Kong Kuma Community, 9 Mar 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kuma Community Call - March 9, 2022

Description

Kuma hosts official monthly community calls where users and contributors can discuss about any topic and demonstrate use-cases.
Interested? Register for the next Community Call here: https://bit.ly/3A46EdD

This month, we will be discussing the 1.5.0 GA release and upcoming versioning change.

A

Yeah, okay, um hello, everyone welcome to the service mesh community call kuma community call, uh please add your name to that and the list I think talks. Oh I'm not sharing the screen. Let me do that.

A

Yeah, okay, please add your name to that, and the list also feel free to submit any items for the agenda. We will try to cover all of them today. um So, yes, I think we can start since last community call actual last community call. It was a great presentation from carl from american airlines. You can find uh the link to the you can find the link to the presentation.

A

I guess on our website. All recordings are here and since then we released comma 1.5.0, you can check blog posts, I can cover features quickly, so new kuma has zone ingress support. Now you can consume external services and services in another zone. Through this component, which is called sun egress, then we have new feature called gateway.

A

It's like built-in gateway, we ship, we run envoy for you and we uh set up it as a gateway. You can try to use that it's still experimental, I believe, but it will be uh normal feature in the future. uh Then we had a great performance improvement when it comes to memory. I think it's like 90 degrees, degrees of the memory consumption and also we have our new troubleshooting features to link in cli and gui. As you can see on the screenshot, you can now check what policies were applied for specific data plane proxy.

A

Also, you can check xds configuration right into the gui and the same thing. If you click on any policy on the left sidebar, you will be able to see what data planes are affected by this policy.

A

I think it's pretty cool and.

B

A

B

There's also api and and rest like kumakoto and rest integration of this. Obviously right, it's not only in the ui.

A

Yeah right, it's it's supported both in kuma, kado and gui, and also you have endpoint in the api. I think it's covered in http reference, all endpoints that we introduced so yeah. It's a great blog post feel free to get familiar with it and yeah upcoming release.

A

I think maybe charlie can cover it better. What I want to deliver.

B

Yeah, so uh what we're trying to put in this release is um some of the improvement to zone egress that we that we're still missing to make it um as as good as we wanted as we want today.

B

um We also tried to ship um gateway as a ga, um so improving some of the edgy bits that we have at the moment uh on the gateway um we will ship. Our arm builds um so that people can run on gravitron or on mac m1, for example, um and I think this is about it.

A

B

Oh no right, I'm forgetting the most important, uh which is we we're working on a full rewrite of our cmi and transparent proxy. um We think that it will be done as a preview, so it will be a flag to switch to the new.

C

Yeah, probably.

B

C

Code, roll state, but it should be there.

A

Okay, that's great.

A

And I think that's it for our predefined items of the agenda and I guess we can. We can start questions section if any, if anyone has any questions, feel free to ask them.

D

Okay, so I will start with with a question: uh why do we want to rewrite cni and transparent proxy.

A

Bart, do you know the answer.

C

So there's no easy answer, but one of the answers is that we want to make it more modular.

C

So currently the whole transparent proxy, as well as the c9, which is actually using the transparent proxy code, is using the ip tables only as well as the solution which we are using um is kind of old and hard to maintain, as we are not properly updating it. Currently, so we decided that we should improve this and make it more maintainable more ours, and you know for us to be able to to ship the ships we want to do so.

C

One of the reasons, as I as much as I hate to say, is to introduce the ebpa as the second engine for the transparent block scene. um It is not yet fully planned, but it's on our short and later room.

D

Thanks yeah, so it's less box, more stability at wp to ship edpf.

C

Yeah and more yeah and more being able to kind of uh make it, as I said more more modular right now, they will slash nf tables soon, ebpf, maybe in the future windows and it's networking solution. Currently, it's not possible completely.

D

Okay: okay, thanks because I I just I just thought that it wasn't maybe clear what is the benefit for that user?

D

B

um I have a another point of discussion which is uh helm, chart versioning, and should we just take the decision of actually mapping helm, chart and code code version together um from talking to people?

B

It's sometimes a bit confusing, especially because at the moment we sort of update the helm chart quite a lot, because kumai is still in in the phase where the architecture is not completely closed.

A

Yeah we have an answer from john, I guess yes, we should. We should mop.

D

Okay, well, I I I haven't seen any single product that does this. I think the hand chart is like the version is always different. I think, but still I agree with john, that probably it's easier for users if the versions are aligned, even if there are no changes to a home chart itself, it's just less confusing.

E

I think um I think I'd be in favor of a model where major minor were both aligned and then bug fix could diverge between product and helm. Chart to allow us to make home chart changes outside of the product. So, like there'd, be a one one.

E

Five version of the helm chart to go with the one five broad release of kuma, but then like we could have one five one, one five two of kuma, but the helm chart, would get like one five one, one, five, two one, five, three one, five four, depending on minor changes because unlikely anything that granular in the helm chart is going to be related too much to the product.

