Kong Kuma Community, 21 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kuma Community Call - July 21, 2021

Description

Kuma hosts official monthly community calls where users and contributors can discuss about any topic and demonstrate use-cases. Interested? You can register for the next Community Call: https://bit.ly/3A46EdD

A

Hello, everyone- this is our bi-weekly kuma community call, please add your name to the attendee list and also feel free to add any agenda items, topics that you'd like to discuss today. We will try to cover all of them and our plan for today talk about the release we had last week.

A

Then, let's speak about ongoing stuff, we're working on right now and at the end, as usual, we will have some q a session.

A

So, okay, let's start last week we released kuma 1.2.2 and you can read about it in the blog post. The I think main feature of this release is a datadog support. We have paul on the call with us who can speak more about paul. Please.

B

Yeah, so uh what we, what we've released, is um datadog tracing, so the advanced performance management as I believe what they call it so um yeah. So if you're doing something universal, you just install the client on bare metal and give us the ip address and ports. If you want to install it on kubernetes, you can install uh datadog via the helm chart and then like expose it as a service and give us the the service domain and then yeah. So we just send all of your traces.

B

Your traffic traces up through data dog and you'll see it up in there. Nice, ui and everything uh any.

C

B

A

Yeah, okay, I think that's great feature also. We had some fixes that uh improve the stability of the product. I can cover some of them. For example, we fixed built-in dns clashes. You may observe this this bug. If you were trying to create two external services with the same host name but different ports, and in that case you'd get dns clash and one of the service wouldn't work. We fixed that. Also, we fixed pretty tricky problem with the empty jot token, when you restart comma dp quickly and that's.

A

This was some race condition which we also fixed and pretty important kds message limit fix. We had hard coded jrpc message, size limit and now we increased this limit and also we made it configurable using comma cp config.

D

There was also one I think, important fix from jacob about the um I forgot lead election.

A

All right right- I I forgot about that so before that, if your connection to the database dropped, we had one of the instance of kumasop's leader, but we decided that it's wrong behavior and we want to drop leadership if we lose connection to the database.

A

So, yes, we also deliver this fix in this release.

A

Any question about their elite.

A

If no, we can, anyway, we'll have some q a later about ongoing work. uh We're working on kuma, cni and bart can give more details.

D

Yes, so actually uh there are kima cni is, can be speeded and will be split into two separate kind of tasks and one there is a full request, already open, which was started by nikolai, I'm kind of reviewing it and I will be responsible to improve it change it. If we will need- and this part is responsible to install qma cni as a plugin on the servers- and that's it the other part, because behind the scene, what it's actually doing, that this whole plugin is doing.

D

It's just calling the huma cattle install transparent proxy command with some parameters.

D

So the whole kind of the work is being done inside our current um code bay, kuma code base, which currently is taken from istio, and we are rewriting this and improving this part two as a next step, and I actually have an idea which is growing into me- and I spend my personal time on on this- and maybe this is a good time to just poke it. Maybe we would be able to kind of live on this field and interest ourselves in the bpfs and evps.

D

um I already spent some time doing the research on this and kind of it is doable.

D

um I will still spend some time on on the weekend to kind of look into the issue, but I feel like this is: there is a strong, strong place which we could kind of leave the fields in this area, but if we will decide against it or if we could take more time than we are able to provide, we will just use the old ib tables approach and I would rewrite it.

A

Yeah ebpf is a really hot topic.

D

That's the only one. The other thing is that I actually have, because it would be really hard to do to write the whole bps logic in goal. But it's somehow good thing is that I'm feel confident in my rust abilities. So.

D

That's the final coincidence, so I will give more kind of insights comments about if we are able to do it quickly or not,.

A

Yeah, I just put some notes that to see later in the document that we were talking about ebpf for kuma, it's like uh just discussion start start. Maybe some proposals, ideas. If anyone has okay, um I'd like to cover uh one fix that I was working on recently or thanks to our colleagues from koip, we were able to find pretty tricky bug in the envoy with hds, and uh now that there is pending pr to unvoice a repository, we will hope.

A

We hope it will be merged soon and we update fukuma so yeah, and if anyone would like anything to the agenda, it's time.

E

um I haven't been able to work on the prometheus stuff the last couple weeks, but I'm back on it and uh yeah. I got verbal confirmation that.

E

The sd would be merged into the next release window, so yeah not not a huge feature, but.

C

It's almost done, okay, and I am going to resume the dns work um so hopefully we'll be able to make progress on that. um The idea is super shallow, sorry, yeah virtual.

B

C

So the idea is to be able to have templates for ports and host names um for abstract service sort of um so that you can quite easily just define how you want to reach your service, whether with your choice of host names and ports, rather than kuma being opinionated on picking whatever they want.

A

Yeah, if I'm correct, that cannot block- or maybe it's already to use a stateful set across multi-zone. If you create, for example,.

C

So it would enable you to actually have a host name for a specific instance of a service, um because you'd be able to just use whatever kumar tag. You want in the in the host main.

A

Yeah, that would be great.

