Kubernetes Network Gateway API Special Interest Group, 17 Jul 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: SIG Network Gateway API meeting for 20230717

Description

SIG Network Gateway API meeting for 20230717

A

A

Welcome to the Gateway API meeting for July 17th. My time is just flying by uh let's get right into the agenda today. uh We've got a few things to go through I. Think yes, we'll be fairly light, but before I forget I'll, just uh add the note that this is a cncf kubernetes community meeting. uh So we abide by the same code of conduct as the rest of the community in general. That just means to be nice to each other. We do want to be as welcoming as possible. That means a few things.

A

That means this agenda is something like that. Anyone can add things to. So please don't hesitate at any point to add something to the agenda. We also encourage people to drop feedback in chat or ideas they might want to discuss uh or reuse the raise hand feature in Zoom, so we can make sure we get to everyone that way as well, uh but with all that out of the way uh we've got just a few things to go through today uh and yeah: don't hesitate to add your own items as well.

A

Now, I think this agenda is basically exclusively uh filled out by me today, but uh yeah. Any other ideas are very welcome. uh So, first off an update on the 080 milestone, uh we are basically clearing it out. It is nearly cleared out. uh There's one thing that uh in the last meeting you may remember, Shane had volunteered to take on this tiny little PR to clarify a Gateway class support requirements. uh This is not a release.

A

Blocker I think he'll probably still get to it, but if, if he doesn't not a big deal, it's not going to prevent us from releasing uh this uh version clarifications. One uh Spencer has already made a good uh PR. That's got emerged for this, but there's some additional work, but again not a release. Blocker we've made progress. You know whatever and.

B

The others are docs.

A

So that means that we are ready to start API review for 080.. uh At any point, the downside is that we are not. We don't. You know we're not in a bubble and other people have schedules and calendars and things too, and as luck would have it the earliest. We can actually start API review due to some people being out of office is next week, so we're ready, but we can't actually do anything so yay.

A

That does mean we do have a little bit more time to try and squeeze things through if there's anything that just barely missed, uh we can definitely try to uh you, know, evaluate and see if we can squeeze it in, but that's just an update on the 080 timeline. We are still moving forward with it. I think we've got everything in place, we're just waiting for viewers to have time in office where we can start that our review process um yeah next up is this timeout formatting thing uh you know this.

A

This Gap got so close and uh time at formatting just ended up being the most ridiculously complicated thing to get right. I think we are close to uh I. Haven't read Tim's latest comments, yet so uh we'll see, but I think we're fairly close to consensus here.

A

I were basically in the final stages of what I would call uh you know, agreement or nailing down the the final format here. Other comments from other people are very welcome. I really appreciate uh there have you know: Flynn had some great contents.

C

A

Above uh yes, don't don't hesitate to jump in here uh and and add your own perspective on this, since it will affect many things in kubernetes. I expect anything that uses duration going forward will end up using something that looks like whatever format we Define here and so yeah. uh Hopefully we get it right, but if you see something here that looks funny uh to do add a comment. Sooner than later.

A

uh The one thing that I would call out is the very very key exception that we're not allowing compound values, so something like one minute 30 seconds would have to be expressed as 90 seconds. um You know I. If that's something that bothers, you add a comment uh whatever again we're just trying to do a as simple a possible subset of the basically going duration formatting, so that it can be easily parsed by other languages as well uh and Flynn actually added a very useful comment that pointed to work ongoing for.

C

A

And python, apparently to support that format as well. So at least there's you know it is not just limited to going at this point, uh and especially the the tiny subset of that format that we're talking about discussing would be easy to support in in other languages as well. I would think.

B

A

Yeah, that's that's a mouthful, but that is what we're doing on timeouts. um I think there's an end of this tunnel in sight, uh but sorry because I know this. This Gap had gotten so close, uh and then we got sidetracked on this tangent, but uh hopefully it'll be worthwhile in the end.

