Kubernetes Data Protection Working Group, 20 May 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: WG Data Protection Bi-Weekly Meeting for 20200520

Description

WG Data Protection Bi-Weekly Meeting for 20200520

A

So good, ok today is May 20s 2020. This is the kubernetes protection working group meeting. Today we don't have too many items, you know agenda, but we have a big item to go through Xin and a yarn actually shin and me had a meeting with the sick, node, 6 storage and another grueling group, and it is community team Hawkins last Friday right. She is that last Friday whatnot yeah last Wednesday, last Wednesday Friday.

B

That's right: that's.

A

Friday, ok, that's Friday. It was a long discussion with regard to the execution hook, design. It is expected. We are facing a lot of questions and some pushback from signal side to put the execution hook, definition into container and they are all reasonable questions. They're all reasonable concerns around this whole design and engine and I came back with the four different approaches we need to look into so from, or community or community.

A

The better protection working group would me personally want it and it's general, probably it is to collect evidence from you guys and the credit use cases from you guys to see which one exactly we meet or requirement while, while if, if we can, we should put for a more generic solution for everybody, I'm not going to go into too much detail over here. Shing has the design talk and she can walk you guys through Chris throat, host any use cases and questions around the design at any time again.

A

This designs in the worried early stage at this moment. From my perspective, we need everybody's in good to make a steam move all right. Seen now is all yours.

B

Thanks Jen, let me see my screen.

B

So this is the container notifier draft proposal. We went through this once so. I just want to summarize what we have proposed here before talking about what are the concerns from signaled, so here we're proposing to add a inline poor definition for continuous signals and an API object to send a request to trigger those signals, and then external controller, such as application-centric on snapshot controller, would be the one to send the signal and request a signal, API object and cubelet, which is that and the runs command accordingly.

B

So this is the the API. We have a inline poor definition, so we proposed you, add a container notifier here inside the container instruct, and this contain notifier would contain a unique name. Let's say you, that's the.

B

Unique name within a container, and then it has a handler handler, is basically this exact action that I like to define a command that you can run inside a container and then also known as the timeout like how long we should wait until we declare that it's it is completely, but not no longer retrying. So this is the inner definition for this container notifier and there's also a notification the object. So this we have the spec in its back.

B

We will have the container notify name, so we know which contain the notifier we are requesting and then there's a pot selector so specifies which pot we should be sending this request to, and then there is this. This is exploration seconds. This one basically is two more for like a garbage collection, but this is I think there are some concerns about this option. So I think this is it it's just something we added that we're not sure if we want this one or not so the, and then there is also status status of this notification.

B

So, like external controller likes national controller, send us requests out and culated gets this request. It finds this contain notifier starts to around the comment, and then at that point it was set as a notification condition to note it says, going to sell those notification, sugared condition type and then once it's complete is going to set. This notification succeeded whether it is the true force, true meaning it's successful, otherwise force, meaning it's not successful.

B

So maybe those are the API changes that we are proposing.

B

So we have a lot of a concerns from sick node for signal side. Think the main cause yeah Xin.

C

Can I stop you for a second sure, of course, I'm trying to synchronize this new design. With my concerns from the old design? Is the notifications, success or failure in? Is that, like the notification wasn't received at all, if it failed or is it the notification succeeded but like something that it triggered then failed? So.

B

So yeah, so this one, it's actually something that we need to settle our time discussing. This is actually one of the main concerns. How do you define success as a failure? So what do we have here? Is the cubelets right? It's basically watching this a container, no TV this this one. Actually, the this notification object actually right. So this is sent by a external controller.

B

So let's say snapshot application central control, let's say so when when cubelet gets that it's going to find this container notifier by name and then it's going to run that come in so let's say suppose we are trying to do acquiesce right and then this is like the your rani in this command inside the container, and then it's going to return a success.

B

It's going to return a weight when it's complete so and then, of course, if for any reason it hands or I, think this is something that we also talked about in our previous design. If, if it turns out, then we can't clearly can't wait in there forever. So we do have this timeout here, which is controls. How long it's going to wait. So this this timeout will be like the maximum time that Cuba is going to do no matter how many reach wise it does.

B

But when this timeout is reached, then it's going to just the same. Okay cannot finish so.

A

B

That point, it's still like a the status still force where it is not complete, because we.

C

Can't control week.

B

Yeah, assuming.

C

It does complete. Can it say that it failed if.