E

But at least you know which line that you're on, like I think it's too difficult to align major minor and bug fix, and also the development cadence and the like little changes which may need to go into the helm chart are probably on an accelerated like path or maybe they're less. I don't know like if you said that the home child doesn't change too often, but I feel like there's a lot more tweaks that are likely to go into the helm, chart that probably don't align with our code releases.

E

But I don't know open to ideas, though.

B

Well and there's the fact that kumakuro in star proxy is more or less dl chart. So that means, if you change the home chart, you might as well release the version of kumako, at least which we don't version separately and kuma so everything's tightly coupled in some ways.

E

I think I have opinions about this cli being the source of truth for all the install manifests, but that's probably too long for conversation, yeah.

B

Well, we can, we can have a start of a conversation about that.

B

Yeah, it's not the source of truth.

B

It's just uh the cli in the end is helm, install without helm.

B

That's all that the cni is when it comes to install.

E

And what's the okay, so I guess just to be devil's advocate. What's the use of the cli doing that, then, because it's not very expensive to use helm and since now you don't need tiller, it's not very difficult, just to download helm and run helm, template right and get exactly the same functionality. That's a good point.

D

B

D

Continue charlie after a good point.

B

Oh, I mean it's, it's a good point. um I'm I'm unsure! What's the well, I guess the value is you know you, you download kuma, like the the installer, the what not the installer but the tar that we produce and you don't need anything else right and you can get started, though, if you're using kubernetes, you're, probably already installed or helm in some ways, because helm is becoming so ubiquitous.

B

Unfortunately, maybe.

E

Yeah I mean just speaking from personal experience. I don't and obviously I'm working in the field a lot right. So I don't. I don't, think I've ever seen. Anyone install kuma using kuma ctl, really, no, I probably have a very biased, like kubernetes view, which means they just do it some other way but like I would probably I think the cuban ctl is just another tool. If I'm using kubernetes, I probably just don't need it all.

B

Okay, and does that only apply to can my code all install control plane or does that apply to all the install commons on kumako.

E

uh I don't think I've used kuma cuddle in about three months for anything at all.

C

Let's remember that we not only support tournaments.

E

Right exactly and that's what I'm saying: I'm I'm always in a very kubernetes-centric world. So like view my opinions through that lens, but like I have, I will use helm for install and lifecycle management and cubectl for everything else like. I have not used kubernetes right, but that obviously may be super different if you're using universal mode right, because obviously you can't use more cube. Ctl, though.

B

For the apply and stuff like that, but for the install, the only install that will work is install transfer and proxy in universal right yeah. All the others are kubernetes only.

D

Okay, I kind of agree with this one. I used kuma cattle installed demo very often.

C

I'm not representative, definitely, but I didn't touch helm for the last six months I didn't install. I didn't upgrade, didn't modify it. I just don't like it. It's yeah, I'm not the client, I'm not losing your production. So.

B

Yeah, it's also probably 99 of the time you installed kuma it's from source right.

B

E

Also also feel like, I also feel like our use. Cases are probably like the venn diagram of our use. Cases are probably two circles here right, like I'm often working in environments that already exist with things that need to be installed from scratch, and I imagine, like engineering folks, are mainly working like to poc things quickly or demo, things quickly or get like. You know the prometheus and like, for instance, the monitoring stack is another big thing that cuba ctl does right and like I've never been to.

E

uh You know a customer or someone in the field or someone who's using it, who doesn't already have some kind of monitoring stack so that just never gets used like I'll use it for demos, maybe but um yeah. I just think, maybe with using it for different things.

B

I think I think yeah the the the the monitoring stack in any way. I don't, I don't think it's recommended at all to use it for anything else than just demo right. It was added there to be able to do the video where it's like. Hey look. Can I call this good, my god, all that come and cut all that, and I have a entire stack, but it's not meant to be production ready. I guess so. We.

C

Have a question related to that and because we talked about fukumakato about helm, etc, so john or maybe others see any other tools currently um being used to achieve what.

E

Yeah, it is do they base it on json or case on it. I can't even remember what it's called.

B

E

B

Case on it, I think case on it was abundant.

E

Yeah, it was, but I.

B

Wonder whether.

E

Grifana took it up, or did they just build directly on json.

B

Well, graphene and labs, if I understood correctly, missed ksonet, so they rebuilt something that is very close to case on it, which was ah it's called tinker or something like that. Ticker tinker.

E

Yeah, I mean just anecdotally: I've literally never seen that anywhere apart from on their release, blog post, but right doesn't mean it's not being used.

B

Yeah, I've never seen it somehow. I.

E

Mean so like personally, the workflow, I don't like helm for its life cycle management, so I often use helm template piped into something like customize before applying it to the cluster, because I prefer the granularity of edits from something like customize, um also plenty of tools like palumi right, which can do the life cycle management using the helm interface, but they're not actually using. You know, I guess maybe they're using helm, libraries or whatever, but we're not using the tool. But a lot of this stuff just gets done.

