Kubernetes SIG Network, 5 Dec 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Network Policy API Meeting for 20221205

Description

Network Policy API Meeting for 20221205

A

Foreign hello, everyone today is Monday December, 5th 2022.. This is a meeting of the Sig Network policy, API subgroup to think Network. um This is the cncf certified meeting. So please be nice to each other. Try to limit the curse words and yeah. Let's have a good meeting today, so um just kind of hopping in something we hadn't done in a long time which issue triage.

A

um We used to do it all the time, but then issues kind of slowed down. So all that the issue triage is is basically I. Have the link in the document too, if I'm ever not. Here is query um kubernetes issues with the label Network policy, basically, uh thankfully there weren't any new ones. So that's good, nothing really for us to tackle. Yet uh it was kind of interesting, though, to see some old ones that have been open for like a long time um and I thought you know.

A

Maybe we could talk a little bit about it. I know, Raul is working on fqdn policies and I. Don't think he's here today, um but this one kind of had some good thoughts around that so I poked him in the agenda. Hopefully, he sees it if you're watching this recording our role um go, give it a look but yeah, if I'm ever not here or someone else, is running. The meeting feel free to run through these, it's nice for us as a subgroup to like try to help out Signet.

A

um However, we can, if there's like new issues and stuff cool. Yes, that was one thing I just wanted to add it on is.

B

That, like uh something that's, come up multiple times and then I guess it's just a continuous. Is it a debate or is there something we're going to do or is it kind of I'll.

A

Read the issue I guess so that issue actually isn't super. um It's a good question Ryan. So that issue isn't super current. The most up-to-date thing with like layer, 7 policies, more narrowed down really to fqdn policies um is something that Raul from Google has been working on for a while, and the current status of that work is is here, so you can go. Give that a read!

A

Oh! Hey! Roll! Can you hear us?

A

You might have already seen this too.

A

Oh, we can't hear you.

A

Well, hopefully he can hear me I. Think he'll hop on I was just saying: Raul I found a really old issue that had some discussion on fkdn from Thomas Graf, all the way back in 2018 so four years ago, I just wanted to make sure you had seen it um what else? What else so I've also I need to update this query to include any issues open against the network policy, API repo, um which I will do.

A

um Let me add a note to do that.

A

um On the network policy, API repo, someone opened an issue saying there are some broken links on the website. I wasn't able to reproduce it. So if someone else even during this meeting, could just click through these links and make sure they work for them as well, and uh if so, we can close it.

A

B

On there, that's for the registry thing so forth,.

A

Oh cool yeah, so I kind of I put this at the end of the agenda, but we can talk about it right now. um I'm fine with that.

A

So for folks who don't know, cyclonus is like a network policy conformance tool and engine that Matt Fenwick has written I had written a long time ago when they redid the Upstream Network policy test and we actually ported it to live in our Upstream repo um and our rough idea of what to do with it is to like extend it for admin Network policy and make it more just like a generic tool for conformance testing for both Network policy and air policy and also maybe a tool to help folks analyze what policies are doing in their cluster.

A

um So with that, we got the core recording done into our new repo, but Matt, who obviously made cyclonus, has opened up an issue saying like what's next for that tool right, we haven't really talked about it here, a lot um and thankfully Brian has offered to kind of help out with this. So this is the issue tracking the work.

A

um I think the first question from you um was kind of trying to decide where any items should live for this and it's.

B

A good question I know: Kate's is going through like a change with the registry too right, like I thought. I saw some issues a couple weeks ago on that I wasn't sure.

A

Yeah, it depends on what we want to release and if we want to start like releasing official versions for cyclonus like Matt was doing.

A

um If we're doing you know, if we're releasing just a container image, then this obviously matters more in my opinion, um but if we're trying to actually release like cyclonus binaries, um it becomes even more complicated for for the container image. You know if it was just me, I'd say: let's release um images to get the GitHub container registry, but I don't know if folks are using the that in kubernetes, six looks like they are.

B

A

So maybe we should start there.

B

At least those top four are getting decent downloads.

A

Yeah, a ton of downloads actually, which is interesting, is.

B

It all is that Twitter images or do you see any binaries.

A

These are just container images, I know. Well, actually I could be wrong yeah. These are just container numbers so so um get the GitHub container registry is like built in to GitHub now, and it's really nice, because it's pretty easy to like um automate, builds and actions and then push here which is cool um so for container images. This this would be a great tool. It seems, like folks, are using it in kubernetes six that was kind of my one reservation, um so I'm fine with using that.

