Kubernetes SIG Network, 11 Jan 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SIG Network meeting 2018-01-11

Description

SIG Network meeting 2018-01-11

A

All right recording is on so if everybody has the agenda back open or if you don't I, will paste a link to it and chat so there it is. The first item on the agenda was the test review and there are a number of different flakes sake.

A

But also the I'm not familiar with what the issue is with stale results. Can anybody explain that to me.

B

There's DCI AGC no.

A

Here's g c ue, I fix some things: that's not flaky. It works okay, so.

B

I think that's just because these are new tests, yet no results. Okay, a warning, mr. Sayle.

B

A

Yeah I looked into a number of the tests so far and like the ingress GCE to e flaky, one that looks like that is image, pull failures and there's a heck of a lot of red in that one over the last 24 hours or so.

B

This board in the next.

B

Just ignore them for now: okay,.

A

One other I noticed was GCI GCE ingress, release, 1 9, which you know seems a little relevant since we're getting close to 1 9 and that was flaky and that looked like it wasn't too flaky. But every now and again there was a leaked default route resource.

C

Default router just a leak, a leek.

A

Trout named default route, something default route, 9b blah-blah-blah-blah-blah.

B

A

Yeah, it seems a little intermittent.

A

Other than that, it's pretty green, but it looks like every now and again one gets leaked. I did take a pass on a couple. Others are there any tests that people think are that are flaky. That should really be looked at at this point, and can we form that out.

A

I did notice that the Calico tests seemed pretty read.

A

Kind of way, at the bottom, the Calico CNI one looks pretty red for a while, at least in a number of the tests at the top, but the flannel tests. Look okay, just for reference. I was kind of wondering, maybe what the difference there might be.

B

B

Last year, yeah I think we made this last year and someone working on calico was going to look at it.

B

A

Their tests, people thought were interesting that we should take a look at quick or should we move on.

A

All right all right, I guess we will move on okay. So the next item on the agenda is topology, aware routing of services- and it looks like do- is that ujin a.

D

A

Bit about that quick.

D

Popper Audrey a world I was a proposed under have a resume any comments. I'm doing here about.

D

Can we calculate one on the ten to be a simple information implementation? Can we I think.

C

110 for an alpha sounds reasonable, I think so does anybody? Is it worth talking about what it is a little bit for people who haven't been following on the proposal, maybe like for two minutes or something yeah.

A

I think it would be worth it take it away.

D

So the proposal is about a tween put him in this low coaster so who the loco serve is a simple local, Lucas own local host and the local week to prepare by the genican way is neither a space take away as a proposal is available now so I wouldn't I, don't know, wanted to talk a tattoo and detail temerity and well, who interesting interesting time.

D

Configures a proposal.

C

And just for background, the proposal started with the question: how do I always talk to the locking agent? That is on the same machine as me right, and we then expanded that a little bit more to encompass? How do I talk to the database server? That is in the same zone as me, or how do I? How do I find the proxy? It is in the same rack as me, where is a known machine? Rack are effectively arbitrary right.

C

This was this was sort of pioneered in pod affinity. The ability to express run this pod in the same place run this pod on the same note than another pod is where the other pot is defined as a expression of selectors parse that five times um so hot affinity is out, and it's in some use.

C

The storage team has a similar problem of how do I express which machines volume can be referenced from and they have taken what the pod affinity team has done and literally reused the structures to express that affinity on volumes and so I think it's viable for us to do the same thing with service.

C

It's a little different in service, fundamentally because all these other ones are effectively like a true term expression, there's a left hand and a right hand and we're saying well the left hand is always the same as me right so find me something in the same rack as me, but I think that's fine, and so there's the proposal and the proposal. Thank you is the simplest possible API to this. It's perhaps almost certainly too simple, but it's a really good starting place to figure out if this is going to work for people.

D

Yeah, it's a simple motion. I know we can't extend data, see ah it's already. A real compact.

E

This is John, hey, you know, I put a couple comments on there and and I. Don't have I have the same use case for the local. On the same note, because we have doing dns, that's very latency sensitive and we don't want to cross the network we don't have to in in our system. But I am concerned about the idea of building, in the specific logic, for this specific kind of routing directly into kubernetes Mensa's.

E

What I talked about a little bit in the comments that more generally, what we need is a hook point for making a decision about how to route something, and we.

