Istio Networking Working Group, 24 May 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Istio Networking WG meeting - 2018-05-24

Description

Agenda:
- Release 0.8 Status
- “FilterAugment” API design discussion
- HTTP/2 requires termination of TLS at the service
- SNI behaviour + things to be aware of for Gateway
- How to configure Gateway to allow both H1 and H2 on the same port
- Proxy-config command
- Meeting info

A

More feedback on on this API and what people think of it, and whether it's a good direction so that we can kind of proceed in getting this merged and implemented for the next release of Sto. So I'm, not too crazy about the name for this API filter augment.

A

But that's what I've sort of settled on as a temporary name, the idea being that it it's a filter, that's sort of beyond what what is do normally configures, so extra filter or some custom filter, and you specify a set of match clauses which identifies which sto or sort which side cars or gateways should apply this filter and which listeners.

A

So in this case, I've listed the hosts as the reviews prod service, so any listener. That is my inbound listener for that service should get this filter. In this example, then there's an order clause which tells pilot where, with respect to other filters, this one should be inserted. So this one should be inserted just before the router filter, and then this is an HTTP HTTP filter and it just has a name and a config.

A

So this inserts a non-void Lua filter with this function, and so that's the the kind of basic example you supply some matches to tell which listeners to insert the filter you supply in order to tell it where in the listener, and then you actually just supply the filter config as a prototype, struct.

B

As site from Gateway selection spike, did you add something to control source selection.

A

As in the source of the traffic or yeah, because.

B

You have a band right as a possible direction, correct, which means that we're binding that band we can bind to sources selected by label.

A

Yes, so I have not not put that into the match criteria, but we could so you were saying that you would only want to select sidecars that match some some particular source criteria like either a service or a label selector, or something like that right.

B

Because then, you know, if you, if we're gonna, do it, people will almost certainly want some form of incremental rollout right, yeah. Okay, the same would probably be true on Gateway, although right now the only binding they have is by name yeah.

A

So that was one of the the questions that I wanted to get its feedback on. Is that right now all of the match criteria are based on name so its host name and Gateway name, a more kubernetes style thing would be to do this with a label selector and I. Don't know how people feel about names versus label selectors. Do we want both do kind.

B

Of already, we've adopted the idiom of hostname selection and gateway, name, selection for virtual service, yeah destination rule and all policies, so I think we should stick with it. Okay,.

B

Okay, okay, I, don't think I haven't seen this before so I will take a look at this and make sure it get my feedback and view of it. My first impression is, this all seems pretty reasonable. Okay,.

C

Initially like, what is your, what is what is it based on I guess,.

A

Well, so the use case that I'm particularly interested in is being able to insert the Envoy . external aussie filter so that it can call out to a authorization service like calico, but it's certainly not restricted to that use case. I know there's some interest from many users for inserting arbitrary lua filters. So that's the example that that I've provided I mean.

B

In theory, we should be able to use this mechanism to insert an extra filter to yeah.

A

So there was a comment, I think from quat about that, and that's probably worth discussing whether we want that to to be a a goal of this or whether we want to just limit it down to these are filters beyond what is Tia would normally insert for you, yeah I,.

B

Think it's probably on this is trivial and immediately apparent how we would make it worse. For mixer we should probably leave mixer out I haven't.

A

Done that analysis, but I will it may be trivial in terms of implementation, with respect to this API and and the sort of code that has to live in pilot, what it might be less trivial is how this interacts with the mesh config and whether you turn on or off mixer right in the old way that we have been doing.

B

Yes, that's true, I mean theory. The same should be true for the Arabic filter as well.

A

The one that's the yeah.

D

A

So I'm not sure exactly what their proposal is for how that gets turned on or off in the mesh, but this would certainly be a way that that it could be turned on or off yeah.

B

Okay, well, I, don't think need to solve all problems and clearly not for one out. So it's probably fine if there are in Eaton's mismatch issues just to kind of open fracking issues for them and leave this api and alpha state yeah.

E

Just out of curiosity are the filters able to change which, like routes and clusters, end up getting selected for the request.

