Kubernetes SIG Network, 14 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Network Policy API Bi-Weekly Meeting for 20201214

Description

Network Policy API Bi-Weekly Meeting for 20201214

A

Okay, so this is sig network network policy. Sub project meeting today is december. 14Th 2020.

A

I kindly remember all of you that this is a an official meeting, so the code of conduct is is running here. Please be nice with each other and let's get started, so I will share my screen.

A

Don't know if someone put something in the agenda.

A

Okay, so you can see the agenda right. Yes, okay, great! I have like a lot of monitors and forget all so do we have any newcomer today.

A

Someone that's new, no okay, hey! What's up jay.

B

No new people today.

A

I don't think so, okay. So the next item that I that I put in the agendas about the europe friendly meeting decided, I think that that andrea was taught to us in slack.

C

But yeah it looks like mondays from 6 to 6 30 a.m. Pst. So I'm just gonna um do what you said, use the same link and we can just uh schedule that put it into the agenda doc. It should be all good.

A

Great, so I I can I can. I can probably help you andrew, because this time is it's uh 11 a.m.

B

Here in brazil,.

A

So I I have, I have also voted, so I can like help you when this is running, so I I I might help you with this. We just need to to ask for casey davenport to add this in sig network meeting agenda, so this is an ai, probably for me or if anyone else wants to pin.

A

Okay, thank you for for making this possible andrew.

D

No, no problem.

A

Great, so the next. The next item from the agenda is the proposals review. So I've put port rings as the first one, because the proposal got.

A

Got accepted by sig network folks, I think two weeks ago, so I have started to implement this uh andrea, seek him and and then winship they. They have put some some some changes there, some reviews, so I I have started to do this this friday night. I think- and I know that that andrew is here so I just I just need some some more reviews from him like if the rest implementation is right.

A

If so, I can move forward with the unit tests and also because we put this as an ai for the pr and three category redhead all of them. They are aware of the changes, so so thomas graf answered me in in slack saying that saying that they are following this: one abhishek is taking care by the andreas side calico, I I've told casey in in chemical slack, and they they they said me that they are also following, so only calico.

A

I have proposed myself to help them implement this in calico site, because I know a little bit about chemical code, because this is what we we use and red hat folks. They are aware by by then winship and and antonio also, so I think that we are good to go here. I have like a to do about documentation and unit tests, but that's it and also wait for more reviews about that. So.

B

A

Range is going to ship in 121 as an alpha and, and we are going to have this implemented by the cni's, also okay, so the next one is the namespace by name jay. Do you wanna tell us about? How is this going in the in the cap review.

B

um Let me see, I didn't check it today. Let me see, I I think I mean there's nothing left to do. We've got a pr up, but we're just kind of spinning around on some stuff. That's just getting someone to finally lgtm it. Let me see.

E

I think jordan had a comment today and uh andrew's. uh One comment is outstanding. uh I didn't I didn't resolve that because I wasn't quite sure which is the right place, but I believe he's already answered that. So maybe I don't know it depends whether you or I one of us will get to it today.

B

Yeah, the pr the cap.

E

Oh I'm talking about the game, yeah.

B

Yeah, the pr yeah I'm talking about the you know, I'm just I've got a low bar over here man. Okay, look at the kemp merged, let me see hold on, but yeah the I mean me and abhishek abhishek. I updated the thing last night. The um the thing andrew mentioned about uh changing the constant like using that constant and that so I got that done yesterday.

B

Liggett has not lgtm'd it, but he did say he was okay. Lgt I mean it. So we just need to. I guess is he does? Does anybody know if he's maybe on like he might be out or something I don't know or he's just probably busy so yeah we're just we just I'll just ping him again tomorrow or something.

A

Yeah I I am, I have just one question, because I think that you are, you are going directly to stable into ga right j in the pr it's not going to to go through future gates and from alpha to beta. I think that that jordan and and tim hawkins, they they decided about going directly to each other.

B

Right, yeah, yep.

