Cloud Native Computing Foundation Service Mesh Interface, 29 Apr 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CNCF Service Mesh Interface Community Meeting 2020-04-29

Description

CNCF Service Mesh Interface Community Meeting 2020-04-29

A

All right welcome everyone to the SMI community meeting today is April 29th and welcome everyone thanks a lot for joining. If you have not done yet, please go to the Google Docs here in the chat and at yourself to the meeting attendee list, and with that we dive to jump into that. First up is Misha.

A

You suggested to talk, give a little bit of time regarding the last week's or last times, service, mashup them all right.

B

Yeah I just wanted to give folks a chance to ask questions so full full transparency like the like solo folks.

B

What service much have some API is that look a lot like as my API is that they're also very different, so I just wanted to I asked for them to give us a demo last week, because I wanted to kind of see since solo as part of our community see what they were thinking where they're at with this stuff and I think the demo is very informative and then I kind of want to after we answer any like questions kind of talk about whether we want to collaborate as a community.

B

These API is kind of overlap with SMI, so I just want to make sure there's not fragmentation. If there's a potential for collaborating, we should, and if there's not that's okay too, it's not a big deal but yeah. So are we okay to answer some questions or awesome with? Does anybody have questions they want to ask Thomas? Did you have something from last week.

C

I probably would have if I had had coffee at this morning. That's my story and I'm sticking to.

B

That, maybe we can just post a recording and like ask some questions: does anybody else have anything.

D

I do see eat it on the call. If we want to have her say anything because she was here for the the presentation last week and you know part.

E

Of it, yeah Manny and a Christian easier I mean you feel, have any question. I would love to answer so.

B

I have a question like for access control. You know, we've been thinking a lot more about or discussing a lot about identity and how do I identify what workload I want to grant access to or between workloads access between English but like some things evening about I know that in the service mesh hub worlds, there's you know you tackled access control and you have an access control policy API.

B

So I just wanted to understand two things: one: how do you do per route access control in that API and to have y'all thought about how to extend that beyond just Cooper Nettie's? And how do you do that in a world where you, like hybrid situation, say BMS or something else, I.

E

Can take the second question and that question of doing so the first one in terms of the multi workload type word. To be honest, this is an N API right. So the question is this: is this API is honored that if there is something in this API that will prevent you of using it? If you guys, if you want to extend that- and in my opinion the answer is no so now the question is implementation.

E

Details right, I mean how do you do this in this world and that's a different question right I mean we can talk about it, but it's totally different. The question is as a spec what we need, in my opinion, to figure it out if we will want to use it because again, this is as I said. My point is that this is an implementation details. It's not related to the SM to the API whatsoever, because the question is the API is owner.

E

If something like that will happen, when the user will want to do take two measures, whatever VM and silver less and cluster, and join them together, as one can do it, yes can they will be able to then route or do an access control and, in my opinion those API is owner that now, so you do this, this is implementation, then we can welcome them to it. Talk to them about them too. Yeah.

B

So let me clarify the question a little bit, I think in the API. It really like. We heavily rely on selectors like and so there's an example that says: there's you can I, don't know if it was like on a source or a destination, but you can have like a namespace selector.

B

So that's a very kubernetes specific concept. So.

E

I can explain what we doing. That's actually really really important question. Okay, so all our job is to abstract right, but what I want to abstract, not stuff that I discover what I want to abstract is stuff that the user is writing with me right. So, if he's writing whatever traffic shifting model I do that I want to abstract for any meshes, but if I'm, the user, the right now just push something to a deployment right and just for a commit. I wanted to use right now, some label to choose it in console Connect world.

E

It will be tagged, I think in VM it will be labels in Amazon or whatever I. Don't want to abstract that that doesn't make sense to abstract that because it's just going to confuse the user. So in my opinion, this selector, which is going to be extended to support more types, but it's not but I, don't think that the user, we need to say I, just push something. Let me go figure out how its defining in your system and then, let's go figure. You know what I mean.

E

It's just I think that we're actually making his life is harder. I, don't know that we want to abstract that that's my point. Yeah.