A

As for like binaries and stuff, then I don't really know how it would work. We have to figure out releases in this project in general, because now we have a school that we're gonna have to release, which is going to be independent of like an API release, sort of schedule right um so.

C

Before and we used it but I'm, it's again, multi-networking and sort of, are we gonna by walking to the close Cyclone this way are we then sort of taking on upon us to do what happens with multi-networking updates the clonus? We don't sort of even know if it's uh suitable, for it I hope it is.

C

It should be because it's to a large extent works on the uh the uh the specs right they're, not the addresses I'm going to look more on the templates and so on, but uh that that's something I think we need to think about.

A

Yeah um I think the moment we have a API object that we're hosting here or that kubernetes is hosting around policy uh in the multi-network scenario. It'll become a priority, but it definitely I I. Think like the same thing will apply. Yeah.

C

But but personally I don't think we'll have a better place to start from that's mine right.

A

That's where I was too right like we, we talked a lot about tooling for admin, Network policy, but there wasn't really anything out there um and you know: Matt was had already kind of started this project and it's great so we figured we'd, take it over, um but just recycling a little bit Brian. Does that answer your question I think.

B

It does if you're, if you're a cni, maintainer and you're gonna, run performance tests, and you depend on cyclones to do that. Are they going to expect those images to exist in the case registry? Is that what they're getting anything else that they might be doing like? That was my only concern there was. Are we doing something weird by putting in a ghcr for say, a cni person that wants to run conformance.

D

A

Think for getting getting a bootstrapped, it's totally fine, because we can it's always we can always. You know once we get our release process figured out for cyclonus change to releasing in registry.katesio it's just harder to go the other way right. So I figure yeah. Let's start there um and then move forward, and you know I would start with just releasing container images and maybe just container images that are based on Main um and then we can move to towards like a natural release system if needed, right like right now, everything's still new and fresh.

A

B

Yeah, unless anybody complains about not having binaries, maybe we don't need to publish them.

A

It's a thought: I think we totally can with GitHub um if we need to with GitHub releases I've, just never played with using GitHub releases for like, like I wonder if we can do multiple releases for a single repo I'm sure we can. If.

D

It if, if it is just a gold program, just use some GitHub actions and go releaser and that's fine yeah, it's it's faster yeah cool.

A

Sweet um and then there's a bunch of other stuff here, too um Brian I, don't know if you want to tackle all this, or do you want to like split it up into smaller issues for people to take on um what? What do you feel like? Definitely a lot of stuff yeah, it seems to me like we can split up these main three goals into their own issues. uh Some of them are good. First issues.

B

A

Yeah 100 so I'd like to continue getting folks involved, um so anything that's a good first issue would be great. Will.

C

This we're on as a completely separate project with his own meeting. So we try to use part of this meeting to coordinate things or.

A

I think we can use this meeting because it is a you know, policy, tool, right and- and this meeting is kind of all around policy, so I don't think we need another one good.

A

uh What else cool yeah so for anyone watching and sorry? What's going on yang.

E

Hey hey Andrew, um yeah I was just having tried to ask a quick, maybe dumb question on: what's the difference between the um engine and conformance Suite for AMPM, be an amp listed here like like what do you have in mind, Matt for for those um goals.

A

Well, Matt's, not here but I, don't think.

D

A

Brian, do you have any input on that.

B

um I'm not sure I understood the question. Sorry.

E

Oh no worries uh I was just saying that to because uh right here, I listed, a bunch of you know, goals right. So one of them says engine and we have, you know, feature for A and P and pamp here and the other is the conformance suite I'm. Just trying to understand you know. What's what's.

B

For each of them, yeah yeah, um so Matt and I did a an entree alive um the other week, and we started talking about how to get Cyclones to support A and P and basically, what it came down to was. We need to First, extend the cyclonus engine to be able to support and work with A and P and Vamp, and then once we have the support built in, we can start writing conformance Suite tests into cyclonus um as a as base policy tests.

E

Okay, okay sounds good, now, I get it so so uh I I probably needed a like a refresher on cyclones, because I haven't looked look into that for a while. So.

B

We just recorded a refresher, so it's in the Google Doc I just threw it on there, for you sounds.

E

Good sounds good, but but a quick question is you know for the normal kubernetes Network policy right now, um so the Cyclones work uh for the for the conformance suite. Does it work? As you know, you bring up a bunch of namespaces apart and you know you run tests through them and is that like a three three namespace three parts in each that kind of thing or uh it's usually, um you know on demand namespaces apart for each specific test case.

