GitLab Configure Stage, 13 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: HTTP Upgrade support in GitLab Agent for Kubernetes

Description

MR https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/merge_requests/632

https://httpwg.org/specs/rfc7230.html#header.upgrade

A

Hello, I'd like to give an overview of this merge request and it adds connection upgrade support.

A

Http rfc defines an upgrade mechanism, a way for a client to request a connection upgrade to a different protocol, so that client and server can speak, something else, not http.

A

If the upgrade is successful, it works by client sending a request with an upgrade header listing protocols in some preference order that it likes to switch to and the server picks one of them in.

A

Not necessarily the first one, but the one it prefers out of this and responds with 101 switching protocols status.

A

It can also ignore the upgrade request, just responding normally of as if there is no upgrade header at all.

A

So this merge request adds support for this, this mechanism, uh so that we can support, drop, sockets and speedy and anything else in our kubernetes, reverse proxy and potentially any other things we might want to proxy in the future.

A

So I'd like to look at the code and go through it to explain how things work uh on high level. So, first of all, we already have the broader definition for the http protocol itself.

A

It's probably not the most generic definition, but it's good enough for us. So we define the request and the response and request consists of the header which describes the requests. Like you know, the method, the query parameters, the rail path, the headers, some extra, which is specific to the protocol, the endpoint that is being called.

A

uh We pass impersonation information here, for example, then we add the upgrade flag if the client wants to upgrade and then after the header, the client sends the body of the request and the trailer to finish the body as a signal that the body is ended and then that's the new thing. The upgrade data and.

A

Each each message may contain one of these basically and we encode the that here and uh the response is kind of the same thing. uh There's the only difference is here. The header contains on the response and that's it.

A

Then we already have this generic herpes, the in in bound http proxies into turns and about http traffic into hrpc request and then on the other end, we have this in boundary pc to outbound http. This is what runs in the agent. It turns that grpc stream into an http request to the acupuncture api server.

A

So we modify these two to support upgrade basically and then we make use of them in kubernetes server proxy. So the server is. What is the part that runs in cass.

A

Yeah no modifications here, basically just some clicks because it delegates.

A

It delegates to the http 2 jrpc proxy uh somewhere here.

A

This pipe streams thing yeah in boundaries with a bunch of pc, so you see it. This thing is generic. We didn't need to modify the the entry point at all like I just tweaked some amounts and.

A

Here the idea is that we send the request yeah we're not going to go into the code. That's not that important have a look at the mr, but we just send the request. Get the response, checks that it's.

A

101 switching protocols and if so then we start like proxy in the connection directly underlying connection and there's a bunch of machinery that this involves.

A

On the server we use something that's called: where is it hijacker?

A

Basically it allah? It allows you to take full control over over an http of an incoming http uh connection and then the server like fully relinquishes control. You do whatever you need to do with this connection. Server just pretends it doesn't know anything about it, so you are in full control and you can read and write anything that does need to be http, though, so this is on the server and on the client.

A

I mean client, the agent. We use a client that uses a transport that makes a request and preserves the connection, and it's here, hp run should probably rename it into upgrade. So it's upgrade round tripper.

A

So it makes a request, reads the response and then, if it was a upgrade request well in any case it it puts the connection into the field, and then the code can use that underlying connection of the http client to do whatever it wants. For example, proxy there is the tcp stream.

A

That's how things work here and everything else is kind of plumbing nothing very interesting but yeah. Let's look at how it works, so I have cass here running and agent running. So I have plenty of errors here, because I don't have gdk running. I commented out authentication so that I don't need jdk and my cast just always allows the requests and.

A

It can't sense user statistics because of that, so let's try lens and see if it works and I'll open the agent logs. But you can see that something is happening and this is our cast cluster. I created a config to talk. Let's talk to cass for cuba, city or anything else like lens, and we will use that. As you can see, things are starting here and um you can see lens is making different requests like fetching services and.

A

A

Establishing watches for nodes and uh pods somewhere here.

A

This is a watchful namespaces, so yeah, it's just the way, the way it works- and I don't have a lot of things here- it's just a rancher desktop server, kubernetes server without anything in it and that it only has like three pods.

A

So this is the one that contains a shell, so I can open a shell like it has a shell binary in there sh so yeah. This is this: is it it works and oops and we can run top to see the processes there and whatever you know.

A

Works fine exit, then we can do that again or we can.

A

Yeah, it's I don't know it's trying to do something that doesn't work, that board itself.

A

Anyway, that's that's the demo. Thank you.