C

A

So HTTP filters can do basically literally anything to the HTTP request and that can include adding or removing headers, which could affect a routing decision. Okay,.

E

C

I know this can be applied at many levels and I'm boy. Are you gonna target? This apply animal like a route level and then based on rules within you know, so.

A

These are being applied, so the the filter chain is set at a scope of a listener. So each listener has has a filter chain and it has a network layer filter chain which then includes the HTTP manager filter, which then has its own set of HTTP filters inside it.

A

So you can select what listener types which are, which is based on what sto thinks the protocol of the traffic is going to be, whether it is TCP or HTTP, broadly that just that sort of determines whether it gets the HTTP filter put into it or not, and whether you could do routing and then we also allow you to supply configuration for either an HTTP filter or a network filter.

A

So in in this API, you can insert a network filter into either type of listener, and if you want to insert an HTTP filter, obviously that only makes sense if you insert it into an HTTP listener that already has the HTTP manager.

A

That makes sense that answer the question. Yeah.

C

Just to be clear, will you be able to apply these at a route level.

A

I, don't think so right, no so yeah, so you I, don't think. There's a mechanism in Envoy that allows you to alter the filter chain based on the route selection right or or to apply filters post, routing, correct, yeah. The routing filter in the HTTP manager is, is the one that actually sends the traffic to and to a cluster and and sort of sends it out of envoy yeah.

C

I know I think I know there's some to kind of get down to the raw level.

C

A

I mean you, you certainly will be able to modify things that will affect routing, but I. Don't think that you can say this filter should only apply if this route is the one that is selected. I. Think.

C

That, actually, it could be so I created an issue, an envoy I think was merged, or here are those merged around. So you can attach metadata to your routes, I believe and that get fed into filters that you can reference like metadata. I have to find it again, though. Okay I don't think we exposed the metadata through. It's the oh yeah yeah.

B

We would have to start putting that into virtual service yeah.

C

But I just it's kind of like for people, so you know I, think that you probably aren't going to get route level, filter or filtering yeah.

A

Certainly not with this proposal but yeah spike.

F

Are you thinking of use cases where which are effectively global.

A

Well, that is definitely included in the use cases, because that's that's our use case, but it is not intended to be useful only on on those use cases, at least by global I'm. Interpreting that to mean this is a filter that I want to be inserted more or less globally across the mesh, but you can target it down. You can say just for this specific service I want you to insert filter or just this specific gateway where.

G

It would not work is if you need to like work at the waited cluster level and that's an issue in general with envoy. You cannot do stuff specific to a waited cluster. It has to be per service right. So that's like similar to timeouts or right.

B

So this is strange right. This is.

H

B

Touched understand right.

H

B

This is before that phase just watch. You can still obviously write code in whatever filter you're trying to do to do some form of selection based on metadata right, I, don't know, dude Kendyl of filters cold other filters. It's like I.

A

B

A

Don't know I mean they could definitely call external services, but I, don't know whether or not it's possible to call a filter as if it were a function, a function or something like that. Okay,.

F

What I heard these filters to routes, but we could to services? Yes,.

A

F

For Cloud Foundry use cases, those are effectively the same and.

E

You're conflating two different kinds of services here. What they're saying is that you can scope these things to listeners on particular side cars. You can say that this is going to go in this side, car, not that side car or on this gateway, not that gateway, but they're, saying that you cannot do this. Based on what upstream, it's going to connect to well.

A

No because they we create multiple listeners, one per upstream service, so like in a typical side car. If there's you know ten other services in the mesh there'll be ten listeners, one for each of those services in the mesh, and so you can scope it down to say: I want this to apply just to listeners that go to service foo. Is that true? It's.

E

True for TCP services is that also true for HTTP I thought all the HTTP services go through a single write, I thought so truth, oh yeah.

A

That's right: it's by port yeah. It's.

F

By poor Gabe I'm thinking about the use cases for which we want the Gateway to app developers would want the edge gateway to do transformations which are unique to a Cloud Foundry route and whether yeah.

E

We can write up a filter, yes and.

F

And have those applied by a filter rather than making calls out to mixer right, so you should in fact take place at the gateway or at the sidecar ingress sidecar right.