A

So, okay, I think we can start q a. I have a question. uh If someone is trying to attend this meeting, I mean as a host I should approve, but if I'm sharing the screen, I'm not sure that I see, because I had some notification and I didn't approve.

A

If anyone knows how to work with it, is there some pending stuff.

F

I mean my my suggestion is: if you cannot see people coming in, do not screen share full size. If you can.

A

Oh okay, that's probably a good idea. I mean screen share only I can maybe.

C

A

A

Yeah: okay: let's go with q; a any questions.

C

um I have a question on the dbpf thing like it's very hot and trendy, but isn't that gonna cause problems for people running older kernels, so.

D

It's not it's not. I haven't thought about completely. You know um changing everything to evpf. It would be just one of the options, so you you could have the happy tables if you want, but there is an ebb ad option if you want, because I think yeah definitely aware about this as not able to run on other kernels yeah.

C

Okay, yeah and it could be, it could be uh check the the u name and can have the best default. Whatever you want. Okay,.

A

So if we want to use cbpf as a replacement as an alternative to ip tables,.

C

A

Okay, because technically we could put more logic into this, probably for the beginning, it would be fine to use just type the tables, yeah, okay, anything else, maybe feedback.

F

I I think I want to bring up the following topic.

F

We do have use cases where users want to configure the envoy flags for either concurrency or connection draining, and we need to find a good way of enabling that we could either create our own resource, where the users can specify the envoy flags and then select what envoys they want to configure with those different flags.

F

We can automatically choose some same defaults today, they're not saying so, something has to happen or we enable them to add to pass the envoy startup flags in our qmdp process. So we add new arguments in our qmdp cli program in such a way that we can then pass those flags to envoy is.

A

It the right issue.

C

I think it is okay. Let me just link it here.

F

So what do you suggest is the best way of addressing this problem.

D

I think that I would go with the flags because, as I I read the comments which which we already had about not locking ourselves when we create another resource. I think james mentioned this.

A

Some of these you're, referring to.

D

I'm not sure if it's here or if it was in his email, I don't. I don't, have strong opinions about it. Like yeah, I think that these two flags, which we are actually missing.

D

Would it be worth to create a separate resource which we then would have to be sure it's back part compatible? uh If we would like to change something.

F

What is the current default? Draining policy that we enforce on our sidecar proxies 30 seconds, so james suggested that the immediate draining policy would be a better default.

F

He he thinks that would be a better one, because you can the draining strategy. Sorry can be gradual or immediate, and he suggests that for the proxy for the regular data plane proxies, it should be immediate, whereas for gateway it should be gradual for gateway data, plane, proxies.

F

I'll ask james to send an update on the card on the issue so that we can unblock and move forward.

D

A

Okay, so any other things to bring up to this call or we want to end this wrap it up.

F

Austin, what's in your wish list,.

E

My wish list, uh I wish I had more time to work on kuma, but um uh so we're still at a of america where we're um starting to build a new use case for uh something that we would need a service mesh for so uh the timeline's still rough, but I'll have more wish lists as uh we start to actually use it.

F

Sounds good hey by the way what happened to prometheus.

E

uh Yeah so uh the last two weeks I have not been able to work on it, but I'm in the the final stages of review on the sd. uh It should be merged in the next release cycle. um If not the this current one.

F

That for prometheus right.

E

Yeah yeah we've got an uh so they released an http uh generic sd. So uh with the work that I did on uh exposing kuma's, metrics or monitoring assignment uh discovery service over http, it would be pretty simple to adapt that to the prometheus httpsd format. But it's all depending on like how quickly you need something in could.

C

F

What is the prometheus issue number? What's the link for that yeah? Maybe you can put it in the chat here so.

E

Here's the here's, the pull request that I'm working on and then the issue is this is started quite a while ago.

C

C

Got it, let me.

F

See yeah so we're waiting on them at this point.

E

No we're waiting on me to finish up the the last of uh their minor comments, but it's they're they're super minor, I'm trying to get that done today, but the last two weeks have been kind of hectic. We're renovating my future home.

F

I mean this is amazing. This will make prometheus much easier to use.

E

Yeah um yeah I'm looking forward to it as well. It's definitely a blocker for us at rivera to integrate with it.

C

A

Okay, anything else.

A

So I think this is last call for questions.

F

Yeah, so I was, you know, one of the things that we would also start want to look at is windows support now that envoy supports windows.

F

You know it is something that I would like to start working on within the next couple of weeks. I.

D

Actually, last week I tried, I created the virtual machine with windows and tried to compile the code, and I found that in our code base, there are a few places where we are using the os specific methods, for example, for ports checking etc. But it was much better than I anticipated like it was.

D

Most of the compilation actually were successful, so I think we should be able to do it without a lot of efforts. We would just have to kind of find an equivalent all four of these parts, which are os specific, currently written for linux and macos.

F

And so the incompatibility today it is in the way we are. You said in the way we are looking for an available port, so.

D

That was one of the things I remember. There are a few places I haven't checked all of them, because these places can be found. We looking for the files called at the end underscore linux.gov and there is like other parts.

D

We can do it in the comments, so we are using this in a few places, so we just need to check all of them, but it was much smoother than I expected so.

