Kong Kuma Community, 10 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kuma Community Call - May 10, 2023

Description

Demo: how to create a new policy from scratch
Kubernetes probes (particular gRPC)
Please open an issue

A

uh So agenda today is not very packed, so we have a demo that I will show how to create new policy from scratch like. If you want to contribute to Kuma. It's pretty easy to create new policy and I'll show how then we will have time for Q a and maybe discuss um princess probes yeah, so we have uh yeah. Is it correct.

A

Yeah and so yeah, let's start, let me share my IDE.

A

Not sure everything so yeah if, um for example, you just it was browsing web and you notice that Android has a lot of capabilities. That Kumar is not supporting at that moment and you want to have something you want to use something, but you don't want to use, maybe proxy mesh proxy patch or proxy template or then you can create policy. So, for example, you notice that there is a compressor in Envoy, so you can compress requests with different algorithms and you want to contribute that uh you can do that. Pretty simple!

A

You go to the IDE, you search for new policy file, that's in the uh guides, docs slash guides directory and this guide tells you what exactly you should do. So there is a comment you can copy that you can open terminal. You paste this command, so it says or name of the policy. For example, we will use mesh compressor, as you can see. I already did that compressor yeah. Then you select what type of policy you want to generate.

A

It can be either outbound or inbound policy, or maybe it can be inbound and outbound policy at the same time. So if this is outbound policy, we will add flag generate to section and yeah we have forcedures to override. If we have some garbage in this directory so yeah we can run this command and this comment creates directory inside.

A

So let's take a look, it's package and then plugins and then policies, and then we have our mesh compressor directory and we have all these files. You can open this one. That's called mesh compressor. The next thing you should do I'm pretty sure we have this here, yeah. If you want your policy to be not in demo, not as demo, but for real. You should remove this skip registration bit. So let us do that and then you can see that there is already Target draft and two sections that we generated.

A

The only thing you should do is uh Define conf right there and we can Define new type, for example, uh compressor type which is string, and then we can Define uh some constants.

A

For example, what do we have here? We go to the reference. We have three available Concepts at the moment, let's Implement at least one. Oh, let's make it two zip type compressor type equal, you should see yeah and then you can create field type.

A

Compressor type and don't forget to put Json tag here as well, so this should be enough, and now we can call a mesh generate police policies, mesh compressor, compressor.

B

I think policy singular. Yes,.

A

Thank you, I was just checking if people following yeah.

A

Yeah so we generated oh these uh policy and we can check now what files do we have so the first one I already explained. This is uh ghost truck that defines the schema of your policy, but at the same time you also have schema in yamo format, so you can validate this yeah or if you do make check it will regenerate. Actually, all everything yeah, that's true um yeah you have schema and Kumar are real, validate resources that user creates using this schema.

A

You also have a validator, and this validator has some places for you to implement the validation, the logic uh also you have deep copy generated. You have helpers, you have a resource for Kuma model like to use internally in Kuma to work with your policy.

A

There is also kubernetes section where you have customer Search definition and you have yeah. You have plugin, that's the part where you will put your um XDS configuration, so you will check the policies. That's coming into this method. You will take all the resources that were already generated and you can create the actual compressor by looking at the policies that were matched for your proxy.

A

So this is pretty much it um that's what you have or if you call this comment and I, think it's pretty simple, so feel free to contribute new policies into Kuma, and let me do do you have any questions for this.

C

Maybe it's worth showing an example of link apply.

A

Apply yeah sure.

C

Right, just you know, I don't know um it's probably a simpler one is mesh twice. For example,.

A

Oh sure, yeah I.

C

Think one that is already implemented.

A

Yeah sure sure mesh trace. Of course we can show the how it's implemented for another policies, so we have plugin.

A

Yeah, so you take policies from this Dynamic map. You take a mass Trace type that you want to implement, uh and then you check uh the rules that we matched. You also can find them in the policy structure.

A

I. Usually, oh you do something like that. Like apply to inbounds imply to apply to outbounds methods in case of the new policy compressor, it will be only applied to outbounds methods, yeah and then you just take a data plane, you iterate over the outbounds and you call configure listener or something like that, and in this listener this is already Android structures. So you take listener. You iterate over filter chains and you configure each filter chain respectively. I.

C

A

Think compressor is HTTP filter, so you will probably you should take probably HTTP Connection Manager and then take HTTP filters and then put your configuration here yeah. So this is how it works.

C

And from a registering point of view, Etc, if you were to start the CP right now, you would be able to see in the GUI like and everywhere in the crd ETC. You would like your new mesh compressor would be registered, but there's nothing extra to be done. Oh.

A

Yeah but you have to call generate policies because I think it's a.

C

A

Is to generate key Imports and other stuff, but we can check that as well.

A

Oh yeah, okay, I think we need to just. There is weird bug with the patching the yaml values file.

A

A

So, as you can see, we added mesh compressor here to the list of policies. We also added import file so that it was actually registered and then now we can, we can run Kuma CP, for example,.