E

So you could write a filter that matches particular host headers and then transforms that was header, for example, yeah.

I

F

So if that's supported, then that's well.

B

H

Know something.

B

You have to put into the filter itself right. This is just a way to enable that filter and trigger in the right context right.

E

And so does this mean like for every if we wanted use case like that for every you know rewrite of the host header we wanted, we would need to install a new filter, or is there a way of like having a shared data structure, that's being accessed by a single filter.

A

So in in principle, you can yeah, you can have shared data structures that are accessed by filters and and things like that in the specific example of a Lua filter, which is something that you can insert sort of inline code with this API I. Don't know whether or not that's true, but if you wanted to you know, go to the trouble of writing a new envoy filter right in C++, then you have a ton of flexibility about what kinds of things you can access. Okay, that makes sense. Thank you well,.

J

One comment regarding the HTTP filter: I, don't know if you're aware that we also have HTTP proxy filter, sorry actually proxy listener, which allows you intercepting traffic without iptables, which is using some environment. Okay,.

A

J

Relates to the previous discussion, if we capture by port or if you capture by year, IP, which we do both, we also have listeners bound ins HTTP deep, but that's something we hope to get rid at some point.

E

Constant, where can I read more about that.

J

It's a picture we had for quite a bit. I, don't think we have a lot of documentation because it's very rarely used my point is: it will probably need a bit of I, don't documentation to specify forward or or better targeting, to specify if it's for HTTP filter where it applies, I mean you should probably apply to all HTTP filters, so we can cut I, don't know, I mean that's a tricky tricky problem, you don't don't forget to.

J

We still have to kind of listeners, we have listeners bound to the port and we still have listeners bound to the to the actual beep of the HTTP service.

J

So you'll probably need to put it in both listeners, I suppose I.

A

Think I'll probably have to modify this proposal to match, based on port for outbound listeners since.

J

That's the action, because, if it's my pores and the based election will also kind of create problems, yeah, maybe is your positive and just says that hastily filters and replies they should be filters to all listeners or inbound listeners, for example, I think.

B

That's there an API custom right I mean if he doesn't put the declaration for pork. It's got to assume to be all things. Yeah.

J

No implementation will yeah I mean yes,.

A

So for inbound listeners, it's it's sort of clear but for outbound listeners you'd have to just apply it to what.

J

I want is clear, an outbound. It's is much important and the other comment ahead is in the API. So far we have a pretty clear distinction between inbound and outbound for outbound to use destination rules for inbound to use virtual service and sends a notification policy. It may be less confusing if we also had two top-level augmentations. If you want to use that word, I keep it kind of the separation. It's also cleaner for further for outbound it's much easier since host is clearly the the main singers.

J

They need to match a destination policy rule yeah.

D

A

Have to look in in detail. My worry, though, is that destination rules are essentially related to routes which, as we've discussed, is not a scope where you can hang a filter off of so yeah. I'll have to have to do some more analysis on on how to do the match consistently for outbound filters.

J

Well, the outbound routes are also at least for TCP, that listeners that captures the traffic and PI owns the outbound Alicia it's for the listener, and then there is an outbound cluster yeah.

A

J

Nation was typically applied to kind of the entire set of listener, plus plus outbound cluster cluster right. So.

G

Costing if we separate the listener, as we discussed with pure trying to unbound and inbound and outbound listeners, so how what they need to like again specify where does the filter apply? That.

J

Should not be in part of an API surface.

J

I means that something that's in internally done and it's up to to the implementation, how it captures traffic and how it but yeah it has another wrinkle of complication or other reason to kind of keep a clear distinction between you know: outbound, listener plus clustering, which have slightly different semantics and inbound at that's my whole and and keep in mind that out indication policy is another set of confusing confusion for the user, I mean it's slightly different way to select targets and to apply policies or we're gonna fix our problem.

J

We're going to fix it, but.

B

Let's review this API right right, whether it's specifying the intent of the user properly and then let's see how we can resolve it, what the implementation does, because the implementation is changing.