A

Is it easier to create a window ci circle, ci or vm.

D

So yeah first, I think we should just make sure that the code compiles by ourselves and then we can definitely test it on him, but we all have access to.

D

I think all of us have access to aws or gcp or um azure, and I just created the aws vm on the windows on our account to test it.

C

Well, if it's just to build, can't you just simply use go s as a target.

A

Oh, it's not about.

C

A

Yeah just cross compile we can.

A

I mean how to test it properly on ci.

D

Yeah then definitely we can use the windows based machines on circles here.

F

It is good to hear so far that it's not it's easier than we thought, because it's something that we would really like to have and then another thing that I would like to start working on is so grafana has a new chart type that allows to visualize a topology map for all the services consuming other services and because we are already using grafana and prometheus heavily for our metrics collection.

F

I don't think it would be hard, and maybe we already have the metrics in place to provide this new topology map on top of grafana and prometheus. Essentially, this would create a feature equivalent to kali's topology map.

A

Hey virgil.

C

I'm sorry what.

A

I mean this new guy from community joints kind of under the in the end of the call, but still hey.

F

Oh yeah, I invited virgil to join.

G

uh Hello, hello, sorry, I've just joined so.

F

Yeah hi virgil- um this is marco here.

G

F

Hi there hi there, yes, so we we are doing these um community calls twice a month and, uh and it's a great place to ask for any questions. I know that you are currently in the middle of evaluating humor, and so, if you have any questions, if you have any feature, you would like to think human or really any feedback. This is the right forum.

G

I see so until now the feedback is is very good. I try to to use you know istio before and link rd. Linkard is not good for our use case, since it is not able to to link external work workloads.

G

uh Workloads external toolkit in this classroom is not able to link into the mesh. So not not too much to to say say here and for easter. I tried the virtual machine integration and I I didn't manage to make it work with kumai. I managed to to connect.

G

With the global control plane and universal and the data plane in universal mode, so I was able to connect the external workloads, so that will work really well. I also been able to use con gateway to expose some some apis to the external world and that works fine as well.

G

I'm still having some issues with some yeah some workloads, but this is something I don't know. If you have any any solutions for this, we have some pods that need to run in network network host namespace, and I don't know if you have any.

G

You know solution how we can access, uh for example, rapid mq that is running in uh in the kubernetes cluster. How can we access it from a pod that is running in into the into the host network? Namespace, do you have any solution for this.

F

So is that how rabbit mq runs by default?.

G

No, no, no, not the rabbit. Mq rabbit mk is running in in the pod in a modern cidr, but I have some workloads that need to run in the network namespace and need to connect to rabbitmq, which is running as a regular port. Let's see what.

E

G

You have any any solutions to for this.

G

Is it possible to have mtls in this case.

A

Yeah, I think so I mean you just need to bind to another network interface, not to I. I think it should not be a problem.

G

Yeah, maybe maybe I will ask also on the slack channel.

A

Yeah yeah, that's disgusting, because now I think we're at the top of the hour and probably.

G

A

To wrap up this call so.

G

Okay and yeah, and maybe I will have some other questions, um I tried also the tracing and I couldn't be couldn't solve the relation between logs and traces. There isn't any.

G

Let's say any link directly between maybe I did something wrong. I don't know, but uh for some locks that uh have.

F

Some traffic logs.

G

Yeah yeah from the traffic logs, I I found some some logs that referred the trace but trace id wasn't in.

F

I think that's actually missing so by the way, this is a great feature request. It would make sense to wanting to be able to to connect traces with with.

C

F

G

C

G

Was I was wondering if you looked at grafana temple instead of instead of jagger, they built something, especially for this.

G

Yeah for tracing- I don't know if you, if you looked at temple.

F

When was it released,.

G

Quite a while ago, yeah, maybe more than half an hour yeah.

A

A

Yeah, okay feel free to ask any questions to the chat.

E

It looks like tempo is jaeger and zipking compatible.

G

F

So, are you able to use the existing jaeger? I'm sorry zipkin integration with temple.

G

um Yeah it should it should work with uh usual traces. I I I only tried in a demo mode.

G

The point is that it is doing this link between logs and uh and trace is quite natural, so I believe it will be much easier to have. The resolution built in just just take a look at what they did.

F

Okay, very well, um keep us updated in the community, slack yeah sure, there's an issue with this.

G

Sure, um overall, I have a very good feedback if the product is much easier to understand than yes, you still have a lot of can do a lot of things, but I believe it is way too much way too complicated for what we need at least.

F

D

G

Yeah- and uh there are still a lot of things to be automated outside the easter- and this is not really good, for example, exchanging certificates in in some deployment models, and things like that yeah, so I tend to to find much better. I find comma much better than in this regard, at least for our use case. Maybe if you have something very complicated to put in place, maybe still is good, I don't know, but for me it was too much.

G

There's a feedback yeah.

A

Yeah, thank you very much for the feedback.

G

Thank you. Thank you for for your product. It's.

A

Well, designed.

G

And the documentation of the thing.

A

Yeah, I think we're super excited the time limit. So I'll just prop up see you all in the two weeks and have a good day.