B

It completes if it come back and if we get an air that is honey if we get an error yeah. So if you timeout, we also treat it as a failure right, because we don't really know why the status is so yeah.

C

Yeah and timeout is a timeout, but then there's a if.

B

It's a fast failure, then, will the command when you run the the command? It's going to you you're, going to get a failure. You're gonna get an error. Okay, so I think wait to be.

A

D

And I think we need to be a little bit.

A

Careful work here I I kind of know where it's from I don't think. Couplet is capable of attaining and greater an execution against the container. It's a fraidy or not effectivity, because if.

B

You look at our code, it's time house is different, let's say: if it's not time out, there is an arrow, it's a yeah, it will get a arrow and also like a message. It was. It will also get.

A

When do you expect cupola to understand that.

E

B

Leader will return no cube leader well, be watching that that's they're doing the same thing for or the.

A

Other I think this is exactly one of the concerns right. Yeah.

B

It is what I'm, trying to what I'm trying to say is. That is the one way that we are determined. However, whether that is true to a force. That's another question right. So that's why that's there are concerns. Is this is not deterministic, but if it returns it, if it returns the arrow, then we know definitely something happens, but if it returns success it actually may not be really quiet, I think that's the main problem, if definitely turn a failure and.

C

I hope I have one one extra layer of complexity which is like okay, especially on the unquiet side. I believe it is important you can return to to cry. There's there's three possible results right. You can unquiet successfully and say yep, it's it's bad. You know we're back in business, mmm-hmm, everything's, fine or you can say, I failed to unquiet and I expect you to try, because the application might still be quiet and I need to keep trying to get it on quest.

C

There's a third state which is I unquiet, but something went wrong and any snapshots that you took while you were while you thought I was quest, are actually bad, like it's that third state that I worry, but.

B

They, sir state, how do you ok so right now we are running this unquestioned.

B

Anyone know that the snapshot is bad, I mean I'm, not okay. The.

C

Thing that handles the the signal it may have quest the application, but it may have also unquiet the application before you were done. Taking your snapshots if.

B

C

Had like a self-destruct timer on it or something you know like like, maybe.

B

Already st. Winder was trying to quiet it, so oh, it's already quest I, don't.

C

Know a quest can succeed, but then, if, if you take too long before you come back and say now, I want you to inquire allocation may have decided of its own accord to just unquiet itself. While you were still taking snapshots and you need to.

A

C

It did that when you, when you come back for the unquiet, it needs to be able to say yes, I am unquiet and by the way, I own quest before you ask me to so. All your snapshots are bad and you have to start over like that. Is.

F

C

But I think a rather important, possibly.

B

That's our chickie I'm, not she I, don't know how to.

D

So like in the original is.

B

D

Was really quite a stir? Cesano us were the explicit operations that were happening that was kind of genericized it so that it's pretty much any operation and I. Think what being called out here is that qui, a son quests, are actually special cases that we'll need to define, because otherwise.

C

I want to make sure that the errors that we communicate back are detailed enough. That first of all, the CEO knows whether it needs to retry or not, because that's something cubelet needs to know, but even if qibla doesn't need to retry it's possible, there was still an error that needs to get propagated to the next guy up, which is the snapshot controller so that he knows he needs to do something. It's so.

A

C

That comes back needs to be rich enough to cover those possibilities. Yeah.

A

B

A

B

A

B

Even know how to how you can so so, basically when you, when you start your quest, you found out he's already unquiet, then you teach teach I mean that's a problem, but how do you know that's a problem. I mean that's the thing. How do you even know? Even this I mean this is like the script right, so you have to.

F

E

And also, how do.

B

You know that's it, for how do you know? That's the first one right, the first time. How do you know you're wrong.

C

Here's the case that I worry about is that some applications might be unable or unwilling to quest for longer than some maximum amount of time and because of the way kubernetes works, kubernetes can't be relied on to unquiet you within the time window that you request, because cubelet can crash other things can crash. You know it's systemic or all kinds of bad things can happen, so the application may take it upon itself to to decide to inquire when it reaches its maximum quest time, for whatever reason.

A

C

Implications of that are that if someone is trying to take consistent snapshot and they're too slow, then they're gonna end up with an inconsistent snapshot and and absent any way to communicate the error back from the from the from the container up to the snapshot, or you won't know that you have an inconsistent snapshot. So so you have to have a way to sort of get that signal that says: hey I did unquiet. You don't need to keep bugging me.