E

We can't chase all the different use cases in kubernetes directly for every single way. Somebody might want to route something so what I was suggesting is. Instead, we we, we have those hook, points that called call out to something else to make a decision now in the case of what you defined here, that could actually be a piece of code that that takes exactly the topology API you've defined, but it puts it in a CR D instead, and it makes a decision based upon the same logic you have.

E

But if it's a hook point- and you actually separate those two things then later on, if somebody else wants to route for some different reason, they don't have to change kubernetes. They just have to add in some different extension, so.

C

I mean you basically just describe this, do and I think that's fantastic, but I think it's far more complicated than what we need for the simplest possible case and I'm hoping and maybe I'm wrong and I. Haven't read your comments so all eyes, I'm, hoping that the simplest or close to the simplest possible thing will actually satisfy some large body of users and more complicated stuff will come along as sto and similar things mature, I. Don't.

E

I, don't think it's a steer does a lot more than than just routing right. So this is this. Is it and I think, for example, I couldn't use this gear for my use case, because this do is layer and I'm doing DNS. It's not steel.

C

Can handle air three or yeah they claim to be able to handle it I'm, not sure they handle UDP, but I know they had a layer three TCP anyway, hi.

D

John I noticed your commenter and I. Think for me: I Pollock, harder, my customers, the one level level, three, your solution, more level in studios, a firm Walker labor, oh I, provision, labor solution, so I think as a Cooper is the way yeah.

E

Iii also, what I'm saying isn't so much about a new.

B

E

But nonetheless, I mean the I, don't think what comes suggesting actually more complicated and what you're suggesting in that and maybe I introduced it with this whole Lala notion of generalized policy that made it seem really complicated. It's actually just about where you put you put the code in kubernetes, or do you put an extension when you could.

C

Given just given like the IP tables and the IPPS proxies that we have today, both of which are effectively kernel configurators with no data path, interference, how do you see that decision being made in real time without intercepting data paths like STS?

C

E

Actually I mean it's the same question really for I would suggesting we do it at service discovery time, because then you don't need to worry about the data path, but I mean I. Guess how are you suggesting it in yours as well to do you keep proxy?

E

What proxy configuration I guess are you suggesting? Because it is it all this is, is about where Q proxy gets its metadata from. Does it get it from some abstraction that existing communities are going to get it from a CRT? And if it's, if it's the C or D, then maybe it's some plug in the Q proxy or.

C

Something, oh you mean they be statically configured from metadata, not dynamically configured through, like on a per request basis, correct.

E

I'm suggesting no and maybe I'm not fully understanding posle, but I'm, not actually suggesting any mechanism that would be different. This is about how you configure it. This is how you configure you, configure it as a as data on a on a core Nettie's abstraction like service, or is it just a separate thing that defines how you wanted to do this routing you hook pointing in the different in the different layer. Is the different control points right? You have different control points in the stack you have the service discovery piece which happens before anything.

E

You proxy, which is doing the actual router tables, which is doing the actual routing, then you've got queue proxy tables we would have to choose proxy or whatever is going to configure IP tables would have to read this other CRE rather than read things off the service. But if you did that, then you'd have to somehow put a plug in to manage those crts within within queue proxy. That's what I mean by the hook point the extension point of keep proxy. Then I, try question.

F

Here, though, the plug point you're talking about is plugging in the logic that interprets the CRD into the actual IP tables rules correct, and what, if the proxy isn't in iptables mode.

E

Well, what would you do today with the current proposal? In that case, it's not really any different. Well,.

F

The difference is that in the current proposal there is a fixed semantics and all the different proxy mutations can implement that semantics. But.

E

They have to implement that semantics rather than right.

F

The point is that, right, what the change you're making is you're changing from a centrally defined semantics, which can have distributed various implementations to no defined semantics and now you've got an what.

E

You're saying I said you're saying that the queue proxy plug-in wouldn't know to interpret that into iptables rules, because it's it's not making the routing decision itself. It's instead trying to set up IP tables to make that routing decision, and so it it's uh in order to make that work. But you keep your nightly tables. You have one implementation that interprets that logic and then to make it work in some other mode. You'd have got a different.

C

Slot and then when the EBP F mode comes in and you have to have another one for that, one, the next thing after that comes in and I, don't think that I, don't think that pretend mole but I actually missed I misinterpreted, perhaps in your favor. If, if CR D here was effectively a mapping of I'm, not sure how to express it, but a mapping of which end points should be chosen from which nodes or something like that for each service, which sounds like a fairly complicated structure.