A

B

They hugged it out, so it's where we're set we're they're, just like we're just going to go ga. So I was like thank god, because I didn't see the point of a feature gate I mean I see the theoretical point and I see that there's a million arguments around it, but I don't see from my selfish perspective. I see no value in it. You know which is getting the future.

A

In so I I think that would be like just fine to probably change this. I don't know if this is still provisional, or this is like implementable here, like in the cat. I don't know how they are following this one just just well.

B

I've been super conservative and I added a huge block of you know unresolved, so that we could merge it and then iterate, because I I feel like any one of these comments is a time bomb waiting to go off of another four weeks of people going back and forth and without actually adding value. So because I mean I think, ultimately, what needs to happen is we just need to make a single pr to debate whatever the last one or two things? Are you know what I mean?

B

um That's like what I was thinking like I mean I just feel like you know. Otherwise this thing is just gonna get dragged down and it's gonna be lumped in with all the other unmerged cups, and I that's my biggest fear right.

B

So um I agree with you that, ideally we would just do it as implementable and theoretically we're at that point, but because there's been no feedback in a week and the last thing we heard was I'd like to move forward with it as provisional that you know so he could so he could hammer out the details in a follow-on. I just want to do that. That's what I'm thinking!

B

Okay, okay! I mean you know so, but there is no problem for me at all. Yeah yeah. I mean I'm open to not doing that. But that's that's my thinking. You know what I mean.

B

Okay, but yeah, bring it up again next week if we're there, if we're next week and we still haven't, got any feedback. Maybe we'll just do that. You.

A

Know: okay, okay, yeah! This is something that that I also wanted to ask for for you folks, if we want to like take some some time between next week and and the new year or if you want to keep following with the meetings in the next two weeks- but I am I will be in here, so we can discuss this later, yeah so clusters, corporate policies, abstract, has added added some some notes here, but do you wanna? Do you wanna speak about that.

E

uh Yes, so last week uh we, you know kind of like put the the api types on paper, or rather in the google doc and like a sample yamu and uh what each field would mean and what we decided that we'll uh you know, try to explain this and bring it bring it up to uh this community meeting on december 21.

E

So we wanted to check whether everyone's available on that like there is no there's, no one who is taking a holiday as such on that day, so that we can, you know, get a wider audience and get a broader feedback. uh We are working on a slide deck. We've shared. You know everyone's going to be adding some content to it and we plan to uh we plan to use our slide deck to propose or bring forward the proposal next week. So is everyone?

E

Okay or you know, is anyone on pto vacation plan for next uh next monday meeting.

F

Yeah, I think, if there's not enough um participants next week, then I think we should think about postponing it to uh the first week of january.

E

Oh looks like one of our authors is going to be our test. I just got a message from gobind that he's yeah.

F

Yeah, I think that a bunch of us are going to be out of shape. So that's the reason I.

E

F

E

F

Gobind about it, uh and we thought that maybe it may be better, uh but I'm I'm gonna be available either way on 21st, even though I'm taking the week off I'll still be. If there is a meeting I'll happy to attend.

G

Yeah- and uh we don't have to block on my my account honestly like if everybody's here and you know we can make the first pass, I'm happy to just sit this one out. um We can just discuss that another time, so no need to block on me.

B

Yeah I'd agree with that. I mean I feel like we're, probably going to have 10 meetings about it anyways. What are we going to miss? What are we going to miss right.

F

No, I think what we're trying to say is: there's going to be enough of a quorum on 21st for us to have the meeting yeah I mean I know we're going to it's not going to result in like one meeting, but do we want to start off by, like you know, otherwise, every subsequent meetings are going to be just a rehash of what happened exactly.

E

So so, if everyone on this call uh plans to attend next week, maybe we can uh sorry go with, but if, uh if the, if we, if we think that jan first week or whenever the first time we meet in january- is that that's the better? You know that that's a better slot for a quorum. uh Maybe we can do it, then so, but either way. I think we will at least ensure that we have a presentation by next monday, because I think we plan to review it internally on this thursday.