C

You know the application is running again, but any snapshots you took in this time window are suspect and may not be consistent there for you. So.

B

But it yeah, but the thing is you probably you just inspecting right, you it's you can't say deterministically that you can and.

C

The here's, the key so secure days, has no centralized clock right. There's there's no way to know that my clock matches your clock, but the application knows that if it's still quiet at the moment, you call unquiet. You must have taken all of your snapshots before you call it unquiet, and so it knows at that instant that AHA I'm being told to unquiet and I'm still quest. Therefore, I can return success.

C

All the way back up and the guy at the top can get assurances that I didn't write any data while he was taking his snapshots and then you know that what you have is good, but but without that that last sort of final handshake, where you asked the application, are you still quest? Yes, ok, unquiet, and it says: okay, you don't know that the snapshots you took an intervening period are actually consistent. I.

D

Think this is a really good case and I think what would make sense here is to go back so we've genericized, this execution look second favorite channel or anything and I would go back and take the original design for the quiescent way ass. Make that a subset of this and make sure that it's implementable and then take these exact concerns for specifically the quests unquiet workflow, because.

C

D

Not a generic problem, but it has to be implementable with this generic solution. Yes,.

C

B

Nora's a yeah, so there was one okay. Let me actually talk about it, the the concerns from them. We can go back to this one. So.

A

B

A

You move on I want to clarify one thing over here.

A

First of all, the execution hook will expect to your operation to be item or nth. So even if your core inquires multiple times it shouldn't just fail and the coup, but it shouldn't just keep on retrying. That's a requirement. We need to post to application owners. That's the first thing, and the second thing is that I it is you doable to me cuz, because you can return a success. Even you call inquires twice it just. You need to populate the output of the inquires into the container notifier status and a larper level.

A

Application controllers should be capable of understand those returned streams. Instead of return rely solely on return code. That was my thought. I think it is the achievable we had this manner well.

D

If I have a generic application snapshot, it needs to be able to work with multiple applications in a common way and I. Think.

B

Yeah I think that one problem is that we are not going to provide scripts right, so you.

E

D

B

D

Should work yeah.

D

The other thing for the unquiet is: do we have a way to prevent multiple users from doing one class? We.

B

Don't know controller.

C

The controller did.

D

It class and the the DevOps guy went ahead and did an unquiet operation, because the databases is too hung up.

A

You you cannot prevent that yeah, but.

D

But that's something that we would want to Detective Lee. So, for example, like the you know been suggestion that if you ask, if you say unquiet and you're in you are on quiet, it tells you you were unquiet and maybe even a time step. I don't know, but that that's the kind of thing that's.

B

That it can be that you know the the error message. I think we never miss.

D

Right exactly, but we should define that in. Like you know, here's why us unquiet this is. This is like the use case, we're actually really concerned about, and how do we set this up so that we can use this, and we tell people you should write to this spec. You should return these other, but this is what you have to do in order to work with our next level, which is going to be kind of the generic snapshot of mm-hmm.

A

That's a good point, I fully agree and we do need an interface so that the controller can understand all these semantics all right.

B

Okay, so I I was thinking that maybe in this room, I.

F

Got a question before we move on so if there are more than one notified left, because it's an array and you can have sent them more than one notified, so is there a guarantee that this one will get that executed first or is there a way to specify the priority or the sequence of execution know.

B

That we can it's not going to be like that because of the kid it was Kubla. It's not going to understand your application. It's the application who is sending those requests needs to make sure that they are sent out in order, because so, when you are so you're not supposed to you so like the application, snatcher controller is not going to send an unwise comment before Quietus and also you should not be doing uncle SD for snapshots taken right. So this is under the application controllers.

B

Right, yeah cube little can decide that yeah yeah.

F

But if I want to do some actions before doing a quest like maybe you know.

B

Then you send another yeah, then if you have to do something before long I, actually maybe okay I think this might be useful, but I think I know the exam. I have example me about this example. There are some problems with this example. So if someone points out that works then, but this is this example, but it's just trying to say that when you're taking a snapshot, there could be multiple steps right.

B

So well you probably look out of this example already, so this is like so I'm using my C code database, but Mexico may not be the perfect example, but this is just to say: okay, there are a bunch of comments that you need to run before you cry us, then you need to say first you say log tables, and then you do flush this and then maybe maybe you need you to F is for it or maybe not so then you just need to do one after an others.