B

So far, I haven't seen anything here that seems unreasonable, I'm an intent perspective. So let's just make sure that we've got and it's a fairly usable API.

B

And if there are obvious and beating some as much problems, let's call them out and try and figure out how to resolve them. Cool.

A

And the other thing that I wanted to discuss because I'm not sure that it has been explicitly is. Are we okay with this being something that we ship in in one point now, I.

B

Mean it's an alpha feature right.

B

As long as it doesn't destabilize anything- and it comes with a big caveat- but if you use this, you may blow your foot off yeah.

A

I'm, just thinking that there's been you know, emails circulating about, you know make sure that we're only emerging stuff that has been approved for 1.0 and and so yeah I think yeah I'm, the.

B

Criteria is if it's not part of our kind of stable feature set, that we call production ready, which this won't be. Then you know how is it turned on? Does that code affect the stability of other parts of the stack as long as it meets a reasonable bar? There then I think it's fine like we can't stop people developing features right, but we are trying to make sure that features are put in in a safe way. Yeah.

A

This is pretty independent, yeah.

G

With the flag as well, so if things do get destabilize that it's merge, we can turn it off.

J

One thing about stable and unstable: there are the discussion about moving the rest of networking to at a level. I means the petrol service and the others. I assume this will stay behind order.

A

All right cool don't take up this whole meeting. So that's! That's all I had okay.

G

It's good. We can go to the next topic. I just like to reply to Thiago and Chad. Could you please send me an email with your email, so I can send him by to you and other than that we have all. The meeting is somewhere in one of the one of the easier pages.

G

So for people who don't have the invite like the Ritter is a place. I can add it to the meeting notes as well, but if you want to have like a direct invitation, please send me an email all right, so I think we can move to the next item in the agenda, which is okay, so HTTP 2 requires termination of TLS at the service. So this is a use case from Cloud, Foundry and Shannon would like to cover it and discuss a bit about it. Shannon or again.

B

I just excited now, but I.

G

Just wanna say: Shannon I'm.

B

Gonna follow the GRDC team and the goaline team here at Google. This is a bit silly, so I'm going to put some pressure on them to support HTC, because there are real news cases for TLS offload and yeah. They should just come around on this I know these two specs says there are lots of people who disagree with what the h2 spec says. So I think we'll make some progress here and I'm happy to pick up the baton and Corral people here at Google to make progress. I was.

F

Hoping to get alignment and at least get an understanding from the eschewed community and Google in particular, about the use cases given given the context of sto the use cases for h2 and and limitations incurred by current frameworks or frameworks currently and right. So but.

B

The age to spec says that if you're going to use h2 on them in public, you should use h2, which mandates and n TLS, but that's that page to see spec does exist for a reason.

B

Go chose not to implement it for reasons that I don't fully understand, but I'm gonna go and find out about I. Think it's because some internal wrangling, the GRDC team, doesn't principled stance on this, because the other GRDC implementations implement h2c support and so don't require eggs and TLS in the libraries. My.

F

Understand is my understanding, and maybe the only data point I have is the Ruby library, but the GRP C Ruby library requires TLS all.

B

Right they're reporting some outliers, but certainly the Java one, the dotnet one, the C++ one do not require. Yes, the.

A

Python I'm, sorry what I just said the Python one also doesn't require it can.

F

You clarify for me what the h2c spec is: I thought that that was a h2 over agnostic, TCP right.

B

H2 in clear text: that's what the C stands for: Oh, perfect.

F

Okay, so if if a work load is written in a framework that supports h2c, then the sidecar proxy handling ingress should be able to terminate unless do all the certificate management and send clear text h2 to the work load. Is that right? Yes, not white.

J

The site guard we do h2 I mean.

B

G

Actually, if Shannon, like we kind of jump so I'm, not sure if everybody in the meeting understands the use case because they may not have followed on the slack discussion necessarily so would you mind just giving a brief overview? Of course,.

F

So we're thinking of h2 in the context of a data path in which request is made by an e2 compliant external client, which would first hit a load balancer that may or may not terminate TLS, which then forwards a request to a gateway platform gateway router, which then forwards the request to a ingress side car, which then forwards the request to a container dweeb and we're trying to figure out how those workloads can leverage h2 for performance benefits the concurrency in h2 or for other reasons.