D

E

Will but the selector will be able, you know you will be able to choose namespace, but you're also going to give it to choose a tag in service console to make sense. Okay,.

B

Gotcha I mean okay, yeah, actually I think so. So let me try to explain that when.

E

If we're writing something off, we are reading something right. They were clearly something that we are reading right, so so.

B

Like you basically have this provider model for the concept of selectors and that different places where your work runs, how this has a different concept for selectors or labels, and you plan on supporting that with wine selector abstraction you mean getting that right, I think.

E

So yeah I mean and again this is something I would love to get your feedback on it. But what kind of like debating it and I felt that if I'm the one who's using, let's say a she and I'm pushing it, you know tag behaving differently. They have a different concept and you know: label they've, been community, I mean I, just felt that it wasn't right to you kind of like abstracted and I think that it will confuse the user more than it's actually helped. So we try to separate between the read and the write.

E

If this is something that we're reading, you know we got this feedback on glue, so this is where it's coming from I mean glue. We had this concept, we did try to abstract it. We had the concept called upstream and a lot of for user come and said I'm using kubernetes. Why do I need to learn something you call upstream? Why do I need to look for my stuff I already have service. Why do I need to do this so right now in blue?

E

We actually supporting also that, if you're using basically be extended, the selector right, you can use service, you can use whatever the console equivalent to this and so on and and I think that this is feedback that we got from the community. But again we can decide it. If that's what we want to do, that's it's our decision, yeah and that's.

A

B

Your questions.

A

Been answered or.

B

Is that okay, okay, wait.

E

Wait wait but Christian didn't answer. So if you have other questions, you ask the question and Christy to answer the second one yeah.

F

And your question was specifically around how it relates to traffic targets in SMI, I. Think yeah.

B

How do you do per route configuration program.

F

Completers right, so the access control policy, just like our traffic policy, has either you know you can be very coarse grained and in terms of how you specify the rules or it can be very fine-grain, so you're, selecting a set of identity, workloads, we're close I have a certain identity and you're describing to what targets they have access and if you want to get very, you know very specific about which specific workload to which specific destination that the API allows them.

F

B

I understand that per workload, but I guess I. For us. We have like the HT route group spec, which allows that per about granularity and I just didn't see that in the doc. So maybe this is an offline conversation. Maybe you could point me to an example of that I.

B

See your mouth is moving, but I can't hear you I'm.

F

Sorry yeah, you know that we can take it offline, I love the dots all of the proto's for these API. It's are documented online I. Can let's take this back on this talk and I can point you to the right direction. That.

B

Sounds good and then just to wrap this up, because I know we don't have time that much time I just like I'm just bringing this up, because I think it would be helpful for us to be in a situation where people are trying to say it's all the same problems. Collaborate! So that's why I'm trying to expose this conversation, and we should talk more about whether we want to go that route or not in slack.

A

Thank you thanks a lot II didn't Christian for I'm, saying all of that, and if there are more questions, just put them in there in the Google Docs we'll follow up there and we're moving on okay.

E

A

Thank you, and next one is Richard Wright you're, going to cover there I just.

D

Wanted to bring to everyone's attention that we do have an S. My fact that I Oh blog Michelle and I wrote the very first post, which was just hey. We are a CN CF project now, but there is an issue if there is a link, I put a link in this zoom chat and there is a link in the meeting notes.

D

If you have opinions about what guidelines should be for community members to write blog posts, we have a proposed blog post and a few other ideas already, let's get your ideas in there by the end of this week. If you care and whatever opinions we have by the end of this week, we'll run with them and we'll get that proposed blog post from solo out, hopefully, and then hopefully, everyone else's. That's all I have them.

A

Thanks a lot and next up, we have the spec conversion web hook. I think Leckie put that on and I don't.

B

Think he's here, Simon yeah I'll cover that line, so there's a few different things related to versions and conversions and all that other stuff. So let me start by like the most high level of conversation, we've got a lot of like confusion around versioning I. Think it's because, like at a high level, SMI doesn't have a specific version like the whole thing, and then you have different parts of this back like traffic policy, access control and metrics, which have their own api's and those have specific versions.