B

You have to run the log tables first and then you flush the disk, and then you say FS first right and those kind of thing you have to do like one after another. You can't like jump ahead that just won't work or you can some people. They say they just write everything. You know everything you need to run before. Take a snapshot in one big script, then that's possible too. You have your big script, handle everything the ordering and everything.

B

That's that's that's another way of doing it, but then you have to at least have a pre and post for those two has to be separate. Okay,.

A

The question is more about array of continent notifier yeah.

B

Yeah, but what what I'm trying to say is like some comments, you cannot combine them so I think he's. Oh I.

A

B

He added some comment saying that why don't we just have like one everything together, but then I think there are certain things you can't like, especially likewise on choirs. You can't combine them. It has to be.

A

Your question there's no guarantee right. You cannot guarantee that once you, because you don't know the order and how Cooper it will pick up all those modifications all.

F

Right, so if that's okay, so just one thing like you know, in which use case really have some advantage, when you have a array of notifies, because most of the time, if you want to do a compression, yeah, okay, your.

B

Application, snatcher controller will need to be waiting for that right. So, for example, if you have to do choirs first and then unquiet later than your application, snatcher controller need to be waiting for the quest results before it gives up.

G

B

So those type of thing you need you, it's location, controllers, responsibility, the.

G

Signal that is going to create the quiesce signal is going to the cubelet, or does that get passed through to the application itself? Also, so.

B

For example, if you let's say look at this one right, so this is a like a container it has. This script requires. This particular comment, of course, will be running against your application. You want to class, let's say, lock tables. Of course you have to lock into single database. You do this lock tables, but it is yeah, but it is the cubelet who is going to yeah yeah.

G

So what if the app does not recognize that signal that cube letters and passing through to it in.

B

G

Situation, yes,.

B

If that's the case, then that's basically it's it's a failure. Right can't really you can't rung it. It cannot run back comment and it says failure couldn't say see if that means, if it's like not found or something it's going to be a failure. When you run that comment, Cuba cannot run a command in. You should result in a failure and.

G

That invalidates the snapshot there.

B

So yeah so that then in that case, then you should not take the snapshot, but then I think that is something I don't know. If somebody has asked this one before you know previous discussions, I don't know if first this might be a good question for the like the backup vendors. Sometimes do people just do in like a best effort and then they would still go ahead and take the snapshot.

E

B

That why it's correct that's great so.

H

What happens is sometimes applications may not honor or participate in the question activity. If we cannot achieve the best-case effort, which is apt consistency, you fall back to file system, consistency or crash consistency, so.

A

H

At least there is a backup and those applications could sometime work with those crash transitions snapshot and recreate their data on state, and they are good at that. We believe, or at least choose to believe that so, instead of saying no snapshot or no backup, you can actually say you have a depreciated backup experience and give them the backup. Okay,.

B

But you do you need, but you still, you want to know that you want to market basically how you want to have a way today.

H

If we need to have a consistency level or something like that saying if this is not a bad consistent, this not five system consistent. This is scratch consistent. You put out two or three levels, so what we envision to achieve and say and flag them saying this is efficiency we could provide in this particular call because of these.

G

H

F

To come back so we cannot have a priority defined for the notifies. That is one.

A

F

If you need to have some operations to happen sequential ways you have to put different notifiers or families.

B

F

Cube letters to pick it up and do the sole okay.

B

F

And and the limitation is basically from the cubelet- tabular cannot understand the priority, so there is no possibility of having within the spec of CID right yeah.

C

B

Couldn't yeah but that's I mean then you ready you're scripted. Are you ready, awesome I think some people do that to do that? I, don't know if you said that's, preferably I would.

C

Think if you have ten different things, you need to do make one notification that calls a.

I

B

C

Does ten things rather than try to have ten different notifications, called in some sequence, yeah.

B

So some yeah I think this product depends on the application, because the awesome some people actually want prefer to do everything like just at least the the you know the pre pre-hook apart right. So the ever seen like one two three do everything together in one big script that handles it and then.

A

It depends on application, does having too many stuff in one script also poses a risk of unquiet process.

A

What do you have fails in the middle? It's a etc yeah.

B

A

Again, this is not the key of the whole concept, or the this thing should come from. Whoever owns the application are knows the best of the application yeah.

