our
users
to
be
able
to
start
deploying
contour
in
production
and
then
in
july
of
2020
we
were
able
to
donate
contour
to
the
cmcf
at
the
incubation
level.
So
now
we'll
have
open
governance.
A
A
What
are
some
of
the
contour
features?
So,
let's,
let's
take
a
look
at
the
kind
of
the
main
features
that
contour
is
delivering
today?
It's
an
advanced
ingress
controller.
That
is
a
significant
update
from
the
built-in
ingress
that
exists
today,
will
allow
you
to
safely
use
multi-team
ingress
in
kubernetes.
What
that
means
is
that
if
you
have
two
different
teams
that
are
in
the
same
cluster,
it
is
very
important
that
those
two
teams
don't
override
each
other's
settings,
so
contour
enables
that
multi-tenant
delegation
of
ingress
objects.
We
also
have
new
concepts
like
inclusion
and
conditions.
A
Allow
you
to
do
to.
We
allow
you
to
do
dynamic,
reconfiguration
and
you're
gonna
see
some
of
that
in
our
demo.
Allow
you
to
do
mirror
service
capabilities.
We
have
requests
and
response
header
manipulation.
We
can
do
host
rewriting
to
external
domains
and
we
also
have
prefix
rewrite
support.
So
a
lot
of
the
features
that
are
needed
by
users
today
to
be
able
to
safely
send
traffic
to
the
kubernetes
objects.
A
We
consider
ourselves
to
be
a
very
good
cnc
ecosystem
citizen,
we're
built
for
kubernetes
we're
reusing
envo
inside,
so
we
didn't
go
and
implement
our
own
proxy
and
were
using
one
of
the
other
graduated
projects
in
the
cncf
ecosystem
envoy
and
now
we're
also
a
cncf
incubating
project
as
well
and
from
a
security
standpoint.
I
kind
of
mentioned
this
already.
We
do
secure
ingress
delegation.
A
From
an
architecture
perspective,
I
want
to
show
you
all
a
couple
of
key
pieces
here
when
an
end
user
tries
to
access
a
website
like
https
xyz.com
blog
that
traffic
is
going
to
come
from
the
outside
of
the
cluster.
It's
going
to
hit
the
load
balancer
that
you
have
deployed
in
your
environment
and
from
the
load
balancer.
It's
going
to
hit
the
envoy
deployment
inside
your
kubernetes
cluster.
A
That's
the
envy
deployment
that
gets
deployed
as
part
of
kubernetes
now
envoy
is
going
to
act
as
your
label,
layer,
7
layer,
4
proxy
here,
and
it's
going
to
send
the
traffic
directly
to
the
pod
deployment
that
you
have
inside
kubernetes,
so
notice
that,
in
this
traffic
pattern,
contour
is
not
in
the
data
path.
Contour
is
a
control
plane
for
envoy
and
it's
not
in
the
data
path.
Now
envo
is
going
to
take
care
of
everything
from
low
balancing
your
request,
based
on
configuration
and
routing
them
to
the
right
place.
A
How
does
it
do
that?
Well,
contour,
the
way
it
gets
deployed.
It
listens
to
the
api
server
to
watch
a
lot
of
the
different
objects
that
we
need
to
make
sure.
We
understand
in
order
for
us
to
properly
configure
invoice
so
we're
looking
watching
objects
like
ingress
services,
endpoints
secrets,
http
proxy
and
in
the
past
we
also
used
to
monitor
ingress
route,
which
has
been
deprecated
so
as
we're
monitoring
all
these
objects
from
kubernetes.
A
C
The
acceptance
of
that
is
obviously
cves
or
other
security
issues,
either
contra
internal
or
envoys,
we'll
ship,
a
patch
as
close
to
immediately
as
we
can
manage
recently
we've
some
of
the
big
features:
we've
shipped
are
client
certificate
authentication
using
our
crd
http
proxy.
That
allows
you
to
make
sure
that
the
person,
the
client
that's
connecting
to
your
service
is
the
one
that
you
think
it
is,
and
it's
all
handled
at
the
envoy
level.
A
So
so,
let's
talk
a
little
about
roadmap.
Like
nick
mentioned,
we
ship
pretty
much
on
the
can
on
a
monthly
cadence,
but
we
also
have
a
very
well
documented
public
roadmap,
that's
linked
at
the
bottom
of
the
slide,
and
I'm
going
to
outline
some
of
our
key
goals.