C

But if it was you know like today. Let me back up a second. What we're proposing with this is, there is a semantics. The semantics is: look at the labels pick the ones that have the label that matches my forehead for an arbitrary label, but all we have is the labels right. In fact, we only have a one expression which is equals equals, and we can talk about whether we need more expressions or not.

C

But that's a pretty simple: it's a pretty simple core and from that we can produce the list of for each node for each service, which endpoints should you choose if we took that logic out and put it into a CR D or something, and you could have any arbitrary process running, that calculation figuring out in real time for each node for each service, which backends should I choose and we could consume that, but it wouldn't put it, but it would not be how do I turn that into iptables, because you don't get a whole lot of freedom in terms of what semantics you get to express its?

C

This is the list of backends to choose in this disorder. Maybe with this wait, but that's about it, yeah.

E

That makes sense. That's right exactly so. The the the the the tension point is fairly simple. It's it's given me that list of end points for this particular service in this particular client, and whether that and you're right that, if that's the extension point, then we don't need to worry about it being different for all these different things. They all use the same extension point and they configure whatever they're going to configure in the same way thing where the decision made somewhere else.

E

Exactly what I'm trying to say right that logic to boil down a client and its destination service into a list of endpoints is doesn't need a living kubernetes.

C

That's interesting to me, because actually one of the questions I raised on this proposal was it sort of feels awkward that I'm defining this in the service, which is sort of the server side when it really feels more like a client side or an administrative policy, not a server side policy, but service is the only place we have to configure. It I like to think about your idea a little bit I'm, not sure that we can have service dependency, our DS that way, but I need to think about the rules there.

A

So I had sort of come to the same conclusion as John when I was taking a look at the proposal, but maybe for slightly different reasons, and on that point it seemed and I know you were trying to keep things as simple as possible and you know create the simplest possible API for it. But I thought that John's comment about well. This seems like something that could be generalized kind of rang. True for me, and so I was kind of wondering about you know, is topology the right name for this kind of stuff.

A

Could we achieve a slightly more generalized result by not using the word topology, but just kind of you know having some arbitrary mechanism for what we've just described, about selecting a particular endpoint to happen, but not encode, any kind of like topology, meaning on that and then that you know looking at some of the sample code.

A

For what cube proxy would do it's only taking a look at node labels, and so my thought there was well yes, this sounds like a great application of labels and then maybe we don't need the kind of external plugin or something like that, because people could just manipulate labels. But then, if the only labels that are available for this decision, our labels on the node, perhaps that's a little too limiting.

C

So one thing that makes this sort of complicated I mean in some sense what yours, what you're saying is the service wants an endpoint selector with a with a way of expressing some relationship right right, except that end point its.

F

Filter that selector I.

C

Yes sure, the problem, though, is that endpoints as currently expect are this monolithic thing that isn't individually addressable and in fact this is one of the things that we identified as needs to be fixed in v2, which would probably make that overall problem easier.

F

Yeah, but that doesn't seem like a big problem to me. If you have an API to call out to for doing a filtering, certainly it can be passed. A structure say a list of tuples where the tuple has an endpoint plus. Whatever else you would like a v2 endpoint to have the.

C

The problem is that the endpoint structures are already getting large and we can't realistically Jam too much more in them until we figure out how we're going to prevent the boundless growth. And this.

A

If that's a concern that it seems like putting topology maps into the endpoints addresses, might explode that quite a bit.

C

That is true. That is something that we need to figure out, and it may in fact be a problem. I guess.

E

I, just try to step back a minute again. I. Think that my understanding, what we're saying is that we need to define a a API extension. That's the word for it, but we need.

A

An extension point.

E

And an API that says: here's the information about I need to make a choice in where I want to route this connection to what endpoint and I get back a list of endpoints in some sort of order, and that's it once we define that APRI, then this proposal could go forward outside of kubernetes right. This proposal could become just just what are those?

E

What is that it can look like and then at the different control points to keep proxy and wherever that, that piece of code needs to implement that control point and make that request and I don't think it's necessarily a service depending on a CR D. There is a service depending on making an API call to something which may be an extension.

E

C

The choices we have, our basically CR D or first-class resource and I'm not sure that CRT would work so means we would have to be thinking of this in terms of a first-class resource. I, it's interesting, I I feel like I need to think more about how it might look I'm struggling a little bit with what would the resource look like they carry the mapping of for each node for each service choose these backends well,.

