Cloud Native Computing Foundation Service Mesh Interface, 10 Jun 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Service Mesh Interface Community Meeting 2020-06-10

Description

Service Mesh Interface Community Meeting 2020-06-10

A

All right welcome to our bi-weekly, as my committee meeting today is June 10th 2020 and if you haven't so yet pleased at yourself to the Google Docs that were shared or you got an eject all right. Let's see where we are thanks for ascribing Bridget and I. Think that's actually more agenda item gonna see its blog post suggestions all right. So that's issue. 36 yeah,.

B

So we had um I added this one, because we had talked a little while ago about getting community members to write blog posts and I know. The fine folks from solo were interested in writing one about service mesh hub as an example of an implementation and I talked to Betty this morning. He did I see us on the call I talked about it this morning and she was saying yeah. They still are interested in writing that mm-hmm.

B

It looks like a few people commented or gave ideas about what would be a reasonable community. Implementation of blog post went to wit, if we had to people approve as per usual, but they were not from the same company as the blog post. I just wanted to kind of circle back and see how everyone felt about that.

A

C

A

We have anything actionable around that.

B

I think, since it looks like we're getting kind of lazy approved, people are either yes or I'll, write up guidelines in the blog or in the SMI spec that IO repo and then make it very easy and clear from you know, give people a template to submit an issue to put a blog post up. Does that meet.

D

With anyone's questions approval, that sounds pretty good to me. What was the so? To recap, the only requirement is well. You know that the topic is relevant and the pretend that the blog is reviewed and approved by two independent parties. Yep.

B

I and I will write a little bit more clearly, but I did write in the issue. Some proposed guidelines that people seem okay with and basically that it can't be an ad for a commercial product. You can mention your product, but like it has to be interesting and actionable by people who are not buying something from you.

E

D

E

A

A

Looks like the.

A

Top level spec update, let's pull request, 169 right and that's again: new britta'd, oh I,.

B

Added it, but I don't have a ton of more insight. It was actually define wanted to put this in. So maybe if you can clarify Stefan.

B

Can't hear you sorry sorry.

E

We're talking about the spec request yeah, so we decided we want to do that, normalize our custom resources, so they are conferment with the kubernetes object. Interface I think it's called so yeah. We need one more approval for that, and these four requests blocks the HTTP route, one because I don't want to create a pull request to add spec to the HTTP route. Until we decide that ok, everything should have a top-level spec to get someone on board today to merge this one.

E

Then we can I can move forward with the route we should also discuss. If we have time today how? How are we going to deal with this kind of breaking change in the SDK.

F

Sounds good I approved it and I'm definitely I'm when I discuss um I had to deal with that an ass BK because it seems like the versions are completely like all the previous versions are going to be completely and compatible and you'd have to delete all your objects, because this isn't even something that the conversion web bug could really handle right, yeah. um Well, it's alpha. Yeah.

E

My proposal is, we just make a new release of the SDK, create a release. Note a document on the release. Node again the change link back to the spec make.

B

E

Aware that you are doing this.

F

I'm in favor I also don't see another path forward, but we probably want to just make sure the link ready folks are okay with that and the console folks are okay with that, since both of them have implemented traffic target and traffic's back.

F

E

F

Ask in the channel.

E

F

Link or D doesn't have traffic target and spec, oh my god, but they do have specs right because do they support? Actually they don't support b1 alpha 3 of traffic split, so they the spec doesn't matter console is the only implementation. So we probably want to just run us past them and get an approval.

E

F

E

Change windbreak console as well.

F

Which HP HTTP route change if.

E

We had respected oh.

F

Yeah, the traffic specs right, yes,.

E

F

Well, alright, let's follow up in the channel and try to get it result. Today. I know it's late for the console folks.

E

But anyway, I couldn't find any and semi implementation for console, so I'm, not I'm, not sure console actually uses a semi or is just that project. There's a showcase that this is how a semi could work with console.

F

Yeah, did you see the adapter repo.

E

Like six months old, there is no mention of it on the console dog snoring, the console connect hand chart, so whoever is using. It must be aware that it is purely experimental. That's.

F

A

Have anyone here on the call who could comment on that? Who knows about.

E

A

Okay, so what do you suggest to do about it now? I.

F

Need to follow up on the slack channel and most likely it'll just be fine, I, don't think anybody's gonna disagree. I just want to make sure everybody's aware.

F

So so fun I can I can ask Megan, take this up on the slack Channel.

A

Any other comments on that one, or can we move on to the next agenda item.

A

The next one is spike alia, conflicting HTTP headers from traffic split and traffic spec.