E

Automated right and they've always already got helm doing other things, it's easy to read: values files. You know, cuban ctl is just another cli. They have to install into their build system. It's just a different kind of workflow. Someone has to learn it's just flags or a config file, that's different to something like helm that they already know for better or worse, like I'm, not saying I'm a huge fan of helm or not, but like it's just from a pragmatic point of view, it's it's already there and it's well understood right.

C

Yeah they got it yeah. I agree with that. That's probably the most used.

D

um Yeah and part you asked about the alternative right um operators is the moderate alternative to home. I think well it it can work with home right, but um you don't need that much of a templating and so on, because it's handled by operator, I think right.

B

So you create an operator yeah. I guess I guess yeah. If you look at prometheus, for example, they built an operator that, like morris, does everything that helm does right. I'm.

C

Actually curious about it, because the last time I talked operators was at least three four years ago, how you are currently shipped the director how they get into your clusters.

D

Yeah so they get their handshakes.

D

And I'm not kidding right, but but the point is that the concert is very small. Then right, it's just the crb of the operator and to know that in the deployment like the instance.

B

And I mean and.

E

Usually, usually the operator would pause be part of bootstrapping right, so we would see two phases usually, which is bootstrap the cluster itself and all the the other bootstrapping parts right. Any operators that you need and then like maybe another team, is responsible for actually applying the crds and the pieces that installed the actual applications and the pieces after that right. So I know it kind of seems a bit like a chicken and egg, but they sometimes fall to different teams. Right they're, part of different processes.

B

And the advantage of operators is, then you can do complex upgrades like multi-steps upgrades when you update things.

D

When you work with customers and users, do you see opera operators being used in the wild like very common, or is it still like not that much? I.

E

Think it's fairly rare that end users are writing their own. Yet, but it's not unheard of.

E

um We absolutely see the common ones right like prometheus operator, all the time cert manager is in almost every single cluster right, so manager is a perfect example of this um yeah I mean those are the main two that we basically see all the time, but I mean customers have written them right and users have written them.

E

I have written them for customers to do like internal um processes that have to happen in certain order or need to rely on certain things or also they're, more typically used for abstraction right, like a better abstraction for end users who don't have to want to have to worry about regular kubernetes, ammo or you know, configuring applications, but um yeah elasticsearch was another big. One like the elasticsearch operator is pretty popular. Just because there's a lot of steps that have to happen um during upgrade. You know anything.

E

That's stateful an operator is going to be massively helpful.

B

I guess for me the for for us there's these things where we can you know. Sometimes we have things where we need all the control planes to be on the new version before you actually switch features on, which is a pattern that we developing more and more.

D

And also it would be nice to restart all the side, cars after upgrading, right, yeah.

B

Yeah yeah definitely this thing of like restarting all the side, cars or restarting a portion of the site cars.

B

You know how istio does this whole pretty complex things with what they call canary control planes and then, but this is all done without operators.

B

I don't know. I think easter is an operator this day. I don't.

E

I think I mean depend depending on your definition, we're kind of an operator right now, right, like I mean more, maybe more, of a controller right, but we're listening to services. We're listening to you know we're controlling data, plane, objects and things like that. We are reconciling objects within the cluster, we're just not doing anything with the life cycle like yeah, it's called an upgrade.

B

I'm not super super good at like kurins's definition, but to me an operator was a controller plus a crd that, like does thing with this, like the controller controls, the crd right and that's what it was. Kuma is a bunch of times.

B

So right, it's just it's! This life.

E

Cycle, we don't do right, but.

B

Right yeah, maybe not.

B

But okay! Well, I guess it's fruitful thoughts. uh I guess the big thing was uh syncing. The version of the helm chart with kuma is still something we said. We were gonna do right.

A

Do we want to release home charts on every commit and master? Is it the plan.

B

We do that already. Okay. Last week, like mike merged last week,.

B

Artifact on the comments.

D

B

And then you can uh you can you can just install them, um but you don't install with like a usual helm, install thingy thingy, you give the url to the artifact.

D

It would be nice to have a ability to do the helm, install.

B

But you can do the helm installer. You just need to put the url of the artifact instead of just doing stuff right. It's not! The artifact is not in a repository. That's what I mean yeah, you see so, for example, this is one build.

B

And so there's this artifact at the bottom and if you take the link to it and you can do helm, install that, I think something like that.

A

But can we push it into the artifactory or we don't want to do that.

B

I mean it's all temporary, so I'm not reaching whether it's necessary or what I don't know: okay, okay,.

A

I think we we're out of time. So thank you, everyone. I had a question. Okay, yeah go ahead, I'm.

B

C

On the open source, um it's the external gateway uh in the open source, or it's only on the commercial offering.

B

All gateways do exist on on.

C

This negroes one eagles, is only so it's a new one.

B

It's in the open source as well: yeah, okay, okay, okay, we're only talking about the open source in this meeting.

C

Oh good good, we have a debate, should start with open source and see see. If that does it and we'll see.

D

Thank you thanks.

A

Yeah, I think we should uh finish this meeting. Thank you. Everyone thanks good day, see you later bye.

B