You
know
at
the
top
of
our
goals
is
to
closely
align
with
the
upstream
effort
around
what
used
to
be
known
as
ingress
vis2
or
the
next
generation
of
ingress.
A
A
Now
we're
going
to
take
a
lot
of
those
learnings
and
we're
going
to
help
the
upstream
networking
community
and
the
cncf
in
the
kubernetes
community
to
design
the
best
possible
service
apis
we're
going
to
take
a
lot
of
the
learnings
from
contour
and
apply
them
to
service
apis.
But
at
the
same
time
we
want
to
make
sure
align
with
service
apis
and
contour
is
one
of
the
first
solutions
to
implement
the
new
specification.
A
We're
also
going
to
start
giving
you
an
easier
way
to
deploy
contour
by
some
deployment
enhancements,
as
well
as
a
helm
chart.
So,
as
you
can
see,
we
have
a
very
good
pulse
of
our
community
and
we
want
to
make
sure
we
listen
to
them
and
get
all
those
requests,
prioritize
them
and
then
deliver
them
on
our
roadmap.
A
Our
community
for
contour
has
been
thriving
so
far
as
you
can
see.
We
have
over
100
contributors,
almost
25
000,
github
stars,
300,
plus
forks
five
maintainers
50
releases.
A
hundred
companies
are
contributing
to
contour
today,
650
slack
members,
lots
of
blogs
and
cubicon
talks
and
presentations.
Lots
of
twitter
followers.
If
you
want
to
engage
with
us,
come
on
over
what
a
welcoming
community
go
to
project
contour
dot
io
find
our
community
meetings
we
meet
very
frequently
in
time
zones
are
both
friendly
to
europe,
asia,
as
well
as
the
united
states.
A
If
you
want
to
come
and
fix
some
bugs,
we
tag
our
bugs
as
good
first
issues,
so
you
can
get
started
with
some
of
the
easy
bugs
in
our
in
our
repo
but
come
and
engage
with
us
we're
on
slack
mailing
list
twitter.
You
have
a
github
here
and
we
record
pretty
much
every
presentation
and
meeting
that
we
have
and
you
can
find
it
on
our
youtube
playlist
on
the
right
so
now
giving
you
a
good
overview
of
what
contour
is,
but
seeing
is
believing.
So,
let's
switch
to
a
demo
by
nick
young.
C
C
C
C
Definition
sets
up
the
same
fqdn
same
tls,
details
and
says
all
traffic
should
be
routed
to
foo
on
port
80..
So
it's
exactly
the
same,
just
a
slightly
different
container
for
holding
in
in
this
case.
So
you
can
see
here
that
this
is
the
the
fu
website.
They,
you
know
they
make
squizos,
they
don't
even
know
what
they
are,
but
they
make
them
anyway,
and
but
you
can
see
this
is
all
working.
I
can
refresh
as
many
times
as
I
like
everything
is
up
and
running.
C
A
This
is
perfect,
so
I
so
so
nick
this
is,
you
know
this
is
a
great
way
for
a
kubernetes
operator
to
kind
of
delegate
the
administration
and
the
configuration
of
this
ingress
to
the
team.
That
kind
of
owns
the
application
as
well
so
in
this
case
you've
delegated
to
the
bar
marketing
team,
so
that
they
kind
of
own
their
own
feed
in
terms
of
both
configuring,
their
increase
and
configuring.
The
routes
in
a
way
that
makes
sense
to
them.
C
C
In
this
case,
the
condition
the
condition
set
is,
as
as
we
could
see
earlier,
the
the
condition
said
that
they've
been
given
is
just
that
it
has
to
be
slash
campaign,
so
anything
that
goes
to
bar
dot
young
dev,
that
that
does
campaign
will
be
routed
to
whatever
is
in
this
special
offer
thing.
So
if
they
create
further
routes
inside
that
special
offer
one,
then
they
can
further
subdivide
their
thing.
They
can
even
further,
they
can
add,
includes
into
their
own
one
and
subdivide
the
responsibility
even
further.
If
that's
what
they
want.
A
B
C
That's
right,
and
one
of
the
reasons
that
we've
built
a
lot
of
this
was
just
to
really
enable
people
to
have
this
sort
of
more
centrally
managed
setup,
because
we
found
one
of
the
things
when
working
with
customers
was
that
we
found
was
that
you
know
sometimes
with
ingress
and
other
things
that
weren't
built
to
have
that
that
that
there
would
be
times
when
people
would
inadvertently
stomp
on
each
other's
config
and
you'd
end
up
with
your
website
outages.
