Kong Kuma Community, 26 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kuma Community Call - May 26, 2021

Description

Kuma hosts official monthly community calls where users and contributors can discuss about any topic and demonstrate use-cases. Interested? You can register for the next Community Call: https://bit.ly/3A46EdD

A

So the question was about the yeah, so cody we pushed the release by one week by the way yeah I saw that I saw the notification come come through any any reason or just because I was just curious. Oh yes, joining okay! So, regarding the rate limiting there was a discussion of where we need to apply it. What approach actually to take and mark was pointing out some use cases back into only handlebars, but can we only handle them because human source shouldn't be able.

B

To make 200 it's okay, do you also have global great limiting in scope.

A

No, that's that's the local rate, limiting that we are planning on.

C

Okay, so I guess the question was: how critical is to support sources in this case.

A

Yes, that's my comment, so we want to be able to set up a global limit from any source and then we also want to be able to override that with specific limits that are coming from specific sources.

C

Okay- and I was saying that at least for tcp limits that might be a problem and evr is the issue that for http, if we base this on headers, this won't be like ntls secure. I'm sorry, what's what's the point here. My point is that it might be difficult to implement this with your requirement in place that we have sources and destinations and we support all of this and with http end with tcp. Also that's my opinion, but I looked into the android configs more so I might be missing something.

A

Yeah, my idea is that it should be the same way I mean as soon as this is just a filter. It should be the same way like we have on ingress. I didn't look deeper than this, so if you have some feeling that it won't work, maybe and discuss it. Okay.

C

I mean I okay, let's, let's leave it for nikolai again.

A

Okay, good, I saw we had a couple of people joining so deep.

A

Do you have something to share with us? Do you want some feedback to to to to discuss today.

B

So yeah on the we on the control plane, yeah control conversioning.

B

So I think what jacob said is we might I mean you guys want to take care of the uh take care of the the upgrade cycle because v2 to v3 you might want to have 1.18 somewhere and then move all the v2 to v3.

B

So uh so I mean I I don't know if I should uh move ahead with that or or you want to take it up and- and I think you also mentioned- that the kde, uh the kong xds server, the global to the remote one- also uses the v2 spec. So some work might be needed on that front.

B

So I I wanted to get the get the go, control plane up, uh upgraded to something like march 10th or something because uh one of the proxy filter that I'm trying to use is not uh is not supported by the controller at this point in time. But I am basically whatever you guys give direction.

C

Yeah, okay, so that's true! That's it! Okay! So let me maybe start with go control plane that have you checked if this version contains v2 snapshot, cache or not,.

B

Yeah so um march, 10th has v2 v3 both.

C

B

But later at some point in time I think uh v2 is removed, because when I try to take the latest and thought of compiling it, it broke because of all the v2 stuff.

C

Okay, so if the version that you are looking for contains v2v3, uh you can pretty easily upgrade this um yeah. I just I think I wasn't expecting uh v2 to be removed uh in gold control plane that soon and the like.

C

The only problem problem is that we use v2 discovery, request and discovery response, which is pretty small protocol right, but we still use this for the kbs and we thought that this is not really a problem, but if they remove the v2 snapshot, cache and everything, this will be a problem so uh feel free to upgrade go control plane if this contains v2v3 still and we need to on our side but on either side plan to migrate, kds to v3 discovery, request response.

B

Okay, so I'll raise a pr on that, the other pr on which you mentioned the header, so I I was able to change that that I was able to make that change. I actually tested it out.

B

It's working, fine, so I'll raise the pr today or tomorrow, and what I'm doing is basically I'm taking a list of headers so as as many as a user wants, so that that particular pr might come.

C

Okay- okay, great so is it like generic yeah.

B

B

uh It is like add header space and then encoded text and then whatever you provided, will be broken into key value pair with same with with colon as the delimiter delimiter, and we save it as key value pair. And then, whenever we create the headers to talk to the control plane, we had add those extra headers.

C

Okay, that that works for us.

B

And that uh l7 support uh for http actually yeah, that's a great feature from your site. Actually, so I'm eagerly waiting on that.

C

Yeah, I'm wondering um do you. Do you see using the modify section that I proposed in the in the document like? Is it critical for your use cases to use this.

B

Yeah- and I mean what what I do is basically, I use the uh native onward to do these kind of paths, path-based routing, as well as uh redirect as well as when you are changing the path prefix. So those things are something that we use.

B

uh I think it will be useful, as in uh as we expand it to more user it it might be useful uh and why bc http is because a lot of users are http based and and and if you look at the way they deploy right, they have a tomcat which is which is front ending and then and from that tomcat they passed it to all the other microservices.

B

And that is why I was. I was little eager to basically have uh have the paths or have the uh the pass in such a way that uh you can do routing directly on that. uh So it will.

B

It will exactly replace the comcad, but then that is like your interest functionality right without having having an application, but if, if we can have that in I mean it will be a great replacement for all the tomcats uh tomcat kind of user who are using tomcat for this particular uh use case right, then then then we can.

B

uh Then it will be easier for them to basically uh use puma and move forward. Otherwise, at this point in time I am having to write proxy templates to do that, which is which is not a very great, which is not a very great uh solution in that and.

C

Okay yeah, I was wondering because recently I discussed with nikolai whether the modified section makes sense in traffic route, or should this be like a separate policy like timeout, retries and so on. So I was also wondering about your use case for l7 yeah.