B

I'm okay either way. My vote is still just keep moving forward with it either way. But it's up to you all right. Let.

F

Me ask you, ricardo, are you gonna be around next week, yeah, okay, so you're gonna be around jay right, so I'll be there. So.

E

F

Going to be around.

B

Yeah we'd like to have andrew, if possible, I.

A

I think that andrew oh go ahead, andrew, uh which day.

E

The next monday, this this meeting.

C

Yeah I'll be here, that's.

F

Okay, so I guess, then we have consensus and we can. We can meet next week. Yeah.

E

So, let's do, let's do part one next week.

A

Okay- and I think that, as we are moving forward with the port ranger namespace, we can- we can focus more those monday meetings in the discussion about the cluster scope and and the service selector one. So, as jay said, I think that we are going to have like probably 10 more meetings about that. So so this this one is going to.

B

A

Just the the the start right, the first one with a brother, okay, great so the next. The next item from the agenda is the service selector. So I I've made a mess. I thought that andrea andrew from redhead told that he was going to deal with that, but it wasn't andrew. I think that was vinai. Maybe.

F

Yeah so for the service collector, I think uh one of my team members, satish was gonna. Sorry is that at the top of the service, but yeah satish is- and uh I guess the first step is to is- to do a little write-up. I guess for this right or use cases. What did you have in mind.

A

Yeah yeah, so we we have. We have some use case some user stories, but I think that the the best move that we can do with this one is like consolidate this one. The same way that that goal being made with the ftd and selector.

F

A

So we can like have a a document, a pre-cap, a pre. I mean like a a pre-k from from kubernetes, but specifying the service selector and what kind of problem we are trying to solve, how we imagine this being designed in the api and how do we imagine like? Okay, we are going to use certain selector, that's going to point to end points, or something like that. So I think this is. This is like a high start, so.

F

By the way, so just as nfl, we already have the write up that is needed for that again just trying to fit. If I guess what I need to do is I'm looking for maybe a template. If there's a template that you guys are using, I can do that or, if, if you, rather that we use something like what we did for fqdun uh cluster scope policy I'll, do that either way it's fine yeah.

A

I think I think that I think that we don't have a template, so I think I think that would the better the best way is like use the the same, the same document from the ftd and one, but because I think it was really really clear about what we are trying to achieve. So, if, if you will not, I I I.

F

I both of our names on this. We will get it out. uh uh We we already have the write up I'll, just gonna talk to open internal circle and uh shake we'll sort it out. Okay,.

A

You want me to put an ai for you here.

F

Yes, please go ahead.

H

So is this usually done on a google doc or like? Is there a draft github repository for this.

A

Okay, this is a great question, so we have this. Is we? We we've started to open an issue in jay's repo, because we don't have like an official repo to follow the the the the roadmap from from this one. So we decided to to open this in in in not j in jade's repo in github, but we have like uh we are. We are doing this.

B

As a google doc so.

A

Let me I can't I can share the link with you and I'm sorry.

A

Probably it's better to find here, ftdnftdm here yeah, so this is the I'm gonna send to you in in check also in in zoom chat. So yeah. I think it's uh it's like it's a it's a it's a good template because it covers the context. It covers the proposal. Probably we just miss here, the user story, why we are trying to to do this? Okay, and as soon as you have this we can we can.

A

We can discuss this in in, like in the next meeting, save something like 15 minutes, 20 minutes, okay, whatever you need, and then we can send this to sig network mailing list. So we have like a brother, public and and and people is going to start commenting here as they did with we go in here, live okay, so, okay.

F

uh There's one more topic that I wanted to bring up. In addition to um so there was also talk about uh selecting pods using service accounts.

F

Like you know, like you know, there is a namespace selection service selection. There was another option that was to use, allow a proposal to like allow um selection of parts using service accounts. That would be a separate topic. Yeah.

A

Yeah I I is there- is there some some issues, some some user story about this one, because I'm trying to figure.

F

Out how this is going to.

A

Work yeah yeah.