F

Maybe they want to use G, RPC protocol and we're running into issues where frameworks like golang as an example, only support h2, if it, if the. If the workload itself terminates TLS- and this is a problem before for us, because both Cloud Foundry and sto service mesh, we believe, provide tremendous value in removing the burden for management of certificates from the app developer.

F

We don't want the app developer to have to include certificates in their application code. We don't want the application developer to have to worry about terminating TLS. We want the sidecar and the edge eight way of all of this for them and the sidecar to do clear text all the time with the local workload.

J

If I cannot hear the other would be disabled if I used to estimate by the application, because we don't get no metrics we'll get no policy, we cannot apply any of these to your features, so any application, terminating h2 will definitely do not use this job. Yes,.

F

If we were to attempt to support h2 for these workloads, given current limitations, it seems like all of the intermediating routing components would have to pass through TCP and we would lose all these benefits and that doesn't seem viable for us. So we're interested in supporting h2, while maintaining all the benefits that the foundry platform and the service mesh proxy model enabled.

G

J

You so I can once more comment here. Besides ER pcs, there is another nice feature of h2, which is push support, which unfortunately, right now is not supported as far as I know in any way, and we don't have any any kind of way to do it if I'm wasting anything. But that's something we can point because push is important. So.

G

What does this mean? Specifically, it.

J

Means that if we, if it is just use and wait terminating, the electron handling it forward into the application, I believe that the push may or may not work properly, which is it for put up for a web page to send request to send results without being asked for them.

G

Okay, that's funny costume.

F

You mean once a and an h2 connection is established initially much like WebSockets. The this server can push data back to the client. Yes,.

J

And that's something we haven't tested and I: don't want it to work so.

F

You're thinking that that an envoy will support establishing a persistent connection, but only for inbound requests.

F

Persistent connection is established, it doesn't support server, sent events or service in data.

J

Support might be some things that we haven't tested and I know if you are see depending on how the community, like sometimes we like to keep our hope and and and make sure we support at some point all right, that's very important for page optimization, you tell me the web page, you know, that's, that's an important optimization to be able to send CSS other thing beforehand without.

I

A full round-trip, it would be fine for us if we got at least the.

F

The the inbound multiplexing to start with and and added the server sent later, that would be fine, okay,.

I

G

So, for this push support, if there is a real like use case and requirement, is it words following up with them boy, they're.

J

Nesting first, if it works, or maybe it already works, and if it doesn't work opening area following up with my and make sure they.

G

Okay, so maybe we'll open an issue, a nice job, but personal doesn't work.

H

Today, in our.

J

Minds you know, but it's something we need to keep track. What.

I

A picture yeah.

G

I

K

An issue: what is so this is because so this is because you are using envoy in the path that goes roughly to a browser to a buzzer yeah.

F

At least two envoys.

J

And maybe a browser, maybe some mobile device that is using web push under use cases for a court reporter in to push right, I mean.

K

This is definitely one of the talking points of h2, but I actually spent a lot of previous years in the web performance world and I was kind of I found that, with a lot of experiments, it was hard to get eighty to push to actually help, but it doesn't work, I mean if it works, but I'm not sure it actually makes web pages faster generally, except in their various specialty, but that's kind of both sides. The point it's part of the h2 of maybe it should be part of yeah part.

F

Of the h2 spec and we want to enable app developers to experiment with it. And we want to be.

B

F

To transparently support that spec yeah.

J

I would say that I'm more interested in the millions of web push for what we use of push for web push, which is a protocol used by browsers, and you know, maybe IOT devices so notifications that you know I synchro notification, I, don't know how they call notifications web push. The idea under this Web push.

G

So Shannon or coursing can one of you just maybe open the issue like an envoy and we'll see Harvey from there like how dumb you know how it goes in the long term. So at least we don't like we don't just discuss. We have a.

G

We have a an issue out of that.

F

Yeah I can stop okay.

G

Thanks so anything else on this topic.

