Kubernetes Data Protection Working Group, 9 Feb 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Storage - Data Protection WG Bi-Weekly Meeting 2022-02-09

Description

Kubernetes Storage Special-Interest-Group (SIG) Data Protection WG Bi-Weekly Meeting - 09 February 2022

Meeting Notes/Agenda: -

Find out more about the K8s Data Protection WG here: https://github.com/kubernetes/community/tree/master/wg-data-protection

Moderator: Xiangqian Yu (Google)

A

Morning afternoon evening, everyone today is february 9th uh wednesday. This is the kubernetes data protection working group meeting. This meeting will be recorded. We do. We do not have too much to do uh in today's agenda. We have a couple of cap updates.

A

I think one is the uh long deserved warrior model conversation and this man just gets matched, and the other thing is, I think, ben have has pushed the william popular targeting uh volume, popular populator, to beta congress ban. I will go through these two items and then there's an annual report for the working group in uh this is. I think this is a kubernetes.

A

Wise kind of you know report in a yearly basis, and this is there's a link over there talking about or specific working group, and then we open the discussion to this larger group. If there's any other topics, people want to discuss all right. Let's get it started on the uh kept baptized uh the royal model piece shin again. I cannot present my screen. Please help me.

B

Oh you want me, you want me to open that cap, okay, yeah! I can open that yeah.

A

You want to give a little bit background on this.

B

Right so we talked about this a few times in this wing group previously. So now the cap is merged, so we're going to go ahead and implement that uh so ronna is working on this uh right. So take a you can take a look of the proposal.

B

um Basically there's a couple changes, whereas in the volume snapshot only snapshot content api, we are adding a new field which is the which is the volume mode from the source volume. So we have that recorded in the world in snapshot content.

B

So this way, when someone is trying to create a volume from the snapshot, then the the external provisional will be checking just to see the new volume mode and this uh source volume mode on the wall is natural content to see if they match. If they don't match, uh we want to check if even there's this uh annotation added on the volume snapshot content that allows body mode change. So that has to be set to true.

B

uh Then that will be allowed. If it's set to force, then that's not allowed so those other those other um changes.

C

And is that implemented as an emission controller or just a failure to provision.

B

This is going to be uh so. The change will be in the external provisioner at the provisioning time. It's going to make that cheap. Make that check. Okay.

C

So you'll be able to create the pvc that points at the snapshot, but then it'll just fail in a loop forever.

C

B

Okay, all right yeah, so this is just to yeah bring the awareness if uh you know, uh since the yeah, just using the api right. So it's uh this is uh well the. I think we talked about the the reason behind this uh type right. The the motivation is because there is a potential security right right. Okay,.

A

Cool thanks great work. Next one would be data populator volume, populator ben.

C

Yeah, so it's not beta, yet congratulations are premature, um yeah yeah, so so we're back on the uh back on the the kep or the the kubernetes release is go as you're targeting beta uh the the work is sort of 75 done for for the out of tree work, I need to write a very small pr. Entry shang has been helpful with the reviews um and so yeah just uh just got to get it done in the next few weeks, not too worried about that.

C

um I guess since we're talking about it, uh shane did you. Did you see my comments or my response to your comments on the review? Yeah.

B

Oh no, not yet! Okay, I will take academy.

C

Yeah I mean this is minor stuff, but uh I'm trying to.

B

C

So we can get that one in and then we can push the release on that um and we'll call that release beta. I believe and then and there's also work to be done to get like tests enabled in the in the gate or in the ci.

B

uh Okay, so so one change you need to is to you may enable the feature turn on the feature gate right. uh That's one.

C

The the entry change yeah is to move the feature gate from alpha to beta and the reason we didn't do that last time around is because we didn't have metrics in the.

B

C

Controller or in the the library so like.

B

And then the- and that is the et test, so oh, we talked about e2 tests.

B

Where are we going to add the e2 test that we're going to edit the out of the tree, or is that I think we talked about.

C

That last time,.

B

I'm not sure what.

C

Yes, I I don't have strong preferences for where the etvs has to go. I I do need help uh with you know. If we're gonna, do it in a way that's different than how we've done it for other projects, then uh then yeah. I need an example to follow. Yeah.

B

Yeah yeah: we can look through that yeah.

C

Was it? Was it patrick who, who had suggested a way to do it.

B

uh I can also give you some links because we actually do that for our driver. We have. We have e2 tests in our driver repo. We are using the entry e3 test framework, so I can. I can uh send you a link of that.

C

And- and you can make it run as part of the gate.

B

Oh, that part, um so for that I think we need to. We need to uh set up that in the testing, for I think that that would be.

C

B

C

That's the help I need, because it did, the edg test need to be running the gate, and ideally they also need.

B

A

C

The kubernetes gate so that people can't break this feature from the kubernetes side.

B

Well, if you want to run the um then, then that has to be entry then has to be under. You know: kubernetes tests, you do test.

C

For at least some part of it, yes, yeah.

B

Yeah we can within. We can talk about that.