F

There is a user story, uh it's just like you know um we're trying to make it all in open source, uh at least from the google perspective, so we would like to lead it uh like. What's going on in the search I mean we use service accounts for a lot of gcp related features anyhow, so for us like uh um we, we are planning to do that for the parts also. So we like to start off by using a getting comments from everyone, and I think there are some vendors also who might be doing that.

F

I'm not sure, but I think there's some vendors who might be already supporting it. So it may be useful to get a um like a generally agreed api for this. So I will what what we can do we can start off. I would like to I'm happy to work with anyone who's willing to work with us. We have some user stories uh like you know, abhishek andrew anyone interested. Let me know we can get right up.

F

I don't know if I can get the write-up done for this thing by next week, but next week we'll definitely get the service selector done, but this is an area that we can. um We are interested in that uh working in the open source community.

A

I'm curious about this one I am on vacation this week. So if you want to ping me in slack, okay, I would be probably around so I'm curious about what what how how how is this going to work? What's the idea about this.

F

I'm not on flat, so if you can tell me, uh is that a yeah send me like a link to the down and I'll see you on that yeah.

A

You can send me an email, okay, I've sent you in yeah.

F

A

I can I I am bad at email at all, but we can we can. We can speak about that yeah sure.

F

C

Yeah there's also, um uh we have a google doc of all the accepted user stories, so I think um the next step would be maybe adding a suggestion in there with the user stories that you mentioned, and then we can go through it. You know like we can iterate over it during the calls and then eventually accept the user story, which would mean this one right yeah. So I think just just uh maybe add the user story directly in here as a suggestion, and then we can go over it. Yeah.

F

Actually, if you go down further andrew, like this, is something I was talking to him about tim hawkin and he put a comment there to like if you go all the way down at the bottom. So if yeah, so you know so, he was said like a select web service account, like you know this. This topic uh he was suggesting, like you know, we should uh so it does. uh Tim was involved in this decision too. So yeah.

C

Yeah, I I think I think it makes sense but um yeah like I think we should just get it added to this doc. So we can okay.

F

So let me I'll that I can take care of that cool.

A

Yeah I this has a different user story, so we can like separate them from the the idea of services and, like I want to select everything. That's behind the service like I want to select from my ingredients. I want to my impress controller I wanna I wanna use like I want to. I want to select for specific endpoints that are selected by the by the service by a service object. Instead, instead of a selector and.

B

A

You you can you, can you don't need to to do this as an uh a reviewer you can? You can put as an editor if you want okay, if you want okay, so that's a that's! That's yeah.

F

Yeah I can yeah, I don't think I have edit access but I'll. I can do suggestions. I think.

A

So because anyone anyone can comment, okay, yeah so go ahead and we can we can pass through it. You.

F

Just put uh like a webinar gmail.com or you know, and give me edit access, I can, I can see you know v as in vector v a and then.

C

Yeah I'll put it in the chat.

A

I am better at english speaking sorry.

A

uh Okay, so do we have anything else for today.

G

I can provide a quick update on fqdn. um We got some, uh you know so andrew and I have been working on that as well. um You know and we're we have a. We had a proposal uh that was looking pretty good actually and it addressed a lot of the comments that were originally left by the way.

G

Thank you to the community for that um and uh we thought it was a pretty good proposal, but I think um when we spoke to a customer, so I I met some customers uh about this and it sounded like it wasn't going to be enough to just you know: do it on the dns layer uh and they actually wanted. You know implemented at the uh the data plan they wanted and you know um completely enforced, but it's not just that. You know the dns said: okay, I'm not going to give you the answer to this.

G

You know query, then you know it's good enough, it's it's just it's not so um they want stricter guarantees around it and that's why I think the solution will have to be thought about a little more because it is tricky. It's not. You know straightforward to do this. um So that's what I think we'll have to take another look at it, uh so andrew I'll I'll reach out to you with more details on this, uh and whoever else wants to you know help out with this.

G

uh I think we'll have some folks from the the google team also uh joining um the supper, but I just wanted to provide that update that uh you know I think we'll have to do a little bit more um sort of redesign work.