F

My takeaway so far is that Louis is gonna, follow up with the golang team and that the group here is aligned that our use case is is common and one that you're you're all would expect to support as well right.

L

F

It's not crazy.

G

Okay, yeah, that's that's it yeah. It didn't sound crazy in the beginning, but now it looks like more people agree with that. Okay, good.

F

But you know if it works or not. Yeah.

G

So we have, we have three more items so I edit, the next one. So this is basically I. Don't know if Shriram are you are you on the calcium or vadym.

M

Yeah, oh great.

G

Okay, because, basically I would like to have like a statement how how gateway works, especially with regards to Essen eyes, so that people are aware, and also about all the like things to be aware of so, for instance, not use wild card to complete wild card in the Gateway, because that will not work when with us and I and all those things. So, if you could, please talk a bit about this.

G

M

Of these usability bugs have been resolved, that you can definitely use wild cards and the sni will automatically be disabled and so on. The biggest issue that is left right now is organizing the spirits, essentially figuring out a way to lower the multiple certificates. Okay, they are launching these gateways, I mean at least the steel version of gateways. My template, where we have hard-coded to secret volumes and that effectively means to only know two certificates. One of them is actually taken up.

M

By is to be that's the East, your intelligence education certificate, so the essentially provide the user, with only one specific secret like the steel ingress and so on, and that's the only key banner the user can actually load into the gateway and that one of the string, a bunch of people can do. Somebody is actually like you know, saggy enough to go, look at the heaven chart and tweak it and had more secret volumes and multiple certificates, and once you do that, then it's very easy to set up the SMI stuff.

M

I mean based on the gateway specification. The so yes, in my opinion, that's the biggest what it called the adoptability issue so far and other than that we have I mean the other painful part. Is this whole namespace business with the gateways? If you have gateways and different namespaces, then, if aunty as to how to address these gateways across different namespaces and so I'm, working with Zack, to clarify that and or like you know, simplify that piece and then.

M

Other than that I think we have almost. We also need some food I mean all you just need. Cliche put them, have a task or something that shows how people can write a simple like gateway specification and launch a mystery or proxy for as a as a gateway.

M

Pod I mean FAA shipping default gateways like you graduate in those gateways, but people might want to launch their own gateways no, and so, if you just provide people with generic template where they just simply replace the names and then that would make they run an internal gateway, external gateway in whatever it is, and we can continue using the DCO gateways for our purposes. So that is probably documentation thing or some template or scripting things such that somebody can quickly generate a gateway. A service.

B

M

Pods that Metapod mode is dr. more that's all, and so these were two biggest caveats: an odd choice with the gateway stuff and based on what I've seen people like struggle with in a meaningless. It seems to give us these two things, especially the HTTP stuff I mean for people who tested this thanks a lot and we found those issues on the SMI, the wild-card stuff and all the vsms of matched and of the fix-up logo, and that fix some things not and I also fixed a bunch of things in this year.

M

So these products shouldn't be gone by now such that you can declare a gateway or the sexy TPS. That would effectively mean it's Taylor's domination and forwarding to the backend. Does you know I? Should he be HTTP in whichever way you want to, and you can do the same thing for other protocols TCP as well and think of the Gateway as a proxy which always dominates TLS, unless otherwise, you tell the Gateway to not terminate TLS.

M

G

The way to tell it to not not terminate is to mark the port is TCP right. No.

M

No, you can. You can still pick lettuce HTTPS, but there is a mode in the settings for the Gateway and that mode has like multiple options, one as a pass-through mode which is sni pass through. So if you specify the TLS mode as possible, then the Gateway will just simply route the traffic and it will not terminate LS. But if it is okay, retailers or mutual Innes, then it will do whatever but mode phase.

E

This is a question about the Gateway star implementation. Does the person who's writing the Gateway config need to explicitly associate a single server certificate with the single host name or set of host names that cert matches, or is there a capability? That's a.

M

Good point: I think that is happy. We do, we can even see a certificate file and simply specify different names or, like I, don't know if your girl is also on the call that he might be a member to answer this question on how we might be able to answer this question as well.

