Kubernetes SIG Network, 21 Jul 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Network Bi-Weekly Meeting for 20220721

Description

Kubernetes SIG Network Bi-Weekly Meeting for 20220721

A

Cool this is a sig network meeting for july 21st 2022.

A

um Let's start off with some triage as per usual uh dan. Do you still have them up, since you were looking at them, yep.

B

I can share.

A

B

Can you see my screen? Yes, yes, all right, okay, so worker node not showing external dns address. um I don't. This is more of a support issue. I tried to respond to this one.

B

I think they need some external configuration for aws. If that's what they're, using otherwise other cloud support or cloud provider support, we don't usually do support issues so like what do we want to keep this one open for a little bit and see if it gets resolved by next meeting or close it out.

A

I would usually do my best to answer and then close it and just let them know that doesn't look like an issue in kubernetes and that's why I'm closing it.

B

Okay, well I'll I'll, assign myself leave it open um for a little bit and then close. It.

B

B

So this one is a little bit older. We probably covered it last meeting um and it's kind of in the same boat. It's uh more of a support thing. I don't think it has much to do with cube at this point, so leave that one open too.

A

Probably free market has support and yeah accepted.

B

All right and sorry, this one how to set multiple node port ranges. I don't believe that we support this. Yet at this point, um because service node port range only takes a single range as far as I can tell so, this one would need some kind of pr or enhancement.

B

Does anybody? Is anybody thinking about doing this or working on it at this time?.

C

D

Don't think that you have to change the the allocator. I have a kept to change the locator for the ip addresses, and if that works it can be expanded for the node ports. But I don't see this.

C

But I mean what they're talking about you know. I want to export port 80 as a node port. Like I, I don't think that you know we I'm not sure.

A

No, it seems more like they're.

C

Trying to use the feature incorrectly.

D

ah So what they want to do is to say I want to support from thirty thousand two thirty two, like I mean they want to affirm services, to define the rights.

B

Yeah they want to range, but then they also want other things outside that range.

A

I mean I agree with dan, though yeah win chip as well like it sounds like they're, maybe not understanding what to use node ports for.

B

So I'm going to sign it to dan since he touched it and he can respond.

B

And say: you're holding it wrong.

B

All right mark net ipv4, ip local reserve ports as a safe, cisco.

C

This is not a kubernetes thing. I don't think this is like a.

D

I think that there was a group tagging these these things.

D

I don't know I have to check.

C

Like kubernetes doesn't provide any way to set cisco's per pod, this is a cni plug-in thing.

C

Possibly an open shift, specific thing.

E

Should we ask which platform they're asking this yeah.

C

You can design this one to me too jen if you want. Okay, thanks.

E

I think the node team does maintain a list of safe systems.

D

Yeah, that's that's. The thing is to know them. No, I think that in some place there is at least with this cisco yeah.

C

E

Two different ways.

C

Of of setting them, then, because.

E

One of them.

C

Is certainly via a cni plugin, but maybe there's another way.

B

Let's find out.

C

Well, he's saying that this one isn't in whatever right right, yeah, so.

B

Okay, so it there is a list, it exists, it's still assigned to you dan, um so you can wait. No, not a sign who who wants to take this? Who wants to follow up on this one.

E

Should we tag it with sig node by the way sure, okay.

D

I think it's a keyboard but assigned to me. I remember I don't know, I don't know if someone setting this this is called for the being for those things. I I just need to to find this.

B

All right next, common labels versus pod labels, error in casting and then pod selector match labels, network policy.

C

They clearly know what they're talking about and are not explaining it well at all.

D

I think that they are trying to use customize for generating something and did not work.

D

Album can be that of maybe 200 different things.

D

I can follow up.

D

A

I don't think we mark it as accepted at this point.

D

Yeah yeah, it's just to do the asking the questions. You're.

B

D

B

Okay, um so that leaves us with. Let's see, multiple node ranges we handled handled those, I didn't see any updates for the flaky test feature external traffic policy.

B

um Maybe it's worth taking the last couple minutes to just see what the status is on these, which one is that so this is flaky test, feature external traffic policy and you last commented 22 days ago.

D

It's before vacations, I don't remember the password, so I'm not.

B

Yeah- and I think we said- let's wait for tim, but he's not here this week so.