C

Yeah sounds good.

G

Any questions from orders.

C

I think it'd be helpful to I don't know how much you're allowed to share um around like the customer requirements there, but I think it'd be great. If, if we can outline yeah the yeah like why it has to be enforced on the data plane and what requirements they have, that that would yeah.

G

Right so I think the requirement so I'm happy to share all uh the information that we got, but uh I think the the primary like you know requirement was that you know they wanted eliminated eliminated like they want the possibility eliminated of you being able to get out of that ip.

G

Whether you got the answer from dns or not, is it's kind of irrelevant uh so they're calling it an ftd policy, but they don't really care if dns as a component was involved with it um as long as those ips are restricted in uh in the data plane that anybody cannot, just you know, go out to those ips uh and they're guaranteed about that behavior then they'll be happy with it, so that that was kind of the the context behind that. I don't know if I explained it very well.

C

Yeah yeah, I think it makes sense um yeah I mean at that point. I. It sounds like it's more of a like just a generic network policy problem like they're what they want to restrict traffic, but I guess they want to do it based on what you can resolve.

G

Yeah exactly so so effectively, they will have to go back to some sort of a number policy based solution. Where you know we get some dns resolutions and we sort of end up coding up never policies on the customer's behalf.

C

Yeah, I'm not yeah.

G

Yeah, I know it's not very like um it doesn't feel very satisfying, but but uh I think that'll probably be the best way to think about anyway. uh You know I'll take it offline with you and then we can figure out how to push this forward in terms of api and implementation.

A

Do they do they expect something like a real time change like every single request with the dns? It changes, also the the rule based on the id or like they are okay, with having some sort of of delay like if I change my service, my service id, and then I change this in dns, respecting the the ttl or something like that. You know about that.

G

So I think the sensitivity to time is it can go either way depending on what kind of a customer you're talking to some customers are saying, you know very, um very sort of cloud native about this and they say yeah, it's okay. I understand you know like a minute or two is fine. You know, but in some cases like a financial institution would be like yeah hell. No right like there cannot be any delay. um So I think, because it's a security thing we have to be the serve the tightest guarantee.

G

uh So I think the the best way to solve this would be to make sure that it works um for the the most stringent case, which is it needs to be in lockstep, with dns.

C

I I feel like just by nature of the protocol like it has to be one or the other, like. I can't think of a way we would enforce uh policy like at the data plane level like at the close to the like the network interface without being out of sync with dns, just based on like ttls and then whatever right, but yeah. Maybe we're just solutioning at this point. So.

G

Yeah yeah yeah. I I just wanted to provide that update that you know we did actually get some feedback from customers and I think our original the proposal that andrew and I have been sort of working on, I don't think it'll it'll- satisfy that requirement. So we'll have to sort of do some re-engineering.

B

Okay, okay, like not, is there any value in like? Are you saying it was multiple yeah as a lot of customers or just one customer.

G

But this particular case it was one customer that I spoke to uh and you know there are some other customers who have requested something similar.

C

C

So maybe this is asking for much, though, but like out of the other customers that we have asking for this. Would it be possible to figure out if they have the same requirements as the customer that requires the resolution to happen like at the data path level.

G

um I think it's certainly worth taking a look. um You know I I think it'll probably just take some time, but uh one way or the other. I think we have to come up with an alternative solution. um So yeah I mean. Certainly we can. You know, get some more information around this, um but I think we'll, like even uh some of the instincts that I've heard from you know people who've been in the security industry. I you know it felt like the right way to do.

G

This was in the data plane because they don't want any any sort of loophole where you don't go through fqdn, but I don't know you you figure out through curl or something and I don't know you can resolve it or go into some other ip address, get those ips and then you can exit out to to those ips. um So I think that was really the the essence of this comment and once I understood where they were coming from, I figured every customer would probably say the exact same thing.

G

So I didn't bother.

B

Why couldn't you do like a redundant thing where, like the v0, is the thing that you all came up with and then you did the danwinship controller thing that sent notifications to the cni and then the cni could make its own ip address like blocking rules before the like?