Just
because
someone
applied
the
wrong
config
to
the
wrong
cluster,
which
nobody
wants.
A
C
C
We've
got
a
question
from
I'm
sorry
I
may
pronounce
some
names
incorrectly
sham,
I
think
says:
isn't
the
hdb
proxy
feature
overlap
with
a
traffic
split
feature
of
a
service
mesh
I'll
there's,
as
I
said
I'll
answer
a
few
together,
willem
de
asks
says.
Many
of
the
features
in
road
map
are
similar
to
some
other
features
offered
by
ambassador.
What's
set
or
sets
contour
apart
and
sham
also
asked.
C
C
It's
designed
to
have
a
central
team
be
able
to
parcel
out
access
to
some
parts
of
a
website
so
that
so
that
you
can,
you
know,
delegate
control
of
parts
of
the
website
and
have
the
team
there
be
able
to
do
anything
they
like
with
that
part
of
the
website
and
so
the
I
think,
so
that
sort
of
that
that's
sort
of
one
of
the
things
that
sets
contour
apart
from
ambassador,
and
it's
also
the
thing
that
you
that's
what
we
mean
by
multi-team
support.
It's
really.
C
It's
really
useful
for
multiple
teams
to
be
able
to
coordinate
via
the
api
once
the
central
team
sort
of
sets
the
things
up,
then
then
the
multiple
teams
can't
step
on
each
other.
That's
what
that's!
What
http
proxy
is
designed
to
do
so,
and
I
think
many
like.
I
think
that
willem's
question
is
quite
fair.
You
know
yeah
many
of
the
features.
C
Many
of
the
features
on
the
roadmap
are
pretty
similar
to
what
our
friends
over
at
ambassador
that
do,
but
I
think
that
the
the
delegation
feature
is
probably
the
big
thing
that
sets
says
contra
apart
from
a
lot
of
the
other
ingress
controllers
out
there.
Now
I
can
see.
Stop
me
if
you
want
to
answer
any
michael,
but
I'll
keep
going.
Otherwise,
no.
C
Go
ahead,
thank
you.
Yeah
no
worries,
so
I
can
see
yeah
there's
a
couple
questions
about.
You
know:
what's
the
difference
yeah,
how
does
an
ingest
controller
compare
to
an
api
gateway?
Well,
I
mean
they're
kind
of
different
things.
An
ingress
controller
is
about
getting
traffic
from
outside
your
kubernetes
cluster.
To
inside
that's
it.
C
A
lot
of
the
ingress
controllers
have
grown
api
gateway-like
features,
so
contour
kind
of
has
a
little
bit
of
that
because
of
the
ability
to
route
things
based
on
stuff
based
on
headers
and
to
different
paths
to
different
services,
and
some
other
things
like
that,
but
it's
first
and
foremost
an
ingress
controller
rather
than
an
api
gateway.
It's
kind
of
an
ingross
controller
that
has
some
api
gateway
features
rather
than
the
other
way
around.
Mark
jensen
asks.
C
Are
there
any
features
missing
in
contour
compared
to
what's
in
ingress,
nginx
yeah
yeah?
There
are
at
the
moment,
most
of
most
of
the
build
most
of
the
features
that
we're
missing
are
on
our
web
map.
Some
of
the
big
ones
are
external
auth
and
a
few
other
extra
configurability
options.
One
of
the
things
that
we
have
tried
to
do
with
contour,
though,
is
to
avoid
using
annotations
to
configure
a
lot
of
these
options.
C
I
to
you,
engine
ingress
engine
x
is
a
great
product
that
is
really
flexible,
but
one
of
the
problems
that
I
have
with
it
is
that,
if
you
want
to
configure
anything,
you
need
to
go
to
a
page
that
has,
I
think
I
counted.
It
was
a
hundred
and
a
hundred
and
something
annotations
that
you
that
you
might
need
to
configure
and
so
by
designing
our
own
cid
we're
trying
to
make
it
a
little
easier
to
only
take
the
bits
of
complexity
that
you
actually
need.
C
So
there
are
a
couple
of
other
questions
about
envoy
igor
asks:
do
we
provide
the
ability
to
integrate
custom
filters
into
envoy
that
works
together
with
with
contour?
We
currently
do
not
know.
We
have
talked
about
that
a
couple
of
times,
but
we
haven't
been
able
to
come
up
with
a
good
way
to
do
that.