A

um Yeah I don't know. If anyone uh working on that Gap is I, don't see anyone on this on that cap in this call so I'll leave it there. Okay, uh next one uh just uh I, think many many many people on this call are working on implementations that are running conformance tests. uh Kind of the next thing that we want to encourage here is to actually submit your results.

A

uh You know we're working towards a point where we can actually display results in a central place, but first we need to understand what those results are, uh and this is just really helpful for us understanding uh which implementations are supporting features uh and how we're progressing towards that kind of end goal of having a lot of conformant implementations of this API. You know our the.

C

A

Of implementations keeps on growing, but we really want to also encourage that progress towards conformance as well. uh So thanks to Matia for filing this PR, uh this is uh really the first one of what we hope will be many to submit a report showing, in this case, Kong's conformance with Gateway API.

A

um Hopefully there will be many more around the corner at this point. We're still kind of uh you know, testing out a few things or maybe some changes as we go to the the format of this report, but don't let that that prevent you from going ahead and running this uh and getting your own feedback, the more the more reports we can get, the more we can test this out to the better. The long-term result will be so yeah any any comments or questions.

A

Anyone uh think they'll be able to get a report out in the next month or something like that to with with their own implementation,.

C

And what's actually involved in the report here? Is it just the URL for the project.

A

Yeah, so uh so, there's a so there's uh two ways to run conformance tests now, and this is a it is basically the same thing as just a slightly different entry point, but it's almost all the same logic of running conformance test, with the difference being that it will spit out a report like this for you uh so yeah. Oh I should find some metadata like this, and then it fills out the rest of the report based on the test results um and that's yeah.

A

That's all there is and cool it's like Contour will start having conformance tests soon, um yeah, so yeah keep an eye on this. uh You know the the biggest thing that would be helpful sooner than later. I would be just to run this sometime soon. Just you don't even need to submit anything, but if you see problems in our reporting mechanism and how this works, I would love to call that out sooner than later, because we do want this to be a part of 080.

A

So you can, you know, clearly tie your conformance results to release 080..

A

So as long as all of this mechanism works well, we can worry about actually getting the conformance reports in a little bit after, but just if you can confirm that this is working with your implementation reasonably well. That'll help.

B

A

uh Yeah there's a good question. uh My understanding and uh unfortunately, Matia and Shane are not at on this call. But my understanding is that we're trying to uh have reports and there's an API version of the conformance report here and my understanding is the goal is to uh use um it is to report that I was conformed. My my implementation at v1.8 was conformed with Gateway API at v0.8, but basically that convert uh that combination of implementation version with API version.

A

So, yes, I, do think we want to link those together as closely as we can and actually have them show in the report. So you can see the implementation version is 2.10 right now the API version well actually not here, but there's another API version somewhere else in this report uh that would have room for 0.8. In that case, we this code didn't exist in 7.0.7.1, which is our previous release, so we're kind of just testing unreleased code, which is not great, but we need to do that just so.

A

We can get to a point with the 0.8 release where everyone can publish their conformance as a release relates to the 0.8 release.

B

A

Question all right, uh any other questions on that or I can move on.

A

All right I'll keep on going uh next one: oh yeah, API tokens. Thank you for uh I. I know I I chatted with you a little bit earlier: uh Igor uh yeah, uh whatever you thinking.

B

uh Yeah hi everyone so yeah. It's really maybe a new big question. I, don't know, but yeah ID is basically we have a application surrounding in kubernetes and uh some of them provided public API. So some other folks can connect to it and do stuff like well. Technically, we are working on a search engine to protein structures, but yeah I can think about any applications that provide public apis.

B

An idea would be to have an ability, declaratively say: okay, uh I wanna, this API to be not ddosed, and so, for instance, it can should be able to provide uh somewhat uh rate limit for requests, and um maybe some also white lists for so I know this kind of a good client.

B

The way my API so I want to give him like full access and by default it should be, let's say, a thousand requests per second, or something like that. So this is very like.

C

B

uh Overview and uh I I recall we shortly talked about it and there is a uh Community interest and having such a feature and uh I was thinking if we start to implement that uh I did some investigations that should be possible to do that with nginx and some zones and uh like Dynamic configurations but yeah.