B

Why couldn't you kind of do both right, like you would do the the original thing you all have that sort of works so that people could use it and play with it, and then you have an extra cni level notification that happens so that you know not only is dns not returning properly, but you know in the v1 of this.

B

You do some kind of a controller callback thing right like like, like it seems like the core functionality of the v0 that you all proposed. I mean I didn't see the proposal, but if it's what I remember it, it seems like that. Even if it's not like 100 secure you get to you, get the api earned out. That way for the most part, right and- and you can totally have redundant. I mean security is all about having redundant layers of protection right.

G

Fair point, I think the api by itself is is sort of independent of this, so we we're still, you know the api by itself. I think we're relatively sort of confident I think, um of what we want to propose. uh We want, I think, the implementation of it, which were which was what was the ask in the proposal by many folks, was like you know how we actually are going to implement it and what guarantees we provide.

G

I think that's really been the key question of this proposal and that's what we want to address um and given the fact that it's a security feature, uh you know it just seemed like we have to do the right thing from day one you know like it's just not something we can iterate on. I guess because people are kind of running this and production software and we want to make sure that they have the guarantees that they expect.

B

They could just not run it in production from day one right like the api comes out and then in day two, you have a better version of the api. That is ready. That's what I'm thinking you know what I mean.

G

Sure yeah, certainly something to consider. uh I think what we'll do is like from here we'll take this feedback and you know any other feedback, and then you know iterate on this figure out how we can sort of split this into different phases. If we have to or if it makes sense, you know we and we can get there fast enough. Equally, then, might as well go. The whole whole thing uh do the whole thing together: yeah.

B

Because I bet the cni providers would be real excited about that right, like they'd, be like oh, okay, cool. You all got like an api created. Well guess what we can make. We can do one better. We can not only enforce this api, but we can also have an upsell thing and then everybody wins right. The business is when the vendors win, the customer wins. Everybody wins.

G

Yeah, so I think maybe that's the right way to do this. Where, like you know the proposal just says, here's the api and here's the sort of exact interpretation and semantics of this, and then we just sort of get that approved, and then people can just go implement it. However, they want right in their own cnn, yeah.

B

We could put an e2e test in you know. We love testing network policies over here right, so I'd love to put add some tests.

B

That basically say well what, if we spoof the dns thing in there, you write a test so that when people run the validation right, it actually is aware that there's a hack around if somebody hasn't completely implemented this api, where you can get where you can resolve conf the damn dns record into the thing and then work around the fact that they're only blocking the response, they're not blocking the actual ip and then you would be able to detect cni providers that didn't intend the thing that you're saying you know that customer wanted right.

B

So we give them a full-blown upstream solution to their problem right, um even though the downstream bits may not have been fully worked out yet.

G

Yeah yeah, I think that's that's fair. I think we can uh andrew and I can just figure out what the api should be and then we'll we'll just specify as much of it as possible in terms of how it should be implemented and then we'll just let the providers take it from there with our end to end test.

B

Yeah yeah yeah. Definitely once it's time to write those tests. um Let me know like loop me in on it and I'll I'll help. I mean I'll, build the tests for sure that's cool yeah.

G

All right cool any other questions.

G

Cool all right, thanks for the feedback, everyone thank you.

A

Okay, so one last comment: abhishek, I I've added an ai for you to send an email to network inviting folks for the next meeting on monday, saying that we are probably going to discuss about the cluster scoped policies. I don't know if this is the idea, but we can gather some good feedbacks about this. One like we can dedicate the next meeting for only this discussion, I'm okay with that.

D

Sounds like a good idea I'll do that this week. Okay, so is every is.

A

Everyone, okay to to us, to dedicate the next meeting only for the clusters, corporate policies, discussion.

A

Okay, so no one against great. So let me just add this. That is here that we are going to dedicate these two cluster scope, and I think this is all folks. Thank you, everyone for coming and have a nice.

D

Week, see you folks, thank you. Thank you. Everyone bye thanks.