B

um So so I just now remember there was a. There is a cap that says data when it go beta. It actually does not turn on by default turn it off set it off by default. So we need to check that. I'm not sure. If that's something that is happening already, then that would be bad because then that means well.

C

The decision to to change it to beta and the decision to turn it on by default are two separate decisions, but I've never seen those decisions made separately or every.

B

Time there is a there is a cap that thing gets merged. That says, for the new and new features, something like that, but we can we can take another look of that. So I wonder if that actually affects this. I.

C

Mean an individual feature could decide to call itself beta and still off by default, but like we don't want that, we're not going to do that. So unless someone like forces us to do that.

B

Yeah, I guess that's a question, I'm not sure if that's like not a new requirement now or is that something just opt-in or what so that. Maybe we need to find out that that.

C

Seems like a bad idea like because there's no difference between alpha and beta.

B

Maybe they see that we do that for csm migration. I don't know if that. That's the that's why they got the idea. I oh yeah, yeah. Probably we should follow up with that one. I just now remember there was a cap like that got merged recently. So um yeah, then that's yeah. That's that's bad for this particular feature. Then, because then the feature gate, even though it's data it's not on by default, then you still have to go manually.

B

C

Yes, we need it to be on by default. Yeah.

B

Okay, yeah: we will take a look at that uh offline and see what, because that have an impact on a lot of features. I know just this one.

A

Cool we can take this uh all detailed discussions. Offline, probably.

A

Right, uh could you open the annual report.

A

So those are questions to figure out basically right.

B

Yeah, I think we can actually talk about this one a little bit here, because everybody just just we don't- have to go in details, but we can just look at this one right. It says what the work one group did this year. Well, this actually is for 10 21. So we can talk about the white paper that definitely something you can that's merged.

B

uh Do we want to mention any of the caps that we can maybe mention caps that are merged or something.

A

Yeah and not being sure, there's another like second one, that's not being tracked in caps. Yes, so so I assume number one should kept. You know mention all the caps.

B

Okay and then so this this one may be like some of the discussions that got started, but we didn't really have a cab like, for example, like the replication right. So some discussions, something replication.

B

A

B

This one does not have a cap here right application.

A

And also the application level orchestration right or this.

B

All right, uh what do you call application application.

A

You remember tom used to give a serious and another person from give a series of discussions over this as well. I think it helped a lot on the white paper.

B

We have those yeah, we have a lot of those in the white paper. Basically, um it's kind of uh we can you want to list this one separately.

A

B

Fine, that's fine, but is this the right term app level illustration or.

D

So I guess um do we want to include like the open source work going on, that isn't part of the that's kind of by the companies? It's like valero canister, those kind of things- um I'd probably say- maybe not here, but right.

B

Because this is for, like the working group uh right, so that if it's, if it's something that we are even there is like a subject like we are talking. We have been discussing in this working group, but it's not tracked by a cap. We can. We can have it here like, for example. Let me just give an example. We didn't really uh discuss that in details. Remember uh like how to handle operator right. If you have operator, how do you handle restore something like that?

B

uh So something like that and if it's a topic we discussed here, I think we can actually add it here.

B

So uh there are other things that we we should check. I think we talked about like um like backup and restore different different uh different kubernetes versions or something that's some some presentation in front of our team. I remember that maybe something like that um yeah we can actually list those. I think maybe like the. If you know the presentation um someone did we can. Actually, if it's you know it has a a specific topic. We had to mention there right so like I was thinking this one, maybe like grenades.

B

What do you call that uh backup and restore this cluster version? A different? I don't know what you say: it's not different, something like that.

B

A

Yeah this is this: is the early discussions about yeah the the crd versions like kubernetes, cross, regressions, etc.

A

B

Something well yeah yeah, please feel free to uh you know, comment or add to this uh or maybe let me see.

A

You you want to share this one. First.

A

Yeah we got this a starting point right then uh letting people comment on that.

B

A

Go back the white paper in the face. Think of them like a lot of money.

B

Like that, oh I think we talked about something like the: how to backup restore uh like a cloud service or something.

A

Right, yeah, you externally manage to uh store systems, etc. Externally,.

B

I need you, the.

A

Services, services.

B

Okay, all right.

E

So I don't think this is dave. um I don't think we've been doing too much in this working group. We probably should be working with the uh the cappy team on backup and restore of cappy clusters.

B

huh Oh, uh the cluster api, you mean.

E

B

E

That's maybe like future.

B

So, let's see, I think there is a section for future we use there's something that we can is that this does not have a future. It's pretty strange.

B

People can add a section, I don't see any uh yeah. That's it's only talking about like what current initiatives, but then what are our future intuitives project? Health, okay, little map- so I think this stuff- and we said yes uh and then roadmap. Well, we have a lot of things that are not done yet right. So all the things we listed as missing all the missing these meeting blocks.

B

uh We can add some. We can. We can add details here, yeah, it's it's weird that they don't have some. We can add a section, maybe like a future future.

A

This this is a yeah. This is, this is a look back.

B

Right, this is a report.

A

B

So maybe we can just add that in our in in our own agenda dog, like some of the future topics we add like, maybe here we could.

A

Right right, right, right.

