Kubernetes SIG Network, 2 May 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Network 2019-05-02

Description

May 5th, 2019 SIG network meeting

A

And we're recording today is the May, 2nd 2019.

A

B

See I think your gain is turned down or something.

A

Somebody going to do a bug triage, yes,.

C

Hon, let me share my screen.

C

Ok guys see it.

D

Yes, look at all those dr. Katz.

C

Alright, let's get started first, one two days ago, IP vs mode unable to update you proxy 1.15.

C

Before we start can people.

D

Put the date in in zoom if they're willing to take at least one issue chat in the chat yeah. That way, if, if nobody's taking a specific issue, we'll just assign somebody from that list, awesome then.

C

This pressure, no.

E

Pressure but we're not asking for too much just just look at it and.

D

E

Awesome cool we've got a whole bunch of people signing up already cool and Andrew says you can assign IP vs ones to me. So: ok, ok, cool.

C

All right, let me yeah assign it dude.

C

All right, ok, so next one IP tables restore failed. Applying rules.

B

Cool, probably not actually armed 64 related. Yes,.

E

Probably not I.

B

Can like this danwon shoot? Okay.

C

Okay, thank you. Dan. Next, one set the service Note one two, six, four, four three: it causes the cluster to not work properly.

C

um I thought we limited the note four to thirty k, plus.

E

First of all is six four four, three special did we use it for something else that might like. We shouldn't be in conflict. It should be nothing. That's really in conflict here.

E

D

Four four three I mean it's conspicuously.

E

Four four: three yeah something with a.

F

E

F

Set six four, four: three: oh okay, alright.

C

So who's that can I decided to use or to respond.

F

It allows me and just like him, okay, thank you.

C

All right, cool thanks well and the same name spaced apart, that cue koto, can get fabric, cannot get what.

E

Does it mean by the fabric not a lot of information there? Oh.

C

He provided some more information.

G

What's Fabrice is fabric like an aks thing, what fabric was got a service, mushy sort of thing, that region.

H

That's called service fabric yeah fabric and.

E

Then something different, ah this.

H

Is something different? That's close well.

D

It looks like a problem with fabric.

E

Whatever I think.

D

E

Right volunteer to follow up on this, just even get a little at one phone. It could put me down. Okay,.

I

D

Meeting theoretical.

E

Famous last words.

D

E

D

John, it's just my first certain on my first name: okay,.

I

C

All right: it's the copepod connect service, low.

I

C

Familiar any movement.

J

No right, no yeah I asked for some more information and got no response. Okay, okay. Let's.

I

Let's close it two weeks: yeah yeah, okay, I.

E

Get time for this two weeks.

C

Okay, thanks Mike unidirectional UDP traffic. No, no poor, sir, is not handled properly. Oh.

D

This one last time, buddy yeah,.

K

I tried to recreate it and fail to do so on the first attempt and I also asked for some more information. Okay, wait.

C

Turns I scroll down move on yeah.

E

Okay, you know, let's give it one more cycle: okay,.

E

Email, this I think I know this. When did I respond, this one? Yes, yeah, yeah.

C

I see so it's a configuration problem. It's.

E

The problem is for very large, so we scale Q proxies contract requests by the number of cores in the machine, which seems roughly appropriate for very large machine. That's going to be a very large kernel allocation which, if the colonel can't allocated in the fast path that will fall back on the v-mail and we'll complain about it along the way, and the question here is: can we do better than that.

E

Open to anybody, who's got feedback on how and.

D

What to do better, otherwise do we care much some contract entries, the only we do, because it's a Linux, that's like not it we'd have to be exposing like with node yeah.

E

I mean order or something we could expose it through Q proxy, like you could just pure out. If you look at the number country.

J

Would do we need to or just something else already do that I, don't.

E

Think anything is already exposing that it.

A

Might be right.

E

This one's assigned to me right so I'll follow up and see if it's being monitored anywhere and if not, it seems like it relatively easy one to add. At least we have some data yeah good.

D

It's a heuristic, no matter what right.

E

That KC somebody was loud. What I don't know is what happens if you dynamically change those numbers, while there are active entries, does it like the entries? Does it copy them over like how bad would it be if I adjusted, that number say once an hour once a minute? It's a good question right. So.

H

E

Up in this one, this is a good one, actually yeah. Let's leave it leave it on triage for now. Okay,.

I

So I think I saw its callicles. You know.

I

C

Right to proxy conflicts, no name in a host names. I get responded to this one. You scroll.

E

Close as far as I know, we have a mechanism, it's not the prettiest thing in the world. It works.