J

What's the question sorry I, oh.

M

Can I have a single certificate which holds the source for multiple different host names and then your.

J

Job here about that sorry, yeah.

G

J

Answer for that, yes, the answer is yes, you can have a certificated, multiple names, okay,.

E

Can I have multiple certificates for multiple host names on a single gateway, port server, port.

J

Definitely genius.

M

G

You also said that you can have like also multiple certificates as part of a secret.

M

Right, that is what constant says: he just simply take one certificate and a stick in a whole bunch of different TLS certificates and create one big uber certificate and you certificate as a secret and kubernetes okay, you're, essentially low. You are socially like mount multiple secret warnings. Each volume contains a specific TLS certificate, but.

G

Right now does the code support mounting multipolar, not.

M

A code it's actually hand template issue. So if somebody wants to like mount 20 different melinda gates, they have to go on tweak the hands and place that we have for Gateway and singing sounds like 20 different secrets.

J

So, instead I'm not necessarily I, mean I. Think we discussed about the fact that you can. You can have this, you can put multiple certificates and.

M

That's why I said you can either do what Costin saying when you create one.

J

M

You can load them at the same secret. All you create multiple sequence, one for certificate and then note the mods, but the second one. The wires will change the hell perfect. The first one is do.

J

The thing can we to change the template users to choose a template. We kind of refer people to go with the first option where there is a secret that is mounted by the template and and in that secret they can put all just all their certificates together in one big happy secret.

G

But in the end, it's up to the user to decide right, for instance, if they are, they keep adding gateways or no if they keep adding like hosts and supports, and they don't want to change their original certificate right. In that case, for them, it might be desirable just to mount a new ingress and modified the right gateway and the.

J

Other new ingress they get a new IP address, and it's not really yes, ni a means. A different, differencing I would say, but.

G

I'm saying if they add, let's say, and they one add the new certificate in the system- maybe for some service right, they maybe for them, is desirable to just simply modify via helm or just keep CTL to modify the ingress specific. The Gateway specification to mount the new secret right without altering their original certificate. The big one they're.

J

Not altering the certificates they're altering the sequences is one secret in which you need to have multiple files. A significant one is that files can be said. Oh I get.

G

J

Wait and since they can have 100 other files, which are key and certificate I.

G

See and the secret is not go ahead.

J

Yeah, the secret is just a directory base, it is mounted to a directory and also the files in that secret is a file created in subdirectory. It doesn't scale, but for scalability we'll have SDS one will have it. Okay,.

G

Okay, I get it. Thank you. I.

E

Have a follow-up question, so how does the hostname get associated with the certificate to be served.

E

J

Based on the client, hello, so the start of the of the TLS handshake includes the host names that you want to talk with and then in who is looking based on the filters that you're implemented is looking to match that particular host. We don't have the sympathy. Kids, okay,.

E

So, within a single listener, envoy is capable of matching an incoming as an I hostname against a variety of various different certificates that it might know about. For that one listener.

F

E

F

J

Api, when you specifies a gateway, you specify the each party per host. Okay,.

E

But if I did a gateway where the Gateway hostname was just star and.

B

E

Several certificates into the server port for that gateway certificate, depending on the client s ni a but.

G

I thought, as a nice disabled, if you specify star that's what Shriram said if.

J

You specify started is that star will get the big set. It is the default certificate that makes no sense. Why I.

E

See, okay, so it sounds like it's. It sounds like the system is not capable of selecting which server certificate just return, based only on the client hello that we need to pre.

L

Configure in particular, we.

J

Need to propose.

E

J

For a hostname, you need to get a certificate for that hostname put it in the secret and then create a gateway where you specify the file path, where you put a certificate for that host and from that and way will be configured with the host that you just put in the Gateway and pointing to the file that you specified. So it is required some user intervention and user configuration. But you know easier if you put everything in place right.

E

Okay, so this is this is functionality that we we have in Cloud Foundry and so we're just sort of surprised that it's not baked already into envoy, but we can I guess we can compensate for this by building a system that will given a set of certificate to generate a gateway for each certificate right. So.