A

And if we go to the browser and check the uh will, we see this and go here.

C

Then policies here in the drop down it should be here.

A

C

Right yeah, there's.

A

Already because.

C

You haven't created any, but.

A

Yeah and exactly and if you check uh mesh compressor arrest.tiamo, there is Swagger that has already method defined. That's why, if so, should work? I, think if you do just this so yeah you'll see that these endpoints already defined in coma.

C

Yeah and- and you would be able to create like instances of this, that match existing data planes and the inspect API would work like all. This would work for you. Hopefully.

A

Yeah, so everything out of the box yeah and you just have to implement uh validation and uh XDS configuration right. So pretty simple.

A

Okay, any other questions.

A

Yes, so we've uh no more questions for this and then oh thanks, um so yeah I think we can move forward. I, think q a can be the last uh part, so yeah, uh let's discuss our comprehensive, prompts.

A

So am I uh saying the name correctly. Is it Yan.

D

Oh hello, hello, hello, sorry, uh yes, that's correct! My name is and I have joined. I have joined this. uh This meeting as uh currently we are working uh more and more with Kumar, and we are applications also need to be more reliable. So we are kinda struggling a bit uh with the kubernetes probes, uh most particular the grpc one.

D

So basically I just wanted to ask that if there is any roadmap for such topic, uh as it's currently I'm, not sure if it's correct but looks like it's not covered by Kuma I mean by the Sidecar. So uh we are looking for workarounds how to Simply keep our applications uh on that level as we need uh I mean the availability level so yeah, basically, that's it. So how you deal with the grpc applications for now guys that that's that's the main point.

B

Yeah I guess I can I cannot uh answer this a little bit because we uh we have grpc applications in our Cloud offering and we also use command or Cloud offering well yeah, and uh usually the pattern that I saw is that there is a separate HTTP server that is used for you know serving Readiness probe and Matrix and diagnostic stuff like that right and so basically, then you use HTTP probe, which we, uh which we support, and you in a way that um you probably looked into right, that we we have this, this virtual probe concept that we override, where it is probes, so kubernetes can contact only this one endpoint without ntls right.

B

um Well, maybe my question is: um are you talking about this new grpc probe feature because I see that in kubernetes one 24.

D

24, yes, score. That's correct, sir!.

B

Yeah, okay, so yeah we definitely. We definitely don't do anything about this right so like. If we don't override those kind of probes, uh then then we have basically this problem, that application is secured by ntls, right and kubernetes is trying to like contact the application, Enterprise and TLS, and it cannot do pro right. This is yeah. This is probably what you saw.

B

um Yeah I think we haven't discussed this. uh Probably we could do a similar thing like we do with HTTP probe that we kind of override this, but I'm not sure how that would work with grpc. So we can only expose like one methods. Let's say how: how does it work like with a grpc? Can you specify like a method or just parting? That's it.

D

uh It's actually specified by by that Health uh house configuration uh actually on on there. It is Health checking uh Health checking uh interface. It should have it's kind of it's specified by uh grpc Community itself. Actually you can you have a link in front of you. uh It's on the top of the page here, I think so so maybe you can yeah. This is this.

A

D

One yeah, it should be it.

D

Or let me just send you the link one second.

A

So you already have a grpc server. You have to implement like just start on your server and kubernetes will know that right. So you have to specify on the Port Central.

D

Yes, that's correct because you have specified this inside the application protocol.

A

D

Basically, the uh yeah, as you said before, the Puma is just blocking this communication right now, so we are not able to reach peace. Endpoint.

C

Yeah, okay, so well known, Health Service right, so it seems like we should. We could do that right.

B

Yeah yeah, we yeah, we definitely can right because um with HTTP we are exposing only like specific paths right. We could do the same here, because this service is exposed like under the hoods in HTTP to under some specific path. So we can only like. We could only pull out this path for health checking and that would work um yep, it's just it's it. It requires uh an implementation on the on our side,.

C

Jan is this something you're interested in contributing Maybe if.

D

We help you find.

C

Like find the places where you need to.

D

Sure do it sure I'm I'm definitely up to it, and we can also test it in our environment if it works well and give you the feedback afterwards, okay and then it will be like plenty-filled used in our environment, because we really rely on grpc applications and yeah. It's traffic, also oh kinda, it's growing day by day. So definitely something what we should going to utilize. And you know the containers are dying or not really helpful all the time. So this probe will be very helpful.

C

Yep, okay, cool! um Do you want like, so how about the next step? Is you open an issue right.

C

And then uh we'll make sure we will catch it and you know add the code pointers to help you like figure out where, where this needs to be added and add a bit of context and then we'll we'll like feel free to ask more questions on the slack and stuff and and someone from the team can can help you um get your contribution home. If that sounds good.

D

Perfect perfect thanks thanks a lot guys well. Thank you.

C

You're welcome.

A

Oh yeah, we have time about five minutes to discuss anything you want. So if you have any questions, please ask.

A

Hey if there are no questions, then uh thank you. Everyone have a good day and see you next time. Bye.

C

B