B

I think I'm I'm, still not a psychonist master, so I might be wrong, but I think you can write your own set of network policies and then use cyclonus to run conformance against those after you've applied them into the environment, or you can use cyclonus to run against a vanilla cluster with any cni and verify vanilla. Network policies are running and meeting performance within that environment, but I think you can also write your own policies and simulate them and then get back like a truth.

B

Table result based on how how that went like to your point like if you have three namespaces put a.

E

Policy in there.

B

And see what happens and if it meets what you're expecting? Okay.

E

Yeah I probably needed to look at specific conformance tests, because I I know that you know before um am pmbanp. A lot of tests are uh written. As you know, you have a specific environment where you have you know three namespaces reposit in each and then we have a choose table sort of thing and we applied Network policy just to see if the truth table holds for that now policy. If yes, then we know that now policy is correctly enforced.

E

Now, what I'm seeing is say seeing here is that for ampmb amp, because we have the um you know more advanced selection mechanism. We have the the same labels same namespace and stuff.

E

Maybe we needed to extend the number of namespaces apart deployed for us to sort of like correctly test that, because right now you will need to have at least a bunch of names, basically the same labels and a bunch of namespace with another solar standard labels and do some um same label amps and figure out that now, yes, you know the the namespace with the same labels are talking to each other, but not across. You know the the label boundary basically and that basically is not possible. If we just have a static.

E

You know three namespaces three passing each cell up to test with, so so for for the amp and bamp test weeks to be complete and we probably needed a little bit more um more pods or namespaces in the infrastructure for us to correctly test it.

B

Possibly or your running those as different scenarios, so you might scaffold a standard, Network policy test with that three namespaces three pods and then, when you're finished with that, you maybe make some changes to that environment and then do an A P test within and then you could do say a p test on just three namespaces yeah.

F

Exactly exactly parallels.

B

And yeah, you might need more.

E

Yeah, so this is just a sub if I don't know, if uh Andrew, you you're um your understanding, what I'm saying.

A

A little bit to be honest with you, I, haven't put a ton of time into you this. Yet that's why I'm super thankful that Brian is here helping. um So let me, let me think about it. Some more I need to go back and watch the cyclonus Andrea live session. That y'all.

E

Did me too, super excited, y'all I have a I have a conflict last week, so I I think it's the week before. It's also something I have accomplished so I couldn't attend it, but yeah I definitely need to catch up with that. I.

B

Basically sat down with Matt and I asked a bunch of really stupid questions and I got a bunch of info.

A

Yeah there are no stupid questions by the way. That's that's awesome. um That's what we need, so it's good we're kind of getting started here because there was just not no one doing it cool um any other thing on this issue that we need to talk about today. Or do you want to take over splitting into other issues? Brian or do you want me to do it? I really don't mind. I can do.

B

It later I think I can oh no yeah I can file issues, never mind yeah.

D

B

A

B

One but yeah.

A

Yeah, well, once you open, new ones, feel free to just close this or ask for it to be closed and I can close it. Okay,.

B

Yeah I got added to the Sig I didn't request owner or whatever here.

A

Yeah yeah sure.

B

What you wanted me to do there.

A

Yeah no worries keep on working and then you know maybe we'll get some more owners.

A

That's awesome, cool okay, so it talked about those issues. I already got an LG TM on this I was writing another operator for open or a totally separate operator from scratch and I realized that our crds were being generated incorrectly. They were not being generated. The cluster scope, so I think this is well Yang. You just have to give a lgtm and an approved, but.

D

E

Just basically, click to approve I I, don't know. If uh let me let me look at it again,.

A

It's just proud: you have to give the dash dash LG TM on that one, um but basically all this stuff yeah. It's no worries all this does for folks who are interested is Cube Builder like looks at our API definitions and generates all the crds form automatically. So all we need to do is add a single cue, Builder tag to make sure this was cluster. Scoped really easy. um But if you haven't looked at Cube builders kind of interesting to check out.

E

Cool yeah there's also a bunch of other tags like if you can, you can Define what the plural or short shortened name of the resource is also I. Think.

A

Yep and a ton of like validation, stuff, um as you can see here, which we do, which is cool and it's all kind of built in which is awesome awesome. Ultimately, it gets distilled down into like open, API V3, which allows you to express things like this. So and it's really important with admin hour policy, because we have some complicated Like rules so nice to use that.

F

A

F

And P and b-a and P ASR little short forms.