E

Actually, that's not quite what I'm suggesting I'm suggesting that, from the point of view of cube proxy, what you have is an API and then an API. You cuz in that you have this this service coming from this source with the client coming from this source and give me back a list of those anyways. What makes that determination on the other side? I, don't know, Hieu proxy doesn't know it just makes an API call. That could be some code directly in there. That's interpreting some CRD! Well, that could be.

E

You know some guy on the chat just joking, but like it's anything right. What.

F

Needs to be standardized, then, would be say, a first-class object that just points to an API endpoint that gets called plus probably pass some configuration data along to it. What.

B

Question is what form is that API going to be expressed in? Is it going to be expressed as a kubernetes style, API or something else? This is like. The only standard we have right now is sort of a kubernetes style, API.

F

Not sure we have lots of call-outs lots of plugins well when, when it's a functional style API, we have lots of our pcs I think what's being described here is a function managing some other state and so an RPC style interface sounds appropriate. Well,.

C

The difference is that in almost all those cases or all that I can think of the behavior is the thing that we can rely like. We don't break portability in the sense that, if I schedule a container on any kubernetes cluster, the container runtime interface ensures that container runs and the semantics and the API I give. It are always the same and if I in picturing, what you guys are sketching.

C

How do I ensure that a user who said I want you to always choose the I, want you always choose the same backends in the same rack as me. How do I know that the plugins you choose to implement always guarantee that semantics or do they do we may not need to? But where does the.

E

C

E

That semantics is guaranteed as part of the service. That semantics is guaranteed as part of the the policy is, what I would call it? That's being defined and and I think we mike suggesting is that. Well, maybe you have different ways: you've got the default thing that you keep, that we already do right, which is just round robin or whatever it is probabilistic and, and that would be the default if you don't specify any pointer to some the.

F

Thing we are the thing we already do is no filtering. It uses all endpoints right, we're talking about any a filtering API, so the default is no filter. Okay,.

C

Well, it could be filtering and waiting, but yes, okay, the default is no filter. So where do you see the configuration like? How do I, how do I, as somebody who's, providing the data dog service? How do I say this is a per node service and I always want you to use the per node version.

E

We would have to I haven't thought it through that that that deeply, because I I was really just bringing up a concern. I had with the way that building into kubernetes but I think what Mike was suggesting made a little bit of sense to me. I'm gonna have to think about it more, which is you. You have some sort of API object. First class API object that defines some.

E

From some point are essentially to a routing routing policy or filtering policy decision maker, something.

C

It seems like it would be much simpler and more sort of kubernetes style to be declarative here and to say instead of me, pulling some service to make routing decisions. You declare them as as a resource in communities right again for each node. I should be able to look up my node for each service you're going to give me a list of which backends I should choose in which order and I can then program my IP tables based on that and because we did it as a kubernetes resource, I can watch it.

C

So whenever it changes, I will immediately be notified and I can update my routing table based on that and there's no call-out, there's no RPC, but whoever is the actual policy generator can program this. This resource sort of like never, policy right, you can.

C

It is sort of like endpoints, but it's a little bit more complicated, because now it has like two dimensions instead of one. So one suggestion is that probably.

B

Should go on the mailing list, I.

A

Was gonna you know sort of cut this since we spent about 20 almost 30 minutes on it. Not too, you know. If people are someone discuss it. Mailing list is great. The issue is great I think we brought out some really good points here. Yeah.

C

This was this was helpful. I'm, certainly gonna, think about that John and and Mike I think it's there's there's something. There is an interesting idea. It certainly has an opportunity to follow a lot of patterns that have been established already through karate. So, let's, let's continue to chew on that and we'll take it to the issue. The proposal here- that's.

E

C

A

Right next item on the agenda is 110 planning.

A

There's a C: where did it go? There's the features spreadsheet link at the top as well, which I spent some time today trying to update and get a current status. So for that I'd like to just kind of run through the feature spreadsheet from there and see if we have anything else that we can update.

A

So if you open that that actually I think defaults to 1:7 but there's a tab in the bottom, four one, nine. Actually we want to go to 110. Sorry.

A

Well, let's start at one nine we probably just want to copy this over.

A

Is there anything in this list that people see, if you have it open for the one nine features that we need to update based on current one nine status, I'm.

F

Sorry, I'm a little lost in yep document, whoever it is 110 relief schedule, there's a sort of handy links. The feature tracking sheet is not a link. Yep.

A

So basically I mean that's, there's a lot of schedule info there and stuff, like that feature, freeze, etc. But if you look at the top of the Signet work agenda, we kind of have our features spreadsheet, linked they're at in the important links part and that's what I was kind of looking at. Thank you yep.