B

So, as we've been changing, the api's we've been changing. Sorry yeah we've been changing just the API version. We haven't been tagging like the entire spec with a version, and so we changed what happened, what the workflow we decided.

B

It should be, and I've been following for a little while now is you change the API, so you just API in the spec and you tag that with like a version and so that my BB 1 alpha 1 V went off a to be when alpha 3 and then you go to the SDK and you update, update the API. Is there to actually reflect the whatever version it is, and then we have a release process of like for the actual SDK and we do update the SDK version, which consists of different versions of the API.

B

Ok, so, like that's a lot of versions, so I think what is it Adam? Who that question do you know and Bridget yeah, so I think I'm suggested.

B

We should start by untangling this mess by putting the different versions of each of the components of the spec into their own directories, so that you have like historical context on you know like the actual API versions, but I think that also so there was this conversation in that thread whether we want to use release branches to like identify changes to be like spec and that's something that we can talk about. Its defined I know you're on here, and you were put on about sometime.

B

We can discuss that a little bit further, but I would kind of like to understand what that branch name would be like and what that process. But look like I still think. There's this higher level issue of there is not a version on the actual spec, so I did put in that issue. Some prior art like scene AB. Does it a certain way, OC I? Does things a certain way? Tough?

B

Does things a certain way, so anyways I just wanted to just start that conversation here and see if there was some consensus on it, so we can finally get versioning out of the way like a year.

A

B

First, issue is owned by Adam and Stefan has contributed to it, and so has she Sean okay,.

A

um Given that we still have two other topics, I just want to make sure that we are conscious of the time. So what? What is the outcome? But do you want to get out of like just awareness or do we have a concrete next step or what wasting I'd.

B

Like to hear out, maybe we could spend two minutes just hearing out opinions on the issue and then we can take it back. Eight odd line to the issue.

A

So Stefan do you have anything.

G

Yes, so if we are doing sample releases and we cut a version from master I'm, okay with having a directory API spec and each version inside that directory and when we cut assembler release, that's actually a branch at the patch branch. So we can look at that branch and see. Okay, I want to use the latest or I'm having this version. What API works with which other API, for example, we have HTTP routes and traffic splitting you need to use alpha three from one ways alpha two from the other.

G

So if we can express these things by doing simple, delicious and having directories, I think that's that's the easiest approaching.

A

So quick, quick, stop all from people who are on the call. Does anyone have check to using assembler here? Is there anyone likes? It's like.

D

A

Though, let's not do that just to get a feeling I mean if nothing, we could just probably move to that lazy consensus and say yeah. Unless we hear any objections and there and the issue.

B

It's a little bit hard to use like we just need to clarify what it means to use summer-like whip because I understand how it's done in code, but it may mean something slightly different for specs. So there's prior art anyway, should look at that. A little bit is.

C

There, but just to speed the conversation that is there any reason we couldn't just do a PR, that's got what the suggestion is. It is and then review the PR and merge like I, I trust, Stephan and Michelle, and everyone like pick what you think is the right version strategy and, let's just stop talking about it and merge this sucker.

B

Sounds good so.

A

G

That for four days, DK in the SDK now in each each API, spec has all the version inside because without it you cannot just upgrade from one of our so already did happen. Sdk we could go with the directory approach for the spec as well and synchronize the tool, but the problem I'm, seeing right now with with the conversion hoop, is the fact that, except for the traffic split, all our other API is the specification is not kubernetes compatible. We don't use the spec object as the top-level, so we can have do conventions.

G

So first we have to do a breaking change at the spec top top-level to every single customer resource we have in there modify the spec. Tell everybody hand. Sorry we did mistake at the beginning. We have a top-level stacks in some case which is like yeah, so we should. We should normalize things and yeah katal release with the proper API. That's compatible with how good does it I mean? The object. Interface in kubernetes specifies that you have to have a cop levels back and we don't have that, except for the dragstrip.

B

That's a really good point.

A

Okay, any more comments on that work. We use essentially get happen to power of github to continue that discussion in code for this back going once going twice: okay, let's move on to the UDP spec manual. Can you little bit of a background of.