A

It's a great question: I, don't think I did um when I was doing. This I was learning it all for the first time, so I probably missed. That um sounds like we need an issue for it. I'm, not sure. To be honest with you fair enough.

F

I I can follow one um yeah.

E

um I could do that too, but if you want to take it also, um I'll be also happy to end too, but uh there's also some other things that might be really used for. um uh In terms of this tags. I, remember, there's um you can define printer columns there like like. When people do uh Coupe cuddle gets amp, you can Define what columns are there like uh like Time created?

E

You know um the first priority stuff will be a nice thing to have when, uh when it's printed out, so you can actually Define those things. um I I think we needed to look at. You know what are um the use for things that should be printed out and we should put it in there.

D

E

I I've I think. Is it going to be the cni who handles the logic of what gets printed there or I I it's and maybe can be built into into the API level. I think.

F

I yeah I mean I. The only thing that I know Cube Builder doesn't handle super. Well is selectors like if you try to tell cute Builder to print out selectors um like today, the network policy, Cube cuddle thing is handled by a custom. Printer tries to the formats it sensibly.

F

um If you use Cube Builder to dump selectors it, it dumps the Json, which is rather unwieldy. So.

E

Yeah but but the power of these should be easy right, because it's just a thought: spec dot priority, so yeah.

F

Anything's super simple, any you know simple Primitives. It can handle foreign.

A

I didn't know about that: I'll have to check it out, um feel free either of you all to open an issue for that that'd be great.

A

um Definitely we probably need to build a tag audit to be honest with you, um so.

D

A

Okay, awesome, that's all that's on the agenda. I was there actually was something that I remembered. While we were talking just now. um If no one has anything else.

B

I think I covered the cyclonus stuff, another one so extend engine and then once we're happy with engines extension to support the AP and BMP, then we'll start working on the conformance, Suites, yeah and.

D

B

Really sick last week, so I'm gonna spend some serious time on it tomorrow. Absolutely.

A

Oh I'm, sorry, you didn't weren't feeling well, it seems like you're back better.

B

Feeling better.

A

Cool so last week, I was poking around at some Legacy stuff and I had looked at this a long time ago, um but it's basically psyllium's like deep dive into Network policy, and it includes like this really long, uh YouTube video about how Network policy was created. Dan actually is in it with like Thomas Graf and some other folks, and it lead led me back to this website. Basically, this I think was a marketing Point too um put forward.

A

Psyllium's Network policy, editor, which you know this site, is open source, but the network policy editor is not um which is kind of interesting, um but it got me.

A

Thinking like this could be another good set of resources to kind of bring back into this core sigs Community um I I wanted to reach out to Thomas Graf and tell them folks to see like what they would think about um moving some of it back and maybe deprecating this website, because you know the the URL is literally Network policy.io and it's kind of a downstream website in an upstream fashion.

A

um So just something to think about.

B

Thinking like to make a open source editor or just more than site, being a home page for something, that's not open source. That's the problem right.

A

I kind of both I mean it'd, be really great if we talked to the civilian folks- and they said yeah here, we'll open source. This editor um that could be cool um because, obviously like I, don't want our website and kubernetes to be pointing to something: that's not open source like there's, no way that ever happens, so we couldn't just assume this website, as is, but it does definitely has some nice um videos and resources. What sort.

C

Of I'm at the other week, someone else that talked to send something out of a network policy and I cannot remember. I can go back and look through.

A

uh Maybe yeah, maybe I'm not sure yeah I.

C

Know um I'll have to see if I forward that to someone I guess no, it was through all the emails, something that I reacted on. But I cannot remember exactly what I'll dig.

G

Maybe, as a as a new person in this uh Sig call um just to chime in on this one, um you know we're building a tool for that automates Network policies- and you know, obviously we found this website very quickly. It looked to us very uh official in some sense, like a very.

A

G

Normal way that if you want to know more about Network policies, which is a part of kubernetes, you go here and they were like. Oh, this is a super cool tool. Let's go play with it and then we realized yeah. As you said, wait a minute. This is a library tool and I'm I'm, just wondering maybe three.

G

The thing to press upon is that it can't look like both it's either this or that and either this thing goes towards a kind of a this is a psyllium introduction to network policies or there is a network policy page which would be awesome because, frankly, we find a ton of people very confused by that, and it needs to adhere to the guidelines of these must not be proprietary tools.

A

Yeah, that's a good we're stoked to have you Yuri um thanks for coming and, and that's a really really good point.