B

But I think we won't like to collect the feedback from Beca vendors. So you know we can put some recommendation when we write this. Oh yeah yeah.

A

Go back to Davis previous comments about defining a more or less standard returning message or code. It's pretty challenging actually because it really connects to a whole lot of common applications, and it has to make sense for most of them.

B

Yeah, so we could talk about that, but I mean yeah I, don't know if we can ever agree on any error code. I know that we couldn't agree on that when I was looking at the boarding house saying so this could also be challenging, but we could try and we could talk about it so so so I wanted. Okay, so should I talk about the so the feedback, so I think one of the. Let me go back to go to achieve this, and actually this is some notes from Tim.

B

So the biggest concern from signal is the ability to you know state because they want to be. They want this one to be like a bullet proof. So they, if you send a signal, then they want to know exactly it works or not, not just command-return succeed.

B

But when you do you quiet, they want to really know it is really quite or not so that's a big thing because they don't want to get into situations when something happens, and everybody says, oh something wrong with a note, but something wrong with a couplet, but maybe it's not so that so they want this one to be clarified. So then there are several different design alternatives, I think the first one. This is what we have currently the second one. Basically, is this design plus a probe?

B

So whenever you send a signal and then you also go probate and then make sure that the signal is not only delivered about also it you get the results that you want. It is really quiet, so that's they say we'll add the complexity, but I mean I. Think at least is something avenue to explore and then why's make quest first-class. Oh, this one I'm, not sure I, think anybody was uni difficult, number, two, because I think even for number three. Basically, even if you just make this choir sing a first-class saying, don't find other cases.

B

We still need to be able to tell whether it's really quiet or not so I think we still I think number two, the second one. We need to look at you first.

D

Some of those things like you know you talk about FS, freeze, yeah, one of the real problems I have with the FS freeze. Implementation is there's no way to tell what's Ferguson, okay,.

B

The fast system, yeah so I think that would be something that it's good to ask the back vendor. Who has already gone that what you know. What is the the best practice right? We just take from them, so yeah I think I'm thinking, so maybe I should I so I just quickly put in something this morning, like this number two, we can go through this one, because this is like the you know. This has the probe right.

B

So let's just look at this one, so this one is pretty much same as what we already have, but I kind of so for this container notifier I kind of divided this into two parts. So this well, it still has this name, but then it has an action and a probe, and then the action will be the same as what we have for the continuity for today. It has this comment. It has a timeout, but then then we also added a probe.

B

The probe will be basically going to say. Is it really in this condition? Does the status that you wanted to be so so basically, this is like.

B

Okay, so I think something here, okay, so basically, this is like when the application such a controller, since this requires to have this container notifier cube later we'll find this name and then okay defines this one. Has this let's say this is aqueous requires application.

B

It will first go look at this continually file action and then run that a command you acquiesce and then same time. It will be calling this command in container, if I probe to check the status so for, if it's like, if it's something like log tables I think you can actually probably check it and just try to write something I found it. So can you write it?

B

Maybe that's you know that that's one way of checking for at least this one and then this way cubelet has a relatively deterministic way to know whether it is down. But but, as you said, they've done, maybe sort of things. You can really tell right if it's a Eva's freezer, much the same hands well,.

D

I mean would when I looked at using FS trees, I was considering actually writing a demon there run in the in the host and and keep track of that. But it's not you know just a script anymore. Mm-Hmm.

F

Sing one question here like know: the tubular started to do the job and in between the whole court, reschedule to another turbulence. So are we seeing any challenges completing that operation I mean.

B

Operation, yeah, of course, the challenges. That's why I signal this against this rain, so I think this definitely will be very complicated. You will definitely you know if, especially if you have to send a lot of signals and then you know, container I mean acutely just needs you and all of them definitely I mean well will be challenging. Not saying this is. This is definitely so need to think, sir. So yeah I don't think that's the easy answer. Yeah just.

F

One thing like knowing that makes applications to be you know kind of stuck on that particulars know those turbulent due to some reason. You.

B

Always kind of infer something you are talking remotely, it's.

A

Not Henry Morley.

B

A

Time they say his.

B

Voice is far away like your voice is closer to the computer or something he's voice as I didn't gather it's an application. What I think and there's one part I didn't get.

F

Yeah, if it appeared no, yes,.

B

F

Yep, so I was just wondering like when the board got rescheduled in between when you billet was performing some operation. Will it cause the application to be stuck on that node or cubelet? For some reason, just one thing like something like that can pop up or not so.