C

Wow IP tables say cause kernel, panic periodically.

F

Didn't we talk about this one last time.

E

B

I

What happened Oh.

C

J

E

Go ahead and assign this one to me: I love Billy with the other one. If it's female like, if not all you can see, then get some colonel cool.

C

Okay, next one Oh bouncer pipe service must use no board. It looks like a feature request.

C

Right now, if you get a little balance of type service, you get an important right by default. Yeah, that's just API I.

E

Think the answer is you can't disable it there? This is the design.

E

You, instead of doing it here, assigned to me off those okay.

C

All right services, the external IP, should honor external.

C

L

C

External traffic policy applies to low balance of type service and no ports, not external I piece.

C

Looks like a valid.

E

Feature interesting.

C

E

Yeah, that seems legitimate.

C

Okay, can you so then it's triage is triage. It becomes a feature, okay feature or bug, actually I'm, not sure which.

E

One it is, but like cluster IP doesn't support the cluster IP doesn't but external eyepiece feels, like you know, given.

H

That it says external.

E

E

Probably weird like nobody needs to sign up for doing the work right now. This is just odd.

C

E

That's we already tree I, acknowledge it. It's legit and.

C

Extra, my piece should not allow duplication. You know, I, didn't you fix that lets. You fix that like last year, not no I think some.

F

C

Think it's ipv6 right that you fix Oh.

F

H

C

H

C

6 m v4, probably just an validation just.

E

So ok seems like a legit. Oh.

C

Okay, so it's triage.

C

G

All right, real, quick on that note, the thing that was fixed does that actually prevent where it is it is it just for logging errors, because I had a similar bug open and from what I found it seemed like for external IP? Is it just logged, but there was a problem, but it didn't prevent you from kind of mixing that in and then IP tables rules got screwed up fixing. What, in.

E

The v6 addresses yeah I think now shouldn't I be able to make you proxy filter out the v6 dresses and lock them I. Think so that's what it's supposed.

G

To do yeah, it does log them, but I, don't think of it like removes it from the slice. Oh well,.

E

If you can show a repro of that.

G

Okay, I'll find that bug yeah.

E

Thank you. It should be relatively easy to make a repro with just by faking it okay.

C

Next, one per service readiness probe sounds like a feature request, I see so the one this guy was a yeah. Unfortunately,.

C

This is currently not supported, so move on featuring that the G combine address already used our own container network.

C

Already address already used court already.

E

All right, this is gke, so send it my way and I'll reroute it Teeter managed I. Don't.

M

Think has anything to do a tiller.

E

I think it's I, don't know, there's also some confusion and they say they're using flannel, but they say they're using gke. So ok.

I

D

D

C

Is a feature request yeah, so these breaks I.

A

Guess my gains still my right. There's Casey.

G

A

Yeah he got my way, I think I looked at this a while back all.

E

Right cool. Thank you. I would just like to point out that we are now back to September burning down the backpack, so yep, that's great! Keep going filled.

C

To star and cue proxy with matrix flying flags, I think we saw him.

F

We get a volunteer to try to reproduce I thought. Oh this last year we fix it weeks ago. Oh really,.

C

F

I have me yeah.

C

C

Okay, next one thank you proxy I, previous auto-detect network interface, MTU, it's already assigned sounds like a future request. Does sound.

G

Like a feature request, doesn't it okay.

E

Yeah I: can you also remove the lifecycle round on one side unless they get closed right away.

I

C

Right next, one that I want to know how much risk external traffic policy equals to local traffic.

E

Okay, this is a documentation. You sign son to me. It's fine, I love these months anytime, I get to hit the reply and close button. At the same time,.

C

Possible race condition in creating network connections in ingress controller namespace.

C

J

Looks like another one I'm looking at I am at least those words.

L

E

I could see.

E

Since I wrote that.

I

E

Venus my video.

C

Okay, she came milk prevention, things pot.

E

I know this bug and it is fixed in G K. You can close this okay. This was a bug with preemptable VMs I.

C

Mean use local, no port with IPS.

C

Connecting to a service.

E

This is fire filed from within the city, so I think it's a legitimate bug.

E

You just mark this as triage unless we think that does nobody's talking about.

I

There's no more but just paint.

C

Okay, sorry, let's.

C

So IPT well Rob and.

C

What doesn't mean by no type a means? Network.

C

This is because the.

E

And send this one to me: I like it I, have a suspicion. It might have been one of the host port ordering bugs that were fixed in the last release, but I'll have to get some contacts, but.

C

The whole sport has to be the same right. Oh yeah, right.