D

I know what happened, I know what happened and I think the person has uh uh appear so when you have a an old port, the test allocates one randomly, but the test has one heart called not porn, so eventually the the random part hits the they assign it in the test. uh Statically and it plays, but I mean the logic to change. The logic is very common.

D

Okay, I think that let's wait 14, he he changed all this logic and.

B

So is it valid, should we accept it.

D

Yeah it's funny the the back is that okay.

B

B

And topology aware hint does not consider node taints last comment from dan winship.

D

This is the one with the.

D

Topology, uh how to.

E

D

F

Yeah I've been involved in this thread too. I think it's being handled there's some. This is almost a feature request. The I should follow up. I think I think, because the the idea of nodetames is something that we are intentionally ignoring, because we we just can't uh we can't scalably do that.

F

It means tracking number of nodes ratio of nodes, etcetera per service instead of per cluster.

F

Yeah assign it to me anyways, I think I'm already assigned yeah.

B

F

B

F

C

F

I mean the statement's true, so yeah we can accept it. I don't know that we're going to be able to fix it. Okay,.

B

Well and that's fine, like you know, we've triaged this issue, um you know we there's been a lot of discussion and I guess once we figure out whether we'll fix it or not, then we can make that termination and close.

B

All right and last one for today, two default storage classes should be handled better.

B

Last one was tim. I think we can just leave this with tim.

A

Should it be accepted.

D

A

It probably yeah like there's a pr open for it.

D

A

D

They fixed the one of the ingress class and it's missing the other one.

D

Okay, so this is missing the the signature one is fixed, so we can remove the network from that.

D

Now is waiting for a storage.

B

Let's remove sig right, that's the key! Okay and yep. Okay!

B

Well, we'll just remove sig network. They can figure out. Other cigs can figure out if they want to accept it or not.

B

All right and out of time back to you, casey.

A

Cool thanks dan um looks like the next item is just a reminder that the 125 code freezes in two weeks on august 2nd.

A

So if you're working on code keep that date in mind, um I don't know if I've ever put that on wanted to say anything else about it.

A

But I will assume not um and then after that was antonio.

D

Yeah we need to thank ricardo for his espanol containers. uh I've tested the pr the vr I I had to fight with the promotion machinery, but now I have a pr and it's working. If rob and the other person, I don't know that, tested the image and checked the abilities or anybody else want to test the image.

D

Yes comment on the vr. If not, we should. I think that we should merge before code freeze, so this is start to solve and because, once we cut, I think that in openshift they are going to to get the the images. uh I don't know if we have to do more steps, but the point is: if we want to move in this release with this image, we should start testing as soon as possible.

D

But the the pr is ready so anything nothing else. Almost.

D

We can move to the next point. Okay,.

A

uh Yeah, definitely thanks to you and also ricardo for working on that.

A

um I think the next was lara lorenz.

G

Hello, can you hear me great? um I wanted to give a little um info of something that's going on in sig multi-cluster, which is the sig I'm most memory of.

G

So I'm going to share my screen because I did bring a few slides, but um I think uh possibly many people in this call know about this project already either because they've come to sig mc. I have come here and talked about it a little bit in connection to the mcs api, which is the sigmc project and also went to cluster api a while ago, which has some overlap here, but I'm going to recite a little bit here for sig network and kind of put it on the record.

G

The uh and hopefully everyone can see my screen. um But basically I just want to share some information about um this about api project and particularly that the crd, which is the way it's implemented, is currently in alpha and then ask or just socialize a little bit um any potential use cases that sig network or its related projects might want to collaborate on. If that is relevant and just make myself available as a point of contact for that.

G

um So just the brief uh background is um there's this cap2149 for sig multi-cluster. That describes this about api, um which is also available um in alpha kubernetes six slash about api, and the point of this is to be a cluster scoped cluster property crd. That just has like key value pairs of arbitrary properties about a cluster, and the idea is to make information about a cluster discoverable from like one central place and make the cluster sort of self-aware.

G

So I think historically, uh things like this may have been achieved through, like annotations on like node objects or like some sort of like custom cluster object, but like specific to a certain api like the cluster lifecycle apis. um But this is trying to go for something: that's a little bit um more uh abstract um and potentially more general purpose, even though we did come up with it at sig mc for a specific purpose, so um we described it for for the purposes of the mcs api.