B

So you're saying it's like something happens in the middle and where you are trying to run this thing and Emily yeah yeah, so definitely so so, if yeah so Q bleary star, those are the things that we also need to consider right. So when the restarts then it will, it is going to pick up so then that means some signal could be recent right. So that's that that's why we have this. We want. So that's why those has to be like I idempotent when you qui asked the first time.

B

Second time has to be ridin Poland right so, but you know definitely it could be, could be problem. You know for certain that also I think it depends on what application for some application your session is lost. Then it's just unfrozen automatically yeah. So that's that's then. In that case you party just need to have to detect that and then mark that as a like or that degradate a snatch or something like what we were just talking about a few minutes ago. Right so as.

A

A matter of fact, that's actually one of the major reasons. I shin had this problem here and it's a whole the whole imperative versus never a signal triggering versus lever to the Ring concept in kubernetes. It goes against the concept in kubernetes.

A

Kubernetes relies on the states to be eventually consistent. Where here is more like oh I sent you a signal, I don't care anymore and that's all.

B

But it was a pro but I'm kind of care. So if we have the drop.

A

Drop way better.

B

A

A little better just to fix that yeah.

B

A

And again, that's the piece I've at least also parts, for you feel that's the strongest push coming from signals, not to say the other. One is also. If you guys look at this API proposal, it's actually probably quite some change into couplet itself, as well as the Co API, the stability of this, and how how powerful this thing can be scares them a little bit because the end of day well, you can claim that.

A

Basically, people will start utilizing those notifiers to do weird things. That's one of the concerns with they don't list any like a specific noose case over here, but I kind of agree with them. This is very powerful. You can pretty much achieve anything yeah.

F

B

Yeah, so this is a does. Anyone have any concerns with the probe which it does it. That means it could take a little longer. It's going to do this probe that does anyone have concerns with this approach from I.

B

Don't know, I I, don't know if the backup and I want this thing to be really just quick does not really want to be keep waiting or something. But then, if we have this probe, then, but of course this one has a timeout, so we can set a timeout, so you you probe it only for certain that you know certain period of time. It's not like you keep probing forever. So maybe it's it's fine! It's it's not that different in front of matter.

B

We had before it's just but of course, the probe for some certain things. This may not be feasible. I yeah is also really relieved. I think differs the conclusion your it is optional. Yes, it is optional, but.

G

At least what does the probe return? A billion.

B

So the probably the same things, basically it's going to have this Rock'em and you will get a error code and message back. So if it's successful, then you just won't get wouldn't get anything right. So then you, depending on that one, but at least this one clearly tells you this is the probe. I. Think I think form signal point of view. At least in there is a way to to say that. Okay, we have tell you they have to implement as a probe.

B

If you don't want implemented- and that's I mean that's a different story right, it's at least this way this this way, and there is this one there you can somehow determine whether it is really. You have truly achieved the state that you want it to be so.

G

There are a number of ways that we could instantiate a probe. We could either just get a status, okay or not, okay, true or false, or we could issue with the probe a structure of potential options that could indicate the status of what is there and return just one of those will return a pointer into that strap.

G

What is the intent of the probe so.

B

The probe actually so I, basically just look at how the current, like Lebanese Pro doors, already some probes implemented in cube, lead already I just look at that, but what that is doing is actually it's the same. It's basically just to a it's basically wrong command, and then it comes back. So it's look like it's the same thing. It's just this probe is more. It has a purpose right, like the name suggests its probe checking so like they have this check-in that whether this container is healthy or not right.

B

Well, not that type of probe, but it's also just running some command and gets back a you know, standard or standard error tablet saying so the same thing you're getting. So it's going to be about status same as an action. It's just the difference is the action is really something that you wanted. Your class and probe it's going to check if you, if it's really quiet or not so.

E

D

Master was the same, namely is checking on the execution, though, unless you're saying that, for example,.

B

D

B

It's it's a checking to stay dry so basically.

D

Because the class operation may not actually, for example, have a running process. That's like I'm the quiet process, so.

B

Yeah, so what I'm saying so, let's say, for example, let's say if we want to do my sequel, octopus right so the action, what we say but on that comment, right, lock tables and then your probable will be trying to write something in the in a sequel database and see if you can see right to it. But if it's a larger than you're, not supposed to be able to write anything. Something like that is just.