A

Let's see, we probably want to duplicate that tab and rename it.

A

Okay, so I just created a 110 features, tab at the bottom or sheet.

A

So if people just want to jump over to that, we can take a look at those items. The first item is ipv6 support.

A

Is that something I mean based on all the discussion that Q Khan and whatnot? It's gonna be mostly there for 1/9 already do we want to say that it's going to be more than alpha in 1/10.

C

C

G

What was that? Tim.

C

16 thing: what.

A

Does it be 16 think for its status in the one 10 release.

G

All right, I think what we have to get done is we have to finish getting the CI working. The documentation is, is almost there and then start on the dual stack and I'm, not sure in the 110 time frame that we can get any more completed than multiple IPS per pod. Would you do you want to.

C

Block the beta of one six on dual stack or do you want to proceed? Sorry of these six? Do you have you wanna proceed with v6 single family support before we proceed with dual stack? Is there a reason to go one way or the other.

G

Yeah I hope you looking for your guidance on that I I would think that having a beta just single family is not that useful.

C

Okay, I mean I, don't have any real experience to draw on here. What.

G

Yeah, what what do we need to do to to go beta? Is it just having CI and proper documentation or for the single family yeah.

C

More or less, but if you think it's not really that useful, if you think this is merely an enabler for dual stack and dual stacks, what's really important then, and let's not rush and may you know, rushing makes mistakes if we want to leave it as alpha and try to pursue, put all our energy into dual stack. Instead, then that's fine too yeah.

A

That would be my vote, so does that mean that this feature probably will not move out of alpha or whatever for 110, because it requires the multiple pot, IP yeah I think that's what it means yeah, okay, and for that that is currently in the feature spreadsheet as not started and low priority, except we've marked ipv6 support as high priority, so I'm thinking, we should probably move support. Multiple product P addresses up to a high priority. Yeah.

F

I think maybe we should split it right. What we're really trying to say is there's two levels of multiplicity. Right, one is multiple network interfaces or network attachments. Now there is multiple addresses on one attachment or interface correct.

C

So sorry, Dane I want to back up a second I'm thinking about single family v6 only and whether that's useful and I can think of places where that would be useful, possibly useful, maybe I'm alone. But you know, we've got some things that we're thinking about that. That might be interesting for I guess what the question would be, what.

B

If you move it to beta what.

C

Is like what? What is that yeah? There's? No really do it right. It's not like would be cementing a field name or something it's just sort of. We run gating. It.

B

It would allow.

C

Broader sort of people to kick their tires, yeah I mean the reality is you know somebody mentioned here like nobody, tests alphas really, and if we really want to get some miles in the v6 support and shake out any issues. Maybe we make sense to just finish the see I call it beta and 110 and tell people it's it's single family, we're working on the dual family support, but single family support for v6. We consider to be beta and go nuts I thought beta did imply more stability. It does imply more than.

F

Orny I'm s, meaning more precisely I thought it inhibited more changes. It was more inhibitive of changes in the future sure.

C

But a nice thing here, there's no real API to this right. It's not like we added anything to any API structs for v6, but I can remember. It was really just my capability through all of the components right right.

G

G

Have a question.

H

Regarding that Tim, so how are we going to add the ability to have to our family and to have that configuration in the cube, API server, for example, or sorry in the controller manager? How do we add the the pot cider for dwell family? Yes,.

C

Although many changes on.

H

C

To do dual family there's a whole bunch of changes that we need and I started, writing some of that stuff down, and we had a little discussion at Q Khan about it. But I don't think we fully enumerated all of the all of the places that we'll need to touch, but you just touched on two or three of them.

H

Right I wasn't that good guns, sorry I know.

C

It's fine, it was really like a clearly a hallway conversation. I think it was maybe 10 of us sitting in the hall, and we just started is just to sketch out all the things that we need to change and there's a lot.

C

But the sooner we get started the better, but I. Don't think that that should block single family.

B

V6 support, in fact, if you let's say you went to beta and something did not work with single family, that would be a bug right. Yes, the other component right.

A

So it's kind of sounding to me like we should try to do beta for single family for 110. That's.

C

My feeling I mean I would like to know that it doesn't regress and yeah having it in beta means more people are gonna, have access to it. Well,.

A

I mean that implies see and do you need the CI anyway? So maybe we.

G

Need that anyway, yeah right, we don't want regressions, introduced I'm.