B

Since we are going to do that anyway, I thought, maybe it would be a good contribution if we do it in a proper way and make it like a feature of a Gateway, API, um yeah I, hope I, make sense.

A

Yeah, no, that's awesome. We we always love to see new ideas come forward, and certainly if the decision is between you know, implementation specific and something like that could be portable I would love to see a way to make it portable I'm trying to understand the the specific use case here. I I heard something about rate, limiting, obviously tokens. So you know I'm thinking about jot or something like.

D

A

uh What, though, those seem slightly separate to me, uh what maybe you can explain a little bit more, what you're, what you're trying to accomplish a specific use cases.

B

um Yeah see I have um like three categories of uh customers, clients to my apis, so the first one would be our internal applications. We should have like as much access as possible and then somewhat friendly clients to which we want to provide like more access uh than to the last one would be like default ones with some uh really Limited access. So this probably describes like really high level ideas and thing.

A

Okay, that so it's kind of like a conditional rate limiting then you know, depending on the source, is it would that be like source of cider or is that where the tokens come in like depending on the category of token, you know the identity of the requester?

A

uh Is that do you have I I, guess I, don't know how you would categorize those those different things or how you would identify um the source.

B

Of that traffic yeah, but you totally go to boy and souls I used to have like some categories and based on that uh provided, let's say, rate access to the apis.

A

I've been talking a lot, I, don't know uh anyone else on. This call have have similar use cases or requirements from customers or or others.

D

uh I know the uh over Gateway folks have done some work about uh right in the meeting already.

D

um So, if we're talking about sort of rate limiting based on tokens, then uh yeah I think that that's probably uh someone to talk to I do think that um right, limiting right, limiting using like tokens in the request, it seems reasonable, um but probably will need to form part of a larger discussion on right. The winning foreign.

A

Yeah, that's a that's a good one! I don't see any of the envoy Gateway people on this call. Hopefully I'm not missing them, but uh they seem like the the most. uh The people have gone the farthest in this specific area with Gateway API, because they they both have rate limiting uh and they have uh you know jaw uh authentication, which I think is at least slightly tangential to what you're talking about here.

A

um But I would yeah I think that's a a good place to go next. Maybe it might. You might get a few more eyes if you kind of describe this use case uh in a discussion. I think that's where we're recommending people start, but if you create a GitHub discussion and just kind of describe this specific use case, that may be the next thing. We're missing some people on the call that I think might have some some ideas here.

A

um It is summer, so lots of people in and out um yeah, but but I I'd agree with what Nick's saying here. This conceptually seems like it could fit an API.

A

um The first thing we do would be to get uh high level interest. So that's you know meeting is a great first step. Next, maybe just write it down in a GitHub discussion and see if that gets any more people interested, uh and then you know if there's interest the next thing we do from there is. We try to start a gap process.

A

It looks like there's some uh interesting comments in chat here sounds like a combination of multiple features, one identifying a user based on authentication or something else, and then rate limiting based on that is that is that a correct assessment before we go further uh Igor.

B

I think so yeah I would say so. Basically, we need to identify the client one way or another and then just see which category to the bowls and dependent on that provides great limits. So that would be like short description of what we are trying to achieve.

A

Okay, yeah, that makes sense so so then I think the follow-up question for Michael in chat is is very good and that's. We've talked in isolation about uh different versions of this, so about rate limiting and about uh jaw Authentication.

A

uh If we combine, you know this feels like this. This seems to suggests that uh as much as we've talked about them in isolation, we may need to say that they need to be compatible with each other uh to to Really achieve what you're looking for here, but maybe you're talking about other ways of identifying uh requests. So I'm not sure. If authentication was what you had in mind, or if you had something else, I.

B

Will think it involves some very simple things so that we just issued token and then clients inject those into the request. And basically we.

A

Don't know anything.

B

About the required to customer, because there are some policies in our field, which is open science, so we don't gather any information advice, but we do want to foreign.