J

Will automatically.

E

Generate a gateway for your certificate that we want to support. Okay, another.

F

Reason not to expose to users.

G

Okay, so so I think I still need to take more notes because I got lost in discussion, but could you please also review that what its if there is correct and add to the notes, any more questions on this beside mind?

G

No, okay, good! We have two more items and six minutes. So I don't know if this is doable but we'll go in the order, so how to configure gateway to a longboat, a chuan and h2 on the same port game, yeah.

E

We might have just screwed this up, but we I see there's several different ways of configuring: the port on the Gateway, there's HTTP, HTTP HTTP. Is there a way for us to configure a gateway ports so that it can accept either h1 or h2 and do the right thing.

F

An auto detect yep.

J

Yes, that APNs Noguchi negotiation I think it is supported. I, don't know if it's exposing its API or its automatic serum do remember. If we have any I.

M

Missed the question: what was it again.

M

E

J

A PMS negotiation means a selection of h2 and and h1 is enabled by default or use that need to do any option. It's.

M

Enabled by default there is nothing that needs to be done. We set up all gdb listeners to automatically negotiate h1 h2 when.

E

I'm writing a gateway config on the port. There's a field called protocol. What should I set that field to in order to enable the automatic, h1 or h2 I.

M

Would automatically be enable for any.

M

Issue or HTTP it would be enabled so, but this is just for your own, like purposes and logging purposes, that you decline, the port sec, poor or HTTP, poor or HT to http, poor, so HTTP.

F

What you should be good, you mean it's a it's, it's doesn't have any big effect on behavior. It.

M

Doesn't have any effect on behavior because of the fact, because the reason is that the main book doesn't have any effect on the behavior of a.

F

M

Voice that is a disconnect, because that is a medieval simulator will be able to automatically detect the incoming protocol as HTTP 2 or HTTP I'm going to be the point of the field is that if you have deploying this gateway as an internal gateway and for other side cars that are talking to you know whether they talking to an Asha, probably they talking to a CTP one gate, because today I know it does not have the ability to auto upgrade from HTTP.

M

You know want to do when when it makes an outbound connection, and that is a reason we asked users to explicitly state when the HTTP 1- not true, so the Gateway did not just for interest. You can also use a gateway, an internal gateway, and that means all the other side it make, and in this case this is this gateway is no different than kubernetes service. Then, where you have to declare what type of is being useful, so this.

E

Okay, so if we are seeing a situation which H two clients are, there are H there, H to upgrade request is not being passed through to our back-end. It's not because our gateways misconfigured it might be because our service protocol is H one instead of H two. Is that right? Yes, okay, thank you and make.

J

Sure it is HTTP or H 2 not H, to see, because if this is different right.

E

Okay, thank you. Well,.

F

Previous discussion, anything other than HTC's really isn't viable.

J

If you want I mean you have job flow to terminate H 2 in the ingress, for example. Yes,.

F

The at the Gateway, the Gateway.

J

F

G

All right, two more minutes and lion: we have a topic called proxy, confident so lamb I are you there yeah.

H

Yeah, so basically I just wanted to make everyone was the proxy conflict commands now in. So, if you want to debug either we want to debug your individual proxies so envoy running. You can basically the input, one curls, the admin interface and the pilot one who talks to pilots debug things as much easy way to debug pilot issues. Basically an envoy issues.

H

G

J

G

We love when people add ability to debug to troubleshoot, because we are really having a hard time, sometimes yeah. Ok, thank you so much for adding that and.

J

Winter to the new shell script that can dump all the logs from the cluster, which is a useful.

G

Did you edit, here or well.

J

Some are not. It was implementation, it should be in the documentation as well I'm, just mentioning it in case people.

G

Okay, okay, so are you talking about the like the control-z, interesting.

J

No, there is a shell script is the release that can be used to get together all the logs for Mozilla and and does get a lot of debug information. Okay,.

G

Good I see I'll, try to dig it out, maybe added to the meeting notes and we are at the top of the hours and we made it actually through all the items in the agenda. So that's great thanks very much to everybody enjoy the rest of your days. Bye. Thank.

E