A

C

So hi everyone, my name, is Kalia um I work with Michele at Microsoft and so well. I was wondering about v1 alpha 3 for traffic split, because that allows you to specify HTTP headers for that and but so does traffic's back. So what do? What's the guidance for if the user configures a traffic split with headers that conflict with the ones in traffic spec.

E

So traffic split does not support Heather's, it sports a reference to spec, where you specify that.

F

Okay, I think she meant a comment: tropic target right, Oh traffic target sure so like if you have em.

F

If your access control policy has one thing and then you create a traffic split which references a trap expect, but that or that implemented like actually executing that traffic split is not possible because of the policies you define or the specs you define and traffic target and reference and dropping target. How should we deal with? How should an implementation deal with that? Is there any guidance around it? Have we ever talked about it? I think that's a big question on our mind. Call you have anything else to expand on that.

E

Okay, so the various cases you create two HTTP route groups with conflicting headers in them: yeah whining the traffic target and the other one in the traffic speed right, yeah.

C

E

So the traffic split will dictate how traffic flows and target will block the traffic for that header. I, don't see where the contact is I.

F

Think one of the questions I personally had was like, should we mention in the spec anywhere what happens when these? When this conflict arises? Should we explicitly state that, in my opinion, it should be the implementation that handles it, and so, if there are errors that need to be bubbled up or the user needs to understand that this split is not possible or you know the errors that are coming because of this conflict between the split and access policy? That, in my opinion, ish is.

F

It is up to the mesh provider, but it would be helpful if I think the spec kind of talked about this type of behavior I. Don't think that we explicitly state that these are independent functionality that don't necessarily we don't handle them overlapping and they're overlapping or conflicts between them. Overlapping is something that the provider has to deal with.

E

Yeah I think it goes back to the status discussion right. I. Think that's right! So, let's imagine on the traffic target staple sub resource the.

E

Implementation should report that this is blocked. Oh no, on the traffic split, the three port. Okay, this is brought by the traffic target, and this way is not specific to the implementation. Anyone can look at the staple sensor and see that okay, this route is blocked by this. Other definition.

F

Yeah uncreate I'd be a good thing to to to make sure the implementation deals with and then I guess when a policy is applied.

F

Does that mean that does that mean that the status of all relevant traffic slits get updated too, because I think like oncreate? It makes a lot of sense to update the status, but if you want to deal with conflicts all the time it just might be heavy burden on the system me. That's just what you need to do.

E

I'm guessing on a change. How often will you change HTTP, roadtrip definition?

E

Let's you could it makes sense to change it every time, your API, your app interface interface changes. Maybe you add a new route or you add a new HTTP method to a certain route that tends where route group could change right. Yeah.

F

E

Like a missile deployment, oven of an app will reflect in an HTTP round route change. But yeah I get your point or.

F

Even a traffic target change.

E

E

But if a traffic target blocks split, then you get non-authorized.

E

If the yeah points, let's say unknown pod or a crashed application, then you'll get a 500 something, and it's from the HTTP response is clear that okay, this is unauthorized and this is timeout or 503. I forgot his name so I'm guessing from a user perspective, is clear that okay, you get an unauthorized error and you can handle that.

F

That's a good point.

E

Grp she also has a code or for unauthorized.

E

Tcp is hard in this case, but then you don't have headers for tcp. So it's not an issue. Udp line.

E

Yeah I agree. We should. We should mention something in the in the spec about this.

F

A

Is there anything actionable around that? Can we create an issue or somehow someone taking up on that or.

F

Carly, I do you, do you have an issue already open? No I don't have an issue of them. You have any thoughts around this news from the conversation yeah did you want to add anything I just wanted an opportunity, yeah I, think I'm still just trying to follow along so I. Think from this discussion, there's at least between needs, a step behind I haven't heard any objections.

F

Okay, I think we agree that we should mention what the behavior may look like when there is some conflicting SMI policy when there's a conflict between policy and traffic slip. So there should be some message in the spec I think we both agree on that.

F

There's an open conversation around updating the status of the tropics split object to reflect that there might be a conflicting policy, or if this is not, you know that this is not something that we can create at this time like we just need to have that conversation in the issue about a route around what specification we want to define around updating a status for the traffic split object, and then the third thing is just outlining what the behavior should, what the hey, behavior normally would be. You would get five, oh three or any other.

F

We can out light any other behavior that we could look out for just and that would be common to any implementation. Just so just so. If someone comes across this issue, they know what to look out for okay.

C

And then there's their guidance on, so are we just not going to like resolve it from the influent? Like the implementation perspective, I.

F

Think we have to get more thoughts from the other maintainer zhan, that maybe, since we've had this conversation, we can ask them to watch those discussion or fall on the issue queue and give us more thoughts. I, don't think it should be something that the spec should define behavior for I think that it should be an implementation, specific thing or the implementation should handle conflicts, but I do think we should call it out in the spec and clarify how what good patterns might be. Okay, one.