B

People to use our apis and we know them, you know so.

A

Yeah so, in your specific case, you're talking about a uh setting this via header like a token via header in requests and then matching that header and adjusting rate limit based on that for, for example, but yeah totally. Okay. So, as on that case, that that could be, you know, I don't want to go too far down the implementation, but that could just be a route rule that has a header match and then a rate limit for that.

A

For that route rule uh maybe easier than trying to bundle in authentication and the rest, um I, don't know, uh yeah I think I think to go back uh to to what I think others had said earlier as well. Maybe a discussion is, is the next? The next thing, but I would just kind of you know highlight that the scope that you're you're looking for because I think at least myself I I got you know stuck down the rabbit hole of authentication and a larger a bit of work to identify.

A

Whereas what you're talking about it for identification, maybe is just a form of you, know, route matching and doesn't need much um so yeah, just as clearly as you can find it in uh and I just got a new GitHub discussion. uh That'll help.

D

Okay, thank you, yeah and I. Think if the.

C

D

If you, if you do sort of it, is probably important for us, it will be a question that we'll need to answer about sort of. um It does have implications about sort of how.

D

If these are implemented using filters, then um we will need to sort of answer questions about how composable filters need to be, and you know if the results of a filter should be available to next filter in a chain and stuff like that, um which is I. Think is one of the um sort of implications from mikhail's question which again, thanks for Kyle.

A

Yeah, that's a really key point: I expect that uh it's going to come up more and more as we have more and more uh filters and policies uh entering API, okay, well, I, think that brings us to triage. Then we are making good time. We may actually end early, uh but uh I don't have anything specific for either.

A

One of these I just wanted to highlight that there are two pretty big sizeable at least two I may have missed some I I know: I've missed some, so sorry for the ones I missed, uh but the ones that are at least in my head right now uh are session, persistence uh and TLS, uh both uh pretty huge gaps. uh I think we've got. You know continued comments and feedback going on on both of these.

A

So I, don't you know we don't need to go into great depth in this, but uh just uh giving this as an opportunity. Grant is there anything you wanted to highlight or ask for on this to help keep it moving forward.

E

uh No I'm getting a lot of good feedback. I haven't had a chance to respond just yet, um but I'm working on my responses now. Custom provided uh some really good opinionated um comments here on how it should handle cookies. I find that I basically I mentioned we shouldn't.

E

We shouldn't allow the API to specify kuki attributes which is kind of a big, a big uh shocker for me, but I'm working through his his position. If other people are interested, um it's it's. It's a good thread to hop on uh and and check it out.

E

um The other thing I'm going to work on is uh I. Think I need to write down some use cases I think we're kind of hop around a couple points of of you know different use cases in the comments, so I feel like I'm, going to take a second and write down some use cases. So if you have any tips, feel free to, let me know otherwise, uh I'll be responding to the comments here. Hopefully this week.

A

Cool now that that's uh thanks for calling that out, I missed uh costen's comments as well. I know I'm overdue, for reviewing this. uh It sounded like uh I. Think I may have misunderstood that. That last comment you made. uh Are you a little underwater just in terms of the quantity of comments here like? Are there so many comments that, if I add more or someone else, adds more that it's just too much or you maybe I misunderstood what you're saying there.

E

No I I'm, not under water with the quantity, uh it's more of a quality uh thing. If that even makes sense, it's I think um I'm digging in deep to some of the comments that Customs making in um I think I I just gotta understand what he's saying um sort of sort of deeply in all the intricacies of of this is suggestion, so yeah no feel free to keep keep commenting. I won't be upset.

A

E

A

Know: okay, thanks um yeah I I am sorry. I have uh not had time to get get to this one yet, but it is on my list any any other comments or thoughts on this one before we move on cool all right uh last, one that I have on the list is TLS. uh Last but not least, that's for sure uh this is a big one. I chatted a little bit with Candace about this one before uh I think Candace.

A

If I understand correctly you, there are a few comments that maybe could use a little bit of clarification still.