E

Yeah, so somebody somewhere has configured their node towards to be in collidable space.

I

J

C

C

Calls communicating via WebSocket an API and.

J

This was August key scroll down, it see where we are saying she is a February same machine.

I

Python Kline.

E

Is it a WebSocket to our API server or its.

D

Websocket between they're, too hot I'm, not sure I, said I needed to communicate with each other.

B

So never seems to return. It sounds like possibly service IP pointing to nowhere, because the pod pod exited sort of thing- maybe he assign this mean I- can ask them some questions. That's great! Thank you. That's a good theory.

I

All right, thank you.

C

Too many established connections I, don't think this is signet work.

E

Yeah I would take Network off and put node on and clear that a rotten one time.

I

Thank you right.

C

External trouble posed.

E

C

E

Service topology, it's just a few signs from City to John and my John close it with the reference to the service, topology site, sure.

D

Yeah, which I, which make it obviously you know, we.

E

Need to revisit that one yeah, okay,.

C

To start off with, in this container, crating Wow.

D

Usually this happens because that networking is not working. Let's.

M

K

D

We get a lot of these on the core DNS issue and we have a whole right upon I know just.

I

Give it to me our.

D

A

Yeah, you could also give it to me because it's a Cali girl, okay,.

C

All right cool all right next one, we just got a few minutes left just time check.

I

Allowing hostname, true I, think I responded to this controller. Maybe not oh.

N

E

Seems like a legitimate feature, request: I'm, not sure we want to do it, but I'm not sure we don't so okay. So alright.

C

Co-Heirs through.

M

C

We fixed all this right, Valerie.

O

Yes, we fix that I see I'm, not backported. Yet that's fine! That's fine! I.

E

Might need to file a back for it. I'm, not even sure we need the backboard to 111, just knowing that it's fixed in head is probably sufficient for this.

M

E

So head actually fixed in 114 for sure was in 113 I, don't mean we.

O

Haven't back border to 113, just 114 cool, so.

C

Okay and then the uvp case. Yes, all the contract, flushing stuff is all UDP.

I

All right, cool.

D

We have to use our looking.

E

At the list of people who volunteered, we got a few people who have not assigned to anything who, if they really want to help, can certainly jump in my queue proxy.

C

External oil, we add, rose to known local IP tables.

C

What does it mean? Oh.

C

I see this is the case where.

H

C

Doesn't allow the IPS the balance room to get out at the note, it's uh I think it's a feature request.

D

Silly short start getting you know, I, don't get that we sure to check it. I would have to come back and look at.

M

E

Config, because on some clouds it is a local address, and so we filter for local addresses and some closet.you not in this case it sounds like it's more the proxy you know and uh forwarder.

E

Okay, we are on time all right. There we go 2:30, all right cool. Thank you. Everyone who signed up for bugs there's plenty more clearly anyway, who feels like a go-getter, can dig into some of these and try to do some triage and we'll note also to we're all the way back to July now, which is fantastic.

E

Can you give me one favor, you have the main query up. Can you just see how many issues we currently have open wasn't? Throw the one that's down from 253 we three cycles ago, so.

C

Congratulations.

C

All right cool next item.

A

Yes, so next up, we've got a discussion of the ipv6 dual stack cap.

H

Hello I put this here with Cal hello, stick Network, so really not not specifically about the cap in detail, but one of the implementation phases requires type changes to CRI, which we went over and had a chat to the folks at signo to kick off that discussion and they but promptly said without this kept being in the right state. They won't consider those changes. So really we just wanted to bring that to the awareness of the sig and I understand. If there's any week, anything we can do because the cap is under review.

H

But if there's anything, we can do to at least start the discussion with sig node for the CRI changes specifically to support multiple IP addresses so.

E

I fed back on your attempt yesterday, I don't if I saw that it was really the only questions I had were about the phasing of the dual stack. You proxy part. Everything else seems good to go, I'm ready to move it into implementable. If we can right.

H

So yes, and thank you very much I spent time with Cao and basically the way we addressed your concerns was explicitly calling out each of the steps in each of the phases and the cube proxy stuff was explicitly put in phase two. So I could throw that I could show you what the phases are now or I could just ping you afterwards, but I. Think we've addressed all your concerns.

H

So if you want to take another pass, we could merge that and then I could put a PR in for implementable and I guess that would unblock the conversation with sig note. Yeah.

E

In fact, why don't can you get I'm probably have a chance to take a look at it until it's in very earliest a few hours from now more likely tomorrow? Can you get Cal to just move it to implementable in the same here? Yes,.