F

Reminded again of a technical question here in v6, your average node gets two main addresses, rather than one so, which one or are we doing multiple addresses now or what.

G

You mean you get the the link-local and the and the regular v6 address is that we mean by no.

F

No in additionally local there is the permanent one and that's the obstacle or temporary one which.

A

One currently gets reported for node addresses in for pot addresses.

A

G

You know the the pod addresses is the one that whatever the CNI allocates. Okay, how.

A

It for nodes, does he.

G

Use link local.

A

For node, or does it use like a site or global scope, it uses yeah the global yeah.

F

Well again, a node will have a permanent address and a transient address. You.

A

Know so it ain't saying, is it just picks one of those, because both of those should work to contact the node on and for now just took one of those yeah I.

G

Think it there's an our rhythm where it for the node address. It looks for the Gateway, where the gateways on and then picks picks a global address on that it prefers global I. Think that's how it works and.

H

You can also specify didn't know what I'd be without the.

F

The permanent and a transient are both global.

A

F

Transient changes from time to time.

A

Yeah I mean that's also true,.

B

So I think. The question, though, is that for the data is this: it's a required to support the transient to.

F

Make on I was just trying to ask it and find out what's going on. Oh so I mean it's. Obviously the simplest thing to do is to use the permian a dress because it doesn't change, but I haven't heard anybody even say that they identify it correctly. I.

G

Transient you mean that, like the privacy extensions, yes.

F

G

That was well yeah. I haven't enabled privacy extensions I. Don't do we.

A

Want to well, it's not a question of you enabling it for kubernetes, it's a question of when you install kubernetes on a cluster. If the person installing the OS enables temporary addresses, then you'll have to deal with them, because yeah.

I

A

Different ipv6 ones.

A

I

To me, it sounds like this.

A

Should be an issue that gets opened and then it gets addressed at some point and maybe it becomes a bug for one 10 who knows but pick.

G

The one that has on it right.

A

It goes through and it picks the one to have the Gateway yeah. Both of them will have the Gateway, though, because the privacy address is has the same prefix as the permanent one. It's just the last bits around few skin, so you don't leak your MAC address out to the Internet.

A

So anyway, it sounds like there should be an issue filed for this, and then we can keep discussing it there in the issue, and we just make sure that we're aware of this potential problem, yeah.

C

It sounds like a great question, thanks Mike.

C

F

No I agree: it's just like it's just just a bug to be fixed.

A

I mean it could also even just be a dock issue. Just say you know, don't enable temporary excuse me. The privacy addresses in your v6 cluster at this point, but that will be fixed by GA.

F

Well, this would have to do with a bug right, yeah,.

A

F

A

So, let's ipv6 deprecation of extensions v1 beta one network policy, I think in Winship had said he didn't know anything about that in Chris. Luciano, who is does not appear to be on the call. Anybody else know the current status of that and is that targeted for 1:10 I swear.

C

I reviewed net PR, we put dots in.

J

Saying it's deprecated good know exactly what this feature. You know what would stuff it entails, though so I don't know how far that gets us did. We do we do that before one nine or after one night, I.

C

Think after okay, then we have to let 110 be the overlap. Release does.

A

Anybody have the issue number for that offhand, so that I can plug it into the future spreadsheet or, if you do just plug it right in there.

K

A

Well, if anybody does get that issue put it in, so we can track it that way. We also have deprecated cube net if anybody has better status than I on that one. But I know that there are some outstanding things for CNI, with respect to port MAP and some other bits for cube net that still need to be spun out. So I think that's still in progress and that's probably not going to hit 110.

K

K

Delete some code.

K

Yes, yeah, that's a different question: I, don't.

C

I Daniel's name is on here, but he's sort of focused elsewhere right now, I, don't know if Chris is here, I, don't think so. I, don't think anybody is absolutely looking at this. This is one of those bugs it's been open for a year and a half like we all sort of think we should do it, but it's not important enough. I.

A

Mean I I would say it's not not in progress, there's still bits of it. I know, there's a bandwidth shaping plugin, that's shown up for CNI upstream, and that's one of the things that cube net currently does so there are bits and pieces, but I don't think anybody is. You know focusing on this specifically, but there are pieces of it that are actually moving forward.

K

C

Daniel started some work, but I don't think it's far enough along to to say like this land in 110 can Oh Jim. Can you investigate enough? They know. Gee gingka on our side will take the action to figure out if anything's happening there or what the status is yep, not okay,.