H

That is that we that we, that we implemented GDP support or are in the process of implementing UDP support and then in recent many recent refactoring, we kind of went to like a feature like approach, so you can now enable ACL or not in and then particular on our mesh and as ACL enabled means that actually, everything that is not explicitly enabled is like disabled.

H

There is no UDP spec as of now, so we couldn't enable any UDP traffic because, like there is no way to enable it so I came and wanted to start the discussion on how how the UDP spec could could look like as a first draft and tell me something that one is that I basically just took the TCP, because it's just raw traffic and took it for UDP. So now the question for me is rather well. Is there anything missing? Is there something like? Well? What does it take to move that on? Let's say.

A

In general, given that we have get happened here, you can actually request someone to review that. I would really strongly encourage everyone to actually use github in the way it's meant to be used. So if you put something in I mean it's, it's always good for awareness or if there is some, you know architectural background that needs to be discussed to put that on the document.

A

But if it's simply like hey, you know, I've put that in there can someone review that I would say that just requests, I, don't know two or three real years and then, if there's like you know, you feel like it's blocked. No one is taking it up or it takes weeks until someone does it, and you know it makes sense to escalate that to the group and say hey well, do we need a different approach there whatever, but so.

G

Request attention.

A

G

Pull requests on the SMI spec request everyone to review it. This is done through github, so you don't have to ask it because github would send you a notification. Hey. You need to review that my why I didn't want to review. It is the fact that, if I'm looking at this definition, like the same thing with the spirit, it has no specking, it's just it's just a metal at the enemy. There's, not people know kubernetes object right. How is that respect if it has no speck inside.

A

Also, that is a valid comment on for requests right.

G

So we got the TCP specification in there that has the specs. We need to figure out participe first, which is reading there with no spec. What what are we going to do with that? What's the actual specification, then we can go back and update the UDP spec to match this piece back and much as INXS.

H

B

A

B

Do you think I.

A

B

We need to talk about that and like we should have an issue for the TCP spec and updating updating that piece.

A

Absolutely Stefan: can you create an issue and link it to that PR, but we have keep it on track. Yeah.

G

You know I'll create an issue for this p1 and I will refer the full equals for the the p1 to specify that it's on hold till we solve the TCP shouldn't be hard to just find something in the spec, then hey type PCP or something because this is just an object and we cannot react to it from a controller perspective because has no spec so good.

A

We have one more topic on the agenda today and that is support for routes. Richard again it.

D

Is me again because I was looking at the issues and pull requests and the repos I was excited to see there were a bunch of polar across requests around this topic and then I realized that only I think Stephan and maybe one other person had even looked at some of them and I thought I hate to leave these sitting here. Developing merge conflicts over time. So, um since it's fun, do you want to tell us your thoughts on this? Since you have the most context, probably since you've reviewed some of these route support pull requests?

D

What do you think is the right step forward to get these moved along.

G

As I said last time, I I approved it, but I'm not going to work it until Tomas approves it as well, because it has like the major impact on all the major. The only implementation of this stack is in linker d-n-a link I'd, be member, made the pull request and proved it while I need another link, remember to get the thumbs up.

A

Necessarily a link ID member but Lee- is that something you might want to have a look at or is that something you could manage? Yes,.

H

A

For volunteering you there but yeah it's so.

H

A

H

A

Uncomfortable position and escape.

H

A

Yeah I owe you one awesome thanks a lot so look we have one more review there and then potentially can convert you too. Unless there's something also happy to have a look at that cool, we have three minutes left any other business. Do we have any demos coming up anything you want to see us discussing in two weeks time, any other, maybe from our new members or anything.

B

I'd like to put on the schedule for next week to follow up on the items that we discussed this week. So we make sure we close things out.

D

Yeah I'll take care of adding note anyone who didn't put their name on the attendance list. Please go ahead and add yourself.

A

D

A

We also need volunteers for next week.

D

If somebody wants Michaels jumper so do you wants my job go ahead and put a note on the dock or say something on the chat here in the next two minutes. We want to rotate this wrap.

A

All right: well thanks a lot and see you in two weeks time right, yeah, all right. Let's keep reviewing thanks.

G

A lot everyone.