G

We have these two uh crs that have well-known names that have to follow some certain properties so that they're useful um to us in that context, and so you can definitely um click through the cap. If you want to know all the details about that, but there's one for a cluster's name and there's one for a clusters: cluster set membership, which is the unit of clusters working together in a multi-cluster world small little asterisk. It so happens that we want to rename the one previously known as idk studio.

G

So if you like to give your feelings about names of things, there's a survey link at the bottom. So you can, you know, make your opinions known. So this is uh like some background about this project and why uh sigmc specifically the mcs api needed it, um but the crd itself is very general purpose.

G

Its names and values that value can take any form and again, the overall intent of the crd is to store any arbitrary properties um about a cluster that, in this cluster, local crd and there's room in the cap, that other implementations or just anybody else could uh store any other arbitrary properties they want as long as they follow. Some follow some restrictions, which is basically not to conflict with the ones already reserved, have to use some sort of suffix and can't use the reserved case.

G

I o or kubernetes io suffixes, unless it goes through like api review and everything. So some ideas, uh just generally that are part of the cap, are like. If some cool implementation has some sort of like special fingerprint thing, they could store some like arbitrary json or if you wanted to store like the network name of the cluster, for your mcs implementation.

G

Maybe you could suffix that, um but then this kind of leads into, like maybe there's some stuff, that, like six or sig uh subprojects, might want to store here and maybe even make them well-known names that like follow this kubernetes suffix. Can you.

E

um Give sorry hey laura, um can you give some insight as to what, when a project should put it here versus creating a singleton crd.

G

Yeah, I mean I think that is uh probably still to be determined. What the best practice is, I think, there's a lot of heritage of making singleton uh crds and also to put sora mentioned before annotations on, like node objects and just go and find find a way to go, find them.

G

So I think this roadshow is kind of to gauge some interest. We definitely needed this for mcs somewhere and we chose to go this way and we want it to be generally useful so that other properties are all in the same place. So we don't have to keep running around to like different implementations, but I'm not sure I have the clout yet to say like this is the case where you use this, and you know this is the case where you use that.

E

Yeah, it would be good, I'm sure, you're going to cover it in the cap to kind of describe how to make that choice, at least for implementers sure.

G

um Okay, so this is the that's kind of the general situation. I do think. uh Maybe I can uh put together in the cap some more thoughts about why um putting your arbitrary properties here instead of an annotation or in a singleton, can be covered, but just some brief thoughts of maybe what sig network might have some jurisdiction over and want to store somewhere, though you all are. Definitely the experts so like ignore me if I'm wrong, um but there's just some ideas brought up um within sigmulti cluster.

G

That may be something about the cider ranges of different other objects.

G

If this is kind of based off of someone who had experience where someone wanted to pull all the inventory of a node, sider and pod cider, so they could analyze it holistically, maybe something about cluster project ideas or regions, though those could be too implementation specific, unless there is some way that this, uh a general standard that this information should be here, might be useful to any sig.

G

And then cluster vpcs is kind of in the same category um and this uh kind of was also inspired because there was some talk about trying to represent a network name or at least a default network name um in the this cluster property in the about api um as a cluster property for use in multi-network mcs scenarios um and there's some pr history about that too. But we got a little stymied thinking about the multi-network case.

G

So these are just some ideas from us uh happy to take a note from anybody here. If there's something this is making you think of that. Some sort of uh you know property that any of your code has needed that you, you know, smash an annotation somewhere, but might put here and I'll happily take a note to follow up or again just making myself available as a point of contact, uh you can dm me or find me in the sig multi-cluster slack channel.

A

Cool thanks, laura anybody. Have any questions or comments for laura.

H

uh Just a quick thought I mean just generally for the network team. I mean good things like the name of the cni plug-in, be a being used in that cluster, be a useful property to make available.

A

I mean there's, there's not a standard way today to see what uh what your cluster is running through the api, so um not a common thing, but I certainly see people have no idea what they're using and like come to me for help with something that's not calico, for example, but- uh and I know that on the calico side, we have long since used our own crd for purposes similar to this. So if this had existed, we might have used this instead.

A

And so that was our last agenda item and if there are no more questions and no other topics, then we can call it half an hour early.

A

That sounds like it's up, so thanks everybody for coming, see you in a couple weeks.

A

I forget about code, freeze.