A

Sounds good and also there were the investigations into the point-to-point plugin as well, which I'm not sure what the status of those was but I know people have been looking at that.

J

All right so so I'm just updating the deprecation thing that did make it into one. Not so we can kill it in 110, all right. I, look forward to that.

C

A

I just delete the row, then Dan or just mark it done I.

J

Marked it I mean a it's: it's not actually gone. It's it's! It's done for well. Annex marks, deprecated, four one, nine. So us we removed for 110 yeah.

C

So the action / 110 is actually deleted. Yeah.

A

So, can you just update the description there to delete right, mentions view and beta1 policy.

A

Okay: next one is proposed, the future of ingress.

B

D

B

Actually that one I had a question on and I think we should add it as a row: okay, where that one is going and then this one is more and related to the discussion. The Signet work, each I've, a coupon and I'll, hopefully be sending out some kind of survey to kubernetes users too. So we get like some data as to where to go, that's kind of where I think, at least in 110, we'll probably collect data and start discussions.

D

Agree heipo, it will mean we can send us a survey to the users to this to promote assassin tree yeah.

B

I think, given the feedback and the enthusiasm from the crowd that definitely people have opinions.

H

Just a small place is there any dog gar issue predict already. No, no.

B

H

A

Procedural question here: Tim at what point I'm just looking at the time left for this meeting and if we should switch over to some of the other items like the pod, ready, plus plus or if we should continue trying to burn down this list and keep it updated. The only reason why maybe we'd want to continue doing. That is that we have freezes in the near future.

A

All right sounds good.

A

Okay, so the next item was IPV s cube proxy I had changed that to GA I mean it got beta I. Think in 1/9 is that correct.

D

Green and talking with yeah, okay.

L

D

I'm not sure what are the scope, ouch.

L

We can go to GA really.

C

Is gonna mean confidence in the implementation, since there's really no API around it and that's gonna come with users, so probably the the yardstick for going GA is convincing ourselves that enough users have switched to it that we believe it works.

D

Yeah and the it's the using Huawei and machine production environment in China.

D

D

And then IPV across it doesn't matter right.

C

Right, there's no API there will we'll want to look at it on our side and see that we are like I would use me as a as a yardstick for being confident or me. The other people in this room. I guess- and maybe we should see if we can get the ah sure folks are like one of the other major to invest some time into figuring out whether they think it's viable and if so, then,.

L

M

We mean I, Q proxy will use IPS and IPS as GA doesn't mean the beef default operationally proxy would use. Ipos no I think that's two different steps. Okay, the reason we enable communities on DCFS with no source and the problem that we are seeing is that Q proxy basically assumes that it is the only entity using IP V s. It is not true in some other platforms, a DC as being one of them, and so I don't know if it should be a criteria for GA that you know it leads to the error.

M

There might be other entities. It's similar to using you know, sharing IP d will so.

C

We practice earlier in the IPPS design and we didn't have anybody who could defend the sharing position. So I think your feedback is very welcome.

C

We didn't, we couldn't find anybody else with whom we decided we needed to share, and we know exactly how to understand what that even meant. So if, if this is a problem for mesosphere, then that's an opportunity for us to actually consider fixing this awesome.

M

So should I just create an issue for it and then we take it from there or how do we go.

C

Well, create the issue and tag it as area IP, vs and okay.

L

H

A

A lot cool, okay, so I will mark I have marked that as a target for GA for 110 next item is core: DNS is cluster default DNS. It looks like at least the documentation all got added for one nine, so I'm just wondering what's left on that, is it going to.

E

Get declared as beta.

A

E

In order to be beta, we need to. We need to provide an upgrade path that takes the cube, DNS pick up and uses it to configure your DNS upgrade process, and so we are working on that. The other question I would have this one with IPS. How do we get the build, the confidence to go?

E

What's the threshold level for confidence.

E

B

At least for the beta, it would be great to get that integrated in the CI sono.

E

Yes, Francois: we discuss how our progress on that, but in.

N

The CI we already have, we already have in the as you call that test integration dashboard. We already have a cubed min GCE called ENS. Okay, then, was don't fall. Fires, oh, but committed, maybe up after alpha. So in that is done. What is not done? I did a test manually before ipv6 with crusty v6. So as soon as we have intelligent test for ipv6, then I can add the 1 for called EMS.

M

Let me see so just for anthem data. We here we have actually seen some issues with ipv6 and ipv4. We saw Co no crashes on Red, Hat, Enterprise Linux and send to us this with yes, when using these he was does not the q proxy IP. Yes, but it's something that heavy tested, I, think in six width, I PBS or the we have a CFL are on different distro. That's.