D

So I think the probe almost if we start going down this probe route, I think that almost implies it, that the cancellation is something that structured as well. Doesn't it you.

B

Candidate, so the properties.

B

Well, I could prove it. Why can't I cancel it? No I, don't think that case is not there now there, but if you really want to do something that I mean I mean it's just that it's not going to be something that is absolutely anything there. Doctor.

D

Why's, the probe needs to be part of the structure here, rather than just saying, there's another command, that's defined for this execution hook. That said,.

B

D

Or not, something is running, but.

B

Where are you, where would you suggest writer? This is, of course, ordered.

D

B

D

But like canceling quiz right, we don't define this in terms of the execution order. We say that that would be part of Koya son class protocol.

B

So, no so what I'm trying to, because okay, so the the reason that I'm adding this one right here is because signal would want to be able to determine exactly whether the action is successful. Not then, how do you? How do you do that? You have to make sure that you run this one right after that, one together I mean otherwise you have to define somebody's out and you have to imagine them. How do you imagine them that way?.

D

I want to Graham soul.

B

To can so that's an autist that was I was trying to address I.

D

Want a pony too.

B

So I was trying to so that their biggest concern is. How do you know that you know if it's really successful, not right, because the BRABUS command wait? Hence, then you can't even like the US, so you're saying canceling. You may not be able to cancel.

D

B

At us, the base tells couplet okay, it is a. It is quest, that's it because they want to know whether it really has achieved the go or not, because it's um well so the problem is then, because they went yeah. It could that's what I explained, but they are saying, then you can't just depend on the whatever is this is like application give up developer.

B

Whoever writes this type of a script right you can, if you tell them exactly say you have to do this this and they may not do it, so they don't feel certain yeah. So it really depends on how you write your this. This part right this script right how you write the this one, but then some if some people they didn't, do the right and then they return success. But it's probably not really successful. I think that's their concern, but so.

D

B

D

If their command is.

B

D

Broken what makes them think the probe will be implemented.

B

Yes sure I think I, yeah I, don't know how to this is just a this is come up. You look.

D

In the middle yeah.

B

We I I think I, basically think the first one should do it. If you just you know, make sure that your script is written correctly, whether it's successful now, you should be able to do that right, but probably especially so this way you clearly cause out. Okay, you have to go check the state, so I think this one. They can say. Okay, you. There is a way here too, to verify that and then Cupid can depend on the second one to to say: okay, yeah I'm gone, no I'm truly done exactly.

D

Being implemented by somebody, we trust they can't depend on it so like, for example, if cubelet is able to so, for example, if if the probe is really is your process, don't running that's something that we can do from the cubelet side right, we can say: okay, we executed this for the execution or we got kid X, and now we can check and see if pit X is still running or it's the tongue or something so that's something we can do without relying on, but.

B

Nobody can but cube. Rican will know exactly what you check. That's a problem right. You are.

D

You'd have to define it as like.

B

D

Running because otherwise I mean.

B

Well, I'll be checking the process. Run is not enough. You actually I.

D

Agreed but but what we're saying right now is we don't trust the implementer to do the right thing with the action itself, but we trust that if we check the probe it'll always be correct. It's like those those are two contradictory thoughts. I think.

B

This is a this is a way for cubelet or the sync know that you say: okay, we have to rely on your. You know, Shastri's check if you even another.

E

Day, let's browse check.

B

Then but they're already saying we're not.

D

Going to record.

B

But it's different right, so I think the difference is this one didn't clearly cause up. If you just look at name, you can't it's not like self explanatory like this. Why you look at it? Okay probe is very clear right, I'm checking the house or something some pro probe, meaning were checking something akshay, minnie-rella action. You can just you know you go away here on. You know your action I think that's their.

B

They are concerned, yeah I, don't even know you don't care, address the concern but or not, but then that that's that's what what is called out last time. It is to have a probe right, so the state probes, that's that's the cert. This option that we want yeah, really.

A

What I want try.

B

To address those concerns by.

A

You guys, you guys see why they are concerned about this right. The they're concerned about having a very generic execution look into the container definition. We Oh Breen seeking loads maintenance burden, basically you're right David. Basically, what they said is that yeah you can execute arbitrary commands against the container we at this notification and notifier and the end of the day.