C
Yet
if
you
would
like
to
talk
to
us
more
about
that
and
about
your
use
case,
I
would
please
come
and
visit
us
in
our
in
contour
on
the
kubernetes
slack
or
log
in
issue
at
github.com
project,
contour,
contour
and
yeah.
I'd
love
to
I'd
love,
to
hear
more
about
your
your
use
cases
there.
The
same
the
same
goes
for
wolfgang's
question
about
the:
is
it
possible
to
use
the
envoy
async
ssl
handling?
C
So
I'm
not
exactly
sure
what
you
mean
there,
I'm
you
will
terminate
there's
a
cell
connection
or
pass
it
through
as
you
wish.
So
I'm
not
exactly
sure
yeah,
both
basically
contra
is
all
about
providing
you
a
relatively
easy
to
get
started
with
http
ingress
experience
that
can
grow
with
you
as
you
need
to
tweak
bits.
C
A
Yeah
also
nick
one
thing
to
note
to
everybody
is
that
we
have
midday
maintainer
office
hours
later
on
today.
It's
gonna
be
at
eight
o'clock,
central
east
european
standard
time
or
1
p.m:
central
u.s
time
zone,
depending
where
you
are
so.
If
you
want
to
have
a
bi-directional
conversation
with
us,
please
come
there.
We
can
also
talk
to
you
on
slack.
You
can
attend
one
of
the
contour
community
meetings.
There
are
many
many
ways
that
you
can
interact
with
our
with
our
team,
depending
on
what
your
schedule
allows.
C
Yeah
yeah
so
manuel
asks:
do
we
support
host
port
mode
to
skip
the
ob?
So
I
mean
I,
wouldn't
you
wouldn't
want
to
skip
the
envoy
proxy,
but
we
do
support
any
any
way
that
you
get
your
traffic
to
envoy.
We'll
work
with
contour
all
contour
does
is
take
the
kubernetes
config
and
give
it
to
envoy
and
then,
as
long
as
you,
your
traffic
can
get
to
the
envoys,
the
outside
port
of
envoy
and
and
then
get
to
the
the
pods
that
it
needs
to.
C
Then
any
deployment
of
envoy
will
work.
So
hopefully
that
answers
your
question
manuel
shum
asks:
is
it
possible
to
restrict
the
namespace
to
use
a
specific
fqdn?
Only
well
yes,
in
a
way.
The
way
that
you
do.
That
is
that
when
you,
when
you
create
http
proxies,
you
can
make
it
so
that
hp
proxies
that
contain
fqdns.
We
call
a
root
http
proxy
and
the
they
can
be
restricted
to
only
a
certain
set
of
namespaces
and
so
that
only
a
certain
set
of
users
can
create
them.
C
C
A
It's
awesome-
I
I
know
it's
early
in
the
morning
for
some
of
the
us
time
zones
afternoon
in
europe,
but
we're
seeing
great
attendance
here.
So
thank
you
all
for
coming
to
our
project.
We're
actually
very
excited
to
be
part
of
the
cncf
now
and
looking
forward
to
take
control
to
even
greater
heights.
So
yeah,
absolutely
one
more
question
by
igor.
C
Yeah
so
igor
says
it
would
be
good
to
have
a
solution
for
public
and
private
ingress.
You've
customized
your
contour
for
yourselves,
but
the
standard
solution
would
be
better.
So
I'm
not
sure
what
you
mean
by
public
and
private
ingress,
but
maybe
that's
something
we
could
talk
about
more
on
slack
afterwards,
but
the
yeah.
C
C
C
C
C
To
your
question,
he
did
okay
right
right.
Okay,
yes,
so,
yes,
igor
thanks
for
that
right,
I
see
yes,
and
thanks
for
thanks
wolfgang
for
explaining
more
so
yeah
eagle
yeah.
The
best
way
at
the
moment
to
do
that
is
to
is
to
split
the
is
to
split
the
contours
and
restrict
what
contours
have
access
to
to
the
different
services.
C
Excellent.
Thank
you.
Thanks
for
the
question
ziggler
and
yeah
wolfgang
yes
right
now,
I
don't.
I
don't
think
we
have
anything
to
do
that,
but
yeah.
If
you
would
like
it,
please
come
along
and
come
come
to
the
repo
and
create
an
issue
and
we'll
talk
about.
It
sounds
great
and
thanks
andrew
for
the
nice
comments
as
well.