B

So, on the proxy template side right I mean I see that you, you support, listener clusters and all of that they also support secret and then can I add, a static secret. If I want to.

C

And not at this moment, I think you can't so yeah, but also it should not be that hard to add well depending how you want to provide the secret really so yeah. But if you, if you kind of need this functionality, we would be happy to receive a pr with this.

B

Okay, let me see actually so how how it has been implemented. So, if possible, I'll extend it.

C

Okay: okay, asking: how is the pro diffuse mifus stuff progressing.

D

um So I opened up the pr, um even though I said that I've been leaving comments in the original design issue about the approach. uh It seems like the main maintainer wants to use uh http long polling um instead of like interval polling, um so basically grpc without grpc, like still server push right. It's like so um yeah. I I haven't gotten around to actually implementing any of that. But I've been asking around on the go control, plane side of things to see if there's any already built out xds resources for this.

D

But if not, I don't think it'll be uh crazy, difficult to build and the largest piece is already done, which is serving mods over http. So um I think I'll just come up with a proposal on how we can uh use it.

C

Okay and how is the generic http sd card cloud calling? Are they implementing this or.

D

Yeah they've got a draft open for it. I've talked to the maintainer about it privately. He said that uh now that he's in charge of um prometheus, he has a lot more freedom to push things through, and he finally agrees that this is a good idea, so it will get through, but he gave me no timeline.

C

D

So um yeah, um I don't know if I can give a good timeline either, but it's it's progressing.

C

D

If anyone has any experience in long polling and wants to help there, but.

C

That could be helpful.

A

What is long point.

D

uh It's opening a long live http, 1 connection, uh yeah yeah.

D

Exactly I I don't see, I don't especially with the xds like 304 response, where you can send back no data. I don't really see the benefit of long polling, but I guess it'll, it's marginally better.

D

A

Yep, but is there anything else that folks would like to discuss.

B

uh I just quickly looked at my github issues, so I think there is one question from bart right whether I still see the gui issue. The answer is yes, it happens only with chrome, it does not happen with uh with mozilla somehow, and I have I think, which I remember uh when you go to the console. When you go to the console, you see like a timeout or something like that.

B

A

B

One six two.

B

A

I will need more information, you know from the network, tab, etc.

B

I'll I'll give you a screenshot of how do I pass it? I mean, I think I have your email letter yeah.

A

Also, the one be sure that you are testing the newest version.

B

Yeah yeah, we are testing the newspaper I mean for me. I've never seen it running on chrome ever and the other issue which I had raised was the uh advertise address. I think that work is also done and I'll submit a pr on that.

B

I have tested it with uh in memory I mean: uh do you think I should test it with uh with uh what is it you don't use post? Will there be any uh migration script changes?

B

For this I mean there will be additional a data plane component additional address and advertise address.

C

Wait but if the address is not specified, we can just take the address, not advertise. Others right.

B

C

uh So you were talking about introducing advertised address into inbounds right right.

B

C

Okay, so my assumption was that if advertised address is not specified, then we just use address right.

B

C

Yeah, so then, if you, if you, if you think about this, we don't pick any migrations right, because it is a backwards, compatible change. Isn't it.

B

It's yeah, it is backward compatible. It is.

A

B

Addition of it is addition of new uh new variables, so should be fine. Okay, I have not looked into that space. I just put it to get your views on that yeah.

C

B

And will you be uh sub ca, sub ca changes? I think that is one more pf uh that we would like to give like one of my colleagues so that change also. You would like to take right.

C

uh We change I.

B

Sub ca so uh uh like in like an istio, we we can provide us sub c. I mean it need not be a c. I mean it could be a sub c, a.

C

Bargaining: okay,.

B

And then you can make more certificate out of that and there was a change needed to make it work.

C

Okay, so yeah, if you make this change, please make sure to add and test with this, so we can verify that it actually works.

B

What what do you want to add end.

C

To end test for this.

B

B

There is another thing that I want to bring about is uh what we see is. uh We are not using post space, but we are using top ones right. So I see a lot of calls happening uh to postgres and they are like for two seconds three seconds. So what I understand is because uh you do all the polling, and that is leading to all the calls so because of that, uh the the caucus db is basically uh getting a flurry of calls uh connection established and connection broken.

B

I mean collection uh later on that kind of logs are coming continuously, so connection pooling is something that we did, but as the number of cps are increasing, uh people are testing. We see a lot of calls happening, so could there be something that we can do to reduce the number of curves that we make to the database.

C

uh Yeah, so you can easily change the internal of uh generating data. Plane configuration right. So if you are fine with some more latency uh like when you, for example, propagate the traffic permission policy- uh and you are fine to wait like five seconds to base config the pro propagated in android configuration, then you can increase this interval and then you can kind of reduce the number of calls to cockroach.

C

Okay, I can send you a piece uh in the box about this.

B

Yeah when we have, I think that that is something that we did and it did come come down. But if we can really do something about this sync that we do for each and every data plane that gets created, it will be really helpful because it's directly proportional to as many data plane that we can trade as as many measures we create our data. I think data.

C

Yeah well for generated configuration. We are trying to catch the responses from the database on the resources that we fetch. So I can generate a configuration for different data planes. um We are trying to avoid excessive um calls to uh to a database, so it in this sense. We are trying to optimize this, but maybe there is something else that we can do.

A

So with this we have the call in two weeks and meanwhile we are available on the slack channel. Thank you have a great day.