E

Second, I, don't think conflict is the right word for it. So imagine imagine. I have a patient period group and a traffic split definition inside, let's say my help, chat and I'm, deploying my app to do Camry deployments or whatever, like that. Then a cluster ramming, cons and say: hey I, don't want track to be routed with this header and it blocks it. This is how firewall works right. You can enforce something.

B

So in behind, if not the conflict.

E

Is a policy enforcement? Even if you have some rel definition that leaves a bunch of headers a cluster I mean can say, hey from all these headers I'm, allowing only this ones yeah, because maybe you don't have you cannot change the route group, because maybe that route good definition comes from outside your organization, from a help chart made by someone else, yeah.

B

That's really if.

E

You think about network policies right, you can. You can turn your app here. I want to call this other app, then the first line says no. Here is a network policy and I'm blocking it in in the same way with SMI, say in this kind of heaven.

C

Yeah, so it may just like it's not necessarily a conflict, so we might not have to work around it. We just have to call attention to it. Yes, sure.

E

A

All right cool, we have seven minutes left and we are at the end of the agenda as far as it's in Google Docs. That's really good, so any other business. Anything else, that's not on the agenda, but to raise something or suggest something or volunteer for next time. Moderating. Ascribing.

A

Okay, I have a question.

E

He's Microsoft working on a semi implementation.

F

Yeah think so I don't know like how much I can say, but yeah Microsoft does work me answers.

B

Related question: is there any company anywhere in the world that it's not working on an SMI implementation.

F

Okay, we have an adapter for them.

F

See and which I really need overview. Some PR is I'm an adapter and.

D

That's a good, that's a good point he's the state of the adapter is that it is it functional right now, I, don't know that it is yeah.

F

It is why, wouldn't it be, we tested yeah.

D

Yeah I had feedback recently that I think it was with traffic metrics yeah.

F

That's correct: the adapter doesn't deal with the AC. Adapter doesn't deal with the traffic metrics. It just deals with splittin policy, but yeah metrics doesn't work because as soon as I made, some updates in the latest version probably do metrics, and so we do need to update the traffic metrics implementation first deal, don't believe that works and I was trying to carve some time out to do that.

F

But to be honest, I had a really hard time, along with some of the other folks on my team understanding, SMI metrics, so I've been trying to figure out how to iterate on the documents, make it a little more clear how how it's, how to actually implement it and I think some of the instructions on the metrics wreaths are also out of date, considering they're home to instructions and not home three, and then the API server runs, but it doesn't have any storage mechanism in the pod.

F

So you know you're just getting like a JSON response that is in the form of traffic metrics. The traffic metrics objects. You can't really query kubernetes to get the object back, there's no CRT or anything like that and I'm just curious. You know about the background of some of these decisions, so I'm gonna try to carve some time out to work on the metric stuff and if anybody else is interested, let me know yeah.

E

My understanding is that the semi metrics library is just transformer between Prometheus and external metric API in kubernetes.

B

E

Every every time kubernetes asked us the kubernetes api hey, give me a metric for a port, then this library, what it does it translates that API call into a Prometheus query and it returns the result in in the matrix kubernetes matrix object. Alright, so I don't think it needs a storage, because Prometheus should be the storage yeah.

F

E

Some caching, so it doesn't, you know, bombard you. If you have like 100 HP is doing the same. Calls to the same thing. It's more like in-memory caching could be used. I know the metric server. The Prometheus adapter has something like that. Ever.

F

Use just libraries metrics at all, or does it or SMI metrics or does it plan on using SMI metrics at all.

F

Who just flagger plan on using SMI not tricks at all, I've.

E

Been I've been thinking about this and it's it's quite limited. I mean most people use flagger to write their own custom. Metrics queries like okay, you have latency and error. That's comes built in with any save, especially English.

C

E

People I'm doing hey how many connections is the Kennedy has the can be opened on the database, which over-limit them is not good or any kind of business. Metrics know right now: Flagler calls out to can call out from acoustic driver and data book, and people are asking for nearly consults. It's a different type of different scale of metrics and.

F

That's that make sense I've been trying to like I think the getting metrics on edges is really valuable. Also, we've been looking into kind of like how to do that and I think some of the docs need to be updated because he can't really do edges with services. So that's just something to look out for and something that needs to be updated. I think metrics needs a little a little slash a lot of love right now. I see we're out of time, so I'll stop rambling.

A

All right we have the top rated yell but half at the hospital. So thanks a lot everyone for showing up and things crying thanks.

B

A lot and it'd be great: if people wanted to volunteer to leave the call Michael did an amazing job being tapped at the last minute. Otherwise, I will pick a victim next time.