H

I will I will get that change, but basically just go and review the phases and make sure you're happy with both phases and then I guess that was it. We addressed a couple of other dangling questions as well. Awesome.

A

H

That we've met it anything else. Otherwise, thank you, Tim anything cal, anything else. Okay, thank you. Thank you. Sig Network.

A

Thanks Christopher I think your next one list.

G

Yes, so the PRI linked in there is actually queued in the merge box. So that'll swap the store now for ingress to the networking B 1 beta 1 by default.

G

I have APR cute after this one urges to change all the examples and places where we reference extensions, where we don't where we should reference the new networking, apos. Okay, so I'll push that out later on.

E

As well, that was basically just gated on the 114 release right so now we have a rollback target.

E

There was a reason we do this right. The reason we didn't do it before is because we we couldn't have rolled back and had this story to be read simply, and how do you say, 114 understanding grass in both API groups, we can do a rollback, they have to okay.

G

Yeah that that sounds right, I I was following the kept okay, so yeah Jordan, Jordan right so Jordan knows what yeah cool and does the kept look? Okay, as far as everything still as we mentioned in there I think jiving still with this release, I.

E

The only part of the cap that was up for debate was the what's exactly in in terms of Delta's feature, deltas and Bowie he's been working on that I saw. There were some comments this morning and I haven't, read them yet.

G

Okay, once was there when I wanted to ensure was also announcing on the mailing list that extensions, especially deprecated at 115 as well. Yes, just like go out yet for the replication cycle, that's that still go as well. I.

E

Think so we're the last person in so we can turn the lights out on the way out. Okay sounds great. That's all I have thank you.

A

Okay and last day we had min Han on the endpoint size proposal, so.

C

So I presented this to the sig last meeting like wanting to know if there's any additional feedback and if that's ready to put into the cab and also any other like feature requests, I wanted to pick it back into it. Any like things that has. The proposer has not considered like, for instance, the one that just came up the ipv6 to us. That looks like it's gonna change. The M points object as well to support multiple eyepiece if I'm reading it correctly yep, so that probably need to have a parody in the end.

C

Points lies in API, so yeah so just wanted to know. If anyone has in comments and like concerns before I put into a cap, because I feel like the dog is easier to communicate on rather than that, pull request. Yep.

E

I'm, looking forward to the capital, I think there's a few folks from cigar chul who will want to take a look at it. I'm know. Brian wants to take a look, so cap is probably the right vehicle. Okay, all right. Okay, all.

C

Right, I, converted to a cab.

A

All right, that's uh that's! All I got on the agenda doc.

C

C

E

You have anything else they wanted to talk about this week, I I.

A

Had a quick question because I know we talked about it a while back, but the status of the user space proxy yeah I think we were in agreement that we wanted to like deprecated that so.

E

There's still there's still one major user of it and they are here. They are now Dan and Dan. I think are now owners of the user space proxy as long as they're using it and it's not causing drag I, don't mind leaving it. If you guys want to fork it and move it out into separate repo. That would also be okay, I sort of leave it in your hands, I.

B

Mean we're mostly using it as part of the uh Nidal Inc proxy and in theory forking it out, might let us clean things up, but at the same time, if we manage to move everybody over to VN kubernetes, then it doesn't use cube proxy at all. It has its own proxy implementation. So then we wouldn't care at all, so maybe just leave it around and if people report bugs we'll fix them- and we can revisit this in in a year- let's see if it's time to kill it off then I'm.

E

Okay with that.

A

Cool I think that makes sense uh mostly curious, because I was coming across a couple issues raised against it and wasn't sure how much time to invest in in those sorts of issues. I wouldn't invest.

E

A ton of time in it, although if people are actually using it, I'm surprised.

B

So the nice property it has that the IP tables one doesn't is that because it actually opens the connection to the pod before returning the connection to the caller. It guarantees you get a live connection, whereas at the IP tables proxy can redirect you to a dead pod and it just hasn't failed its liveness check, yep and apparently this is an issue for some people. Interesting.

B

We tried to come up with some way to implement that behavior in the IP tables proxy, but.

E

Yeah I, don't know how you would do that.

E

E

Jp is anybody else, taking a look at the ingress GA kept.

E

Bowie I think seven changes in the API of things we would want to do are calling nga I. Think most of them are good. There's the debate about how they should exactly look and what the implementation should be. If anybody cares about ingress in the ga feature set, please go. Take a look at that cap and offer your feedback.

A

All right any anything else, I should we do some more or triage or.

E

Give everybody twenty minutes back or.

A

E

How about ten minutes of each.