C

A great question.

M

Because I mean there are issues with ipv6 support for I. Think years and I mean an our internal CIA used IP V, as per our internal Lord, Mansur and DC us I mean we seen a bunch of clashes with ipv6 penny enable at home, I guess.

C

So can we can we just say the v6 team and the IPPS team need to get in a virtual room and talk about an Festus. Yes, I think that would be perfect.

A

All right sounds good, so can we commit to beta for 1/10.

C

My beta would be a problem all.

A

Right ingress class proposal, API design, doc- that was marked as done before so should we just remove that row from the 1:10 release, or is there a second stage of this that we could mark down? I think it needs to hold until we figure out the.

C

Rest of what we're doing anything grass, which is on Bowie, okay,.

A

So does that mean I should delete the row for now yeah.

C

A

Right, it is gone windows cube proxy I changed that to go or to ask: does it go to beta or alpha? It wasn't marked as alpha anything but I know it got into 1/9 right so or no it. It hasn't gotten into 1/9. Yet I forget what the status actually is. I.

C

Forget to I lose track of which was in before, which isn't, after anybody for Windows here.

N

All right well.

A

For the moment, let's mark alpha since I'm pretty sure code is there for 110, okay and then I guess we'll uh people on that. Next one is Network policy, egress cider to GA.

A

Dan, did you have an update on that.

J

So I mean people at the meeting said that they had implemented it. So I guess people who have implemented it should be reporting whether it works for them. I, guess: yeah I, don't know exactly what the criterion is, but I'd.

C

Like to know that the major implementations have worked for it, I know for a while. We've did not I think they do now.

C

I would I would like to hear that the major you know three or four implementations have support for it before we GA that's my only real gate and the way I am and feedback from their users. I.

J

Guess four major implementations: we could go with the ones that are currently mentioned in the Cuban Eddie stocks as having network see support which we've in calico and something else, we've.

C

Calico Romana canto was Compton. One of those I feel like there are only three but.

J

Yeah, okay, I guess I can dan. You want to assign me to look into figuring this out sure.

H

One one thing so I heard that ball we will send a some something to the users requesting for comments. Can you also send about the network box egress some questions about the details: how to implement the network policy, not implementation themselves, but the battle policy I.

C

Think it's worthwhile. You know those two separate topics: cuz ingress is leaking engines. Okay,.

H

C

It seems reasonable if you want to send out a second one, to ask people about how they're doing with egrets policy, although to some sense, the lack of complaints is of ethan signal.

H

It can also means people are not trying this good.

B

I mean typically, you survey, you don't want to long, because the drop off will be quite severe when it gets beyond a certain number of questions.

K

A

All right last one, multiple pot IP addresses I mean that one's been around forever as well and as far as I know, nobody is actively working on that. Yet, but obviously we discussed it is kind of a dependency for ipv6.

A

F

All right there's a multiplicity here. One of them is needed for ipv6 yeah, correct.

A

To me, it doesn't seem like this will hit 110 unless.

C

Somebody's drive it right now, probably not yep,.

A

And that driving would have to happen in like the next three weeks, which seems like pretty short deadline. So for the moment proposal.

C

Has them I started on something that maybe I think I forgot to share with you I'll send out my notes on it if I didn't already send them out, but I don't have enough there to go for the implication in yeah.

F

Please do I send a reminder if you already sent it and I'll look at it. I'd like to maybe see we get this going all.

A

Right, there's also a pretty active discussion on the are not pretty active, but there is still active discussion on that issue. That's marked there in the dock. Okay,.

C

Yeah I swear, I wrote something up and I haven't, maybe I just didn't send it.

A

All right, well I'll, leave that one alone for target release status. If something shows up in the next few weeks, then we can change that if we need to I also think we should obviously skip multiple networks for the moment, since that's clearly not going to happen for a 110 release, yep exactly so, if nobody has anything else to discuss.

D

Yet, as I do I think the topology aware routine stuff is, and we can't keep a disguised thing, I mean sure.

C

Let it break it seems like you could go for alpha.

C

If we miss it, we miss it, but if we can hit it break mm-hmm.

B

All right stop, it will buy anyone, so you can edit it. You can add.

I

A

All right padded, it.

C

We here link your issue: there I just.

A

Pasted that in.

D

I

A

We will see everybody in two weeks in.

L

A