B

Like here right future topics, for example, so maybe you're saying so dave what you're saying like what happy something like that.

E

Yeah backup and restore of the management clusters, um it was kind of a hot topic.

B

B

Management clusters.

E

Yeah yeah we had some issues on restore.

B

Okay, uh all right so, okay, so uh are there anything? Well, so you know if we can't remember uh anything right now feel free to take a look later and add items here and then project project house.

A

Yeah, this is basically uh do we need to yeah and.

E

B

Yeah, so basically just look at what we have done right and so that's the report of last year, so uh yeah. So this one. Basically, I we can listen to like all the things that we we added as the missing beauty product. That's not not completely, unlike the content, notifier right, the choirs, quite as quiet as hooks all of those work, but not completely alright, cbt uh a lot. A lot of things.

A

I think we should take this. uh This is not you like recently right, I'm sorry. This is not deal like uh in a couple of in in the months or so right.

B

I think we probably should get this complete this month. So it's okay, uh I can definitely add more details, offline and then others. You know uh if you think about something add to here. um Let's see if there's.

A

B

Contributor, oh yeah, this is this is a yes yeah. We don't have to complete. I'm not saying we have to complete it here, I'm just saying since uh everybody's here uh you know we can. We can start this one, but we don't.

E

B

This part, we can finish later right. Oh yeah, one thing I I actually. I was trying to understand what swimming okay so are there any do we have any end users? We don't, I think, do we any people here and use that I think we only have vendors, uh backup, storage, vendors, car providers.

A

It depends on what feature right. I believe.

B

It says: uh uh are there any contributors in this working group, basically who are contributing in this working group, because that's what this means it's not like. Is there anyone using the feature that we, you know uh like snapshot, that, of course there are users. I think this is more about this particular working group. Are there any users that I I'm not? I don't think we have any end users.

E

Yeah, I think this is asking for what would we ask the group people are currently in the group to do.

B

E

They're not doing.

B

Right right, which I think.

E

We're good, I mean yeah it'd, be nice to add some other like actually add end users and maybe some app developers, but I don't think that's what this is asking.

B

They're, just basically asking that they're not here so, but I think is a is a certain a is that the end user. Is that considered end user, sir, uh probably but all right, but we are going to ask them to do more. Oh no, I'm saying, I think, there's some participation from somewhere yeah yeah.

A

B

In certain, that's why I was I just checked. I just heard that yeah.

A

This this question is not about that right now about.

B

That and the user can contribute that they currently are not uh so yeah any. How do we answer this? One? Any end users can come and uh uh they're they're if their end user can come here. They can give us some feedback. Well, actually, you know what is actually the end user. I believe there is someone who um I think, that's actually when we like this particular topic is probably from an end user.

B

Remember that we got that question from the kubecon session. I think they're they're, a user.

C

B

Don't really think you can say that.

C

Developers are not also users, because all of us are using kubernetes, pretty heavily or maybe some more than others, but.

B

Right but this one is basically asking end user companies, so this is more like we, I think most but.

B

Because if you look at cncf whenever you submit a session or questions right, so if now for us to answer, we are and use a company, then then that's not it's different! So like we are.

C

The question like is your core business dependent on running kubernetes.

B

Or something yeah, if you are comfortable, I think yeah. I think there's definition there. If you could read that basically uh yeah, we are not uh we're, not end users, you have to be your company has to be in that end user group. Then. Yes,.

A

B

Apple is the end user.

A

We can find some examples from past year and to see what exactly people answer. This question, I think, there's ambiguity there.

B

Right so I think that, like oh just it's just an example, just for my reference, uh I think some some someone.

B

Requested this at the end user, so I think it's asking what they can do more, so we can say we want them to. You know they can participate more and they can bring up their uh requests like like what this user did, which is good right. So right.

A

B

A

We us two can take a step on this one right so uh next meeting we can. We can finish the skeleton of this whole dark right and share with this community here, just in case we missed anything or there's some anything that people wants to bring up, etc and then right so uh otherwise it's not the best use of this group's time.

B

uh But I think it's suggested by the. um What is that the secretary.

D

B

Committee is actually yeah, it's kind of saying, but it's just suggesting nothing. You have to right. Yes,.

A

B

It's okay, that, for you actually work on this in this, uh you know in the group meeting. Of course, it's.

A

B

It's a suggestion: yeah.

A

We will that's why.

B

A

It's just that we don't have a quite uh you know. People don't have the context. Yet that's what I'm afraid.

B

Okay, that's fine, so, okay, so I think then we can maybe work on this offline. So this one that this uh one little space well anyway, I'm not quite understanding that this last question: okay, we can, we can yeah, we can uh uh so shenzhen. Now we can yeah we'll walk through this, um but this is a dog case, uh so yeah.

A

And everybody got everything I can.

B

Take a look and.

A

Okay, everybody get a link, everybody just please feel free to do to edit this doc, and then uh we can maybe spend another 10 minutes in the next session to go through this before we publish right. That's that's that's much easier way.

B

Okay, yeah sounds good.

A

All right, that's the last item, so I'm going to stop recording in case anybody have any secrets to discuss.