A

um It's that's that that's that was kind of what I was trying to get across like it's confusing, um so I'm gonna try to reach out to Liz from Liz rice from psyllium and Thomas Graf and see like what they think about how we could like I. Don't want to be like shut this website down. I more want to be like how can we absorb some of these resources into our website um and you know maybe they're willing to open source. The editor now that'd be even cooler right, um yeah.

B

So I'll add that in front of cyclonus.

A

Yeah, exactly that's kind of you know, I'm thinking we're almost there with cyclonus. Like does a lot of the logic work, um who's gonna react. Okay, you.

B

Know put an API in front of the simulator and pretty.

A

Much 100 so um I'll add this to my list. However, the first thing I want to do before I reach out to that is I still have the issue of to kind of make our website more generic right. We want to be describing all of kubernetes policy apis, not just the admin or policy API and I've had an outstanding issue to do that. um I haven't been able to get to it. So if folks are listening to this call and want to tackle it, please go do it.

C

I was mixing it up with Monaco, whatever it's called. Oh cool, okay,.

D

A

Okay, is there anything else folks want to talk about today? Any other questions comments, concerns foreign.

E

Just a gentle reminder to you know.

A

Review your PR yeah. It's literally been on my short list, a couple weeks grinding towards the end of Q4 and trying to get my Downstream and it's done before then. So I am very sorry. I promise I will do it.

E

No problem at all I mean I'm also busy with a lot of other things recently, but I think we have released cut off by December the 16th so in between six things and Christmas. I do feel like there's gonna, be ton of free time for me. So I'll definitely, you know spend more time. Looking at The, Amp, related stuff, I guess.

A

Awesome yeah. Thank you. I appreciate it and I'll put a link to that PR here in a second um for folks who want to review it for a kind of a back story. The cap originally emerged a long time ago. Then we worked on the API and got it merged, and now Yang has gone back and has a PR update to cap with like what actually emerged in the API design side of things, because it changed a little bit. So it's good.

A

It's just good practice to keep that cap updated um and it's even weirder for us, because we don't adhere to kubernetes release guidelines like we're just a crd, um but it's it's definitely a good practice to keep that updated and speaking of releases. That's something you know. As we start getting, implementations done for amp like we're. Gonna have to start thinking about a uh some release: infrastructure for the API itself, and um hopefully I can make an issue for that.

G

Can I raise one other thing that may seem because it is a very much a newbie question, but since I've got the experts here, no.

A

G

For it Yuri, so um you know in in the rolling out of of this tool which, by the way, is open source um we're thinking to ourselves. You know, Network policies are an interesting thing because, as you say there, there are crd they're, an object that exists. Whether or not anybody pays attention to it. You have a network policy, but you don't know that anybody's enforcing it.

G

Obviously, there's got to be a cni that supports Network policies that enforces it and so on is there or has there been some thought towards implementing some way of uh the cluster, knowing that somebody's actually enforcing Network policies, so.

A

First, you know that first thing: Network policy itself isn't a crd. It's a core API. um The admin Network policy we've been talking about a lot in this meeting is a crd. So so it's we we did that just so that we could iterate a little bit faster. um It's a good question. There is a status field now in network policy. Now the issue with that is I, don't think anyone any cni has implemented it. Yet maybe Ricardo.

E

A

E

uh Sorry to sorry to interrupt I just wanted to share a little bit my thought here. If I understand this question correctly- um or you probably are talking about something in the lines of I'm- probably a app developer right, so I wanted to know. That is if I wanted to talk to some other namespaces. Is there going to be now a part of c um blocking that or you know restricting me to do that- is that what your question is more about? Certainly,.

G

One of the use cases right so we're creating the code that automatically creates Network policies. Yes based upon sort of client intents, but our big thing is that we can say great. You know this network policy was created and if it were enforced, the following would be allowed and the following would not be allowed, but we don't know if it's being enforced by anything.

E

Oh okay, so yeah that that's more of uh that's more of a status thing. Yes,.

A

Right and I linked the cap to that um great I think that'd be good to check out I, don't know what cni are using, but you could ask them to possibly implement this and you know. Maybe we need to think about I, don't know what status defaults to it defaults to nothing like an empty list of conditions, um but maybe someday in Upstream. We need to have the logic that says: unless the implementations explicitly write like implemented, then it defaults to unimplemented or something I. Don't know how that would work, but.

C

It and then, if a Sunday had a control plane right that would update to something, then it would be possible for the system itself to come to conclude if the backends that are implemented actually fulfills, something like cyclonus test or someone and because then you could let the platform test itself.