A

We are the people who will bear all the burden and look into the problems and fix any problem or prove that the province knots on cupric side is actually for application side, you're right and that's exactly one of the concerns and I kind of view them. If there's something timeout or there's a networking issue, I, don't know right the things that okay prove me. That's not Cooper's problem. First, before I look into that's not my problem.

D

It's a question: I, don't think we I hate to suggest is, but maybe maybe execution hook is a generic thing isn't doable at this point, and maybe we should fall back to like doing the actual quest which can be structured where you say yes, you need to do this. Yes, you need to do that. Yes, you need to return these error codes.

A

Well, I agree with you as.

F

A

That again, I think one thing she didn't mention too much over here is why we're taking this a prior API approach? They are, they are use cases as well, which also can utilize this mechanism to signal parts accessories such as so that to achieve our the functionality, other functionality is other than quiescent and quiesce. That's.

D

Why I went you, but they're not really signals right signals are defined things you stand receive and there's a way to to manage these right, and this is run a script. That's where it started from is run a script, and now it's like. Well, we want to be more structured, but we also want to be completely unstructured and the two ideas are really colliding with each other and I. Don't think you can do both.

A

You can't also you cannot achieve this weirdness the other way as well. You can you.

D

Specific mechanism is built on top of it, like you can have a signal or quiesce. You know that's defined. It has a certain protocol between the hooks that it executes, and you know they have some stereotypical responses and stuff. But if you're going to have your kind of generic thing, I mean you're almost getting into like designing the process. Api from from Unix right.

A

Yeah that the problem is that that will require all the adapters or the application owners to to implement that.

D

Well, we're gonna.

I

D

Because if they don't so we're using we're using the class, we're saying this is gonna, be a building block for like the application snapshot or a generic object snapshot, and that can't be generic unless it can rely on an API. That's the same. Otherwise, you're gonna have three million plug-ins for it, which is just backwards right.

A

But back to what? What are you mentioning before? How do you define this? If it's just the FS phrase right, it's uh it's gonna be yeah. We need to think more on this, but but I we would be. They are alternate was out there. We should be considering I, know, I, think she'd already can't see them a lot of them already and also.

B

I think freeze not anything right, the run. Oh no. The databases has other comment, so even those I think they're behave differently right. So, like my sequel and wait, we need to do the quest and they behave totally differently. Yeah.

D

And even like the the expectation of doing a queer, some some Questers, don't necessarily you know, stop service mm-hmm right, you may be able to say yeah I can qui su and continue to accept transactions, but I'll leave the storage alone, and you know I'll just write into my logs, which you don't snapshot.

A

Running all over time, I think we do need some follow-up actions over here cuz this thing had it is so important to this wooden group. First of all, and and I do see a lot of people wants it and it's it I think one thing I would like to encourage. Everyone is to really share your ideas and a use cases we either will or working group email, threads or weirdest document comments on this right. We need a lot of supports for you guys to move this agenda forward right.

A

This has been there for how many homicides, in maybe year and half yeah,.

A

And still, we don't have a worry, finalized idea yet well the root causes, of course this is itself, is a very complex problem to solve, and the second is really that we, we are lacking of use cases to support some of the points.

A

Any any comments would be a highly appreciate, yeah.

B

A

B

F

One one go yeah one question for my side, so do signals see any use case with this up with this execution, who called the container notifier, or is it just that the push happening from sea store aside? Just for maybe you know, depreciates.

B

Front but the proposal for this one pushes from signals, but then there are some concerns for our previous design right. So there are like many many many.

F

Rides right right right, but but but do they have any use case, is defined from their end. Use.

B

Cases I mean you, can you can look at it? I mean, like you listed a few here. You can actually go. Look at this issue. That's the that's for those other use cases. If you, you can go click and go look at this issue that team opened a long time ago. So he would like this. Won't you send a signal, but this is something that we can. We can still we can still discuss, because one of the options here is: do we just make a acquiesce? This is first class same paths right.

B

So that's another nother thing we can also. You know this is another thing that we can about it, but then even foot I mean, but even for this one I just don't see. This want to be very simple because we have like multiple before need. You still need you need. You have like multiple notify or is forgiven for this one. I just don't see how one is enough, so, okay, so I think we are running out of time.

B

Okay, we have anything else. Yeah.

A

No I need to drop what why not you have another meeting, so thank so again, as I said, any a common, so use case is highly appreciated. Please comment either on this talk or sent winner or email list. If you would like to participate into this discussions, please let me know she, no all right. Thanks.

B

A