A

um Is there is anything worth discussing in this meeting on this one uh or you rather just keep the conversation on the pr.

C

Ank it if, if Nick, was able to take a a quick look at this um I, think I got some feedback from you Rob um and a little feedback from Shane, um but but um not sure that Nick has had a chance to to look at it. I don't know if you have time Nick to look at it, but it's.

D

Definitely on my list uh but yeah like it's: it's literally uh like 8 30 a.m. On my first day of back after Forex location, so yeah.

C

D

So yeah it's definitely on my list, um but yeah I'm, not 100 sure when I'll get to it.

C

And um I guess: I have to say that you know uh last week adding in some additional requests for mtls to be discussed within this PR um and I.

C

Just really don't know what what people want to talk about regarding mtls and this PR, um mostly I got comments like um what about mtls um like what about it, but um I, don't know you know what what people really want to talk about in terms of mtls in this in in this Gap, um especially since at the beginning, I mentioned that it was autoscope for The Gap. But within the comments it looks like people are sort of moving towards well, this can't go out of provisional status.

C

If we don't talk about mtls but still I, don't know what do people want to talk about in terms of mtls for this? um So it's difficult for me to actually make any progress with that.

A

Yeah, no, that's that's entirely fair, I I think that, uh at least from my perspective, what What's, Happening Here is there's this uh fear. You know these. These concepts are very similar, the TLs from Gateway to back end uh right now, we're just talking about uh really the this you know serve validation of that the server is providing to the Gateway the client in that case. uh Well, the Gateway is about the client Gateway as a client is validating the search uh provided by the server or backend, um and that's a that's, a really tiny.

A

uh You know bit of configuration, but I think uh what at least the comments I'm reading are are just trying to at least understand how and how and where this fits into the bigger picture. But I I agree with what you're saying that that this has been called out. You know mtls is out of scope, uh but I I think. Maybe what we need here is just some kind of answer of you know it.

A

We, this Gap, is not intending to solve that specific problem, but we at least have like how this could potentially interact with an MTS mtls solution in the future. That's I think about the the extent of of where we need to go, not not a not a solution, but just a there's, a path where this could interpret this could interact and work well with mtls config in the future.

A

um That's I think what what people are asking for, but I agree that we don't want to try and solve mtls in this. uh We just need to have have enough uh confidence that it can interoperate and we're not going down a path that is going to be incompatible long term with or just annoying long term, with mtls config.

A

um I, don't know, does that make sense, or does that line up with what you've been seeing or thinking.

C

um So I think someone also asked if you're not going to include mtls. You have to say why and I just felt, like I had already said that it was autoscope for this, and you know, based on the ways that we've we've tried to approach this in the past and mtls getting in in the way.

A

Yeah and I I think I think that I think you've really answered it well there. Just by saying that uh mtls is something that is uh room can be complicated and we've already found this Gap very complicated to you know we we have tried and failed on multiple previous occasions, starting with my initial failed attempt. Years ago now, uh and uh and so yes, I I'm very familiar with the plane involved in in moving this forward and and I think the the answer to that question is kind of what you alluded to.

A

We need to start with the smallest possible scope that we can think is you know independently useful and that's why other things are out of scope, um I think that may already be stated in the in the Gap, but if it isn't I think that's that's the answer um and I think that is useful to record, because I I do understand why someone reading the Gap in the future may say well. Why did you start with such a small? You know Target when TLS is much broader well, this is.

E

A

D

Yeah noise I'm definitely going to have a look at.

A

Some of those comments.

D

As well Candace and uh try and help uh resolve them too, if there's any qualifications required.

C

D

C

D

Feel free to ping me.

C

D

Specific things uh that you really want me to look at as soon as possible and I'll bump them up to the top of the hoop.

C

A

Cool I think that may be. It then uh believe it or not we're gonna get some time back today. uh Give it just a few seconds. If anyone has any anything else, they want to bring up today, otherwise, uh have some time back.

A

C

Right, well thanks. Everyone.

A

uh We will talk to you all in a week or so until then have a great one see.