C

Let's see if the implementations fulfilled, but I mean we're far from there. Yeah.

A

Unfortunately, we're far from there um I agree with you, but that's a really it's a good point. It's it's a good question and you know it's.

C

Interesting saying that you implement something and that you really do with this, not always the.

B

Same thinking like a cni would import a cyclonus go package and then build that into their verification process on install that's kind of interesting yeah.

C

But with multi-network and multi-c and I don't even want to think about it. Yes,.

E

That's uh that's an interesting thought, but you know for the users. Actually it probably also gonna be a little bit weird, because once you install a CNN in order to verify that use inside Corners people will probably see that a bunch of namespace that art just came up and then you know running some tests under the hood. People are probably gonna figure out on you know. What's going on, you know. So that's that's also something to think about.

E

You know unless I would say that it's probably better if people explicited to say that hey I haven't, saw the cni I want to do like a sanity run. Yeah.

B

Or you're, just installing a cni, that's on a stable branch of that cni, which means it's past conformance at that point, yeah.

G

B

G

Purposes we from what we heard from users, it's good enough, if the thing kind of self-reports- it's just that right now, the hack we would have to do is we'd have to install a couple of PODS, create a network policy cuss that it's actually enforced and delete those Bots extremely hacky.

A

Yeah there's something there there's also another. There was another issue and I can't find it right now. I will go find it. um There is a kind of proposal within an issue to add an enforcing flag to network policy, um so that could could be used as more of an explicit same way right. You could just make a network policy with enforcing set to false.

C

A

But I will find that and Link it.

A

Yeah no good to have you Ori, and you know it's interesting I've, seen a lot of folks kind of doing. In the same, the same thing y'all are trying to do because, in my opinion, it shows that Network policy is hard to explicitly illustrate a lot of intents. So you always end up having a shim that is creating Network policy right or an engine.

A

So we're hoping if you, if you get some time, definitely check out our admin, Network policy and let us know if we missed anything um because we're still early in the cycle and we're hoping that it's a little bit easier to use straight natively and.

G

That was a major driver for me to join here, because I wanted to learn more about this I. Think there's, there's sort of you know, sort of what the admins are trying to do in general, which is kind of enforce.

D

G

Governance and so on, and then there's what the app developers are trying to do, which is just to make the right things work and like how do those meet right? Do we have to monitor for drift, or is there some official way to say you know this is where the intent of the developer meets the governance of the admin yeah.

A

That sounds like the admin Network policy API so definitely go check it out. We'll.

C

Do thank you, wait, there's a lot of cool things that could be done. One is like, let's say they will say central control system. They calculated everything and he you can do a lot of cool things with uh things like srv6 and metadata, so you could actually have something that pretends to be a pod, sending traffic through and see. If it gets caught right you will, you would tell the firewall, on the other side, never forward this to the actual pod right. Yes, return result.

C

What's this forwarded or not so there's a lot of cool toolkits that can be made to to check that this actually works in in reality for a given CNA, um that's at least where we're going so we will be able to calculate the full graph and say what can talk to what and then run it and compare that to psychologist results and also actually test an all combination to see if it fulfills the requirements by having actual traffic being sent to any of the pods, but telling the connection tracker on the source to to not forward that report.

C

Yes, send back the uh the result. Compare.

G

What what when you say, we are doing.

C

On my company, what I was going to work with that's what we and parts of it uh my dream and goal is to be able to give away an open source of complete control, plane that eats up the policies and can also be made very easily to handle more policy types and then the laborers call it a logical firewall API where you would plug in backends to and then you do, your implementation of your firewall.

C

The way you want to, but kubernetes should have something um call it the other end of the cyclonus one one implementation, not similar implementation. That calculates if things can communicate. Yes,.

G

Awesome I'm, gonna, I'll ping you and get more information directly, maybe you're on slack I would assume.

A

Yeah, he is I, think I think he had to take a call yeah all right, awesome, cool awesome! Well, thanks! So much folks. If there's nothing else going on going twice sold um good meeting today, pretty constructive uh thanks for the time and thanks for coming I hope you all all have a really good rest of the week and well I. Think we'll see you next time, I gotta! Look at when what date the next meeting falls on, because if it's in the Christmas holiday, we might cancel.

C

A

Just be aware,.

C

It should be on the 19th right, so that's before Christmas.

A

Yeah so we'll probably have that meeting so it might just be quiet, cool, okay, thanks y'all.

D