A

That's good back.

C

To you in on okay, all right, okay, you guys see my screen yep all right. Next, one IPS and host port host port is implemented in IP tables, yeah.

C

I see this is a sequencing problem.

E

E

You can sign this one to me: it's probably a dupe with the sequencing stuff, okay cuz. This was quite a while yeah.

E

If I get 10 minutes back I can't she go work on these.

I

E

C

Demons is broken, run to 18.04 again, host port moves.

B

I think this is a we're waiting to see if they responded after the last meeting and we're gonna close it if they hadn't well or maybe not arch.

E

C

Okay, all right next one, an idea, a target support. We do this sounds.

E

Like it's actually singing WS right, we still have sings for the individual clouds or those Dead Yet.

F

It should be, they should fold, and around July can also tag cloud. The writer there.

C

Okay, all right ex wasn't own local breaks, internal nature, Bodhi.

A

Looks like Tim, reproduced it and had an explanation of why I was working as intended.

H

A

At least that the post claims that, in that block there, it says Tim Harkin, is this to say: June.

E

I see my said, something go.

D

You say it's easy to fix pattern.

J

E

Alright I decided to me that.

C

All right, this woman could old.

E

Closes down time, I know this one um I think I'm Melissa Collins. Yes, yes, you can this one already assigned to me. You can just mark it as triage I know this issue and I have an idea of how to fix it, but not done.

C

This is not a GPO machinery right right, yeah.

H

C

I

Próximo IP, yes, I.

C

See so does IP vs skip proxy support, ipv6.

E

Can I sign this to you or one of yours.

H

You drop off already I'm still here, I think sinking.

H

E

What do you think, can you just you need to fix it just try to figure out if it's a real thing sign.

N

E

H

Your handle Cal B&B age, then the second from the bottom, oh yeah, yeah. Thank.

C

You thank you all.

J

Right and dogs break tienes, razón, oh and us makes dinner I think now.

I

I have to drop off okay, not to get any more.

E

It's almost a year ago,.

M

Okay, thank you just comment close.

D

You wait long enough. They just closed. That's.

E

She's already marked as rotten so nobody's, responding to it in.

I

Very long time, when she's going to close, it seemed.

E

I

Change solved: okay, close.

C

The conciliation strategy of what IP allocation the Coalition is flawed from one Knicks, are going that guy.

C

N

Go back up. Sorry I see a shoe. Oh.

E

Well, goodbye- and you can just mark this triage.

I

Okay, all right.

C

Cue proxy can load XD compressed.

I

There's a kernel not insert module of invalid module.

N

Format, kxz compress the kernel object, uh so this is probably because.

B

The container has like a newer version of the tools than the base OS does, and so the newer version can deal with the compression and the Bergersen other way around. Whatever I see.

E

I don't want to compressed until there's no, no.

B

The colonel wants it uncompressed and the tool doesn't know how to uncompress it, but the tool on the node does.

M

So it's trudged.

E

If you wanted to just add a common, and you seen where anybody else sounds like.

E

If we need to build a new image, we can do that too. I just want some guidance on it. Somebody.

M

Else always active yeah.

C

M

A cute proxy huge.

C

Yeah, okay, that's one of those names of the main feature compatible with deployments.

N

That's missing what they want to happen.

E

People said: okay, it's a feature request, I'm, not sure we want to do it, but it's a feature request.

E

That would cause a big blow. Well, it's not a graze using subdomain.

M

Olvera regrets that well controller I'll buy one cow, an attack that.

F

That's old that this is no it's over a year old, yeah, I, think cloud provider. Sig is tracking this one, though it's more like a API call issue other than networking issue cool.

E

Take off sig network is.

C

There, like cue penis limit like.

I

Just curious: is there ever enough?

I

Okay, all right last one just.

C

After this last guy external.

N

Name doesn't generate research discovery, oh.

E

Yeah cuz, what would he create you admire available for.

M

M

Scroll down and see, if there's anybody +1 in it.

E

Plus 1, as of October, alright,.

N

It's a feature request.

E

Use Mikey triage.

D

E

My fate, a lot cleaner knows.

C

There's a discussion.

D

In the Curia has talked about like apparently cute penis, if you put an IP address into the external name,.

H

D

Just worked just happen to work, don't understand how I I know either sky DNS was overly clever, sometimes yeah. It doesn't work out all right, but it's not spec stuff. Alright,.

E

Cool we're now back into February nice.

I

E

Cleared the last year back well, we've been opened the last year of backlog. Let's see we can clear it, everybody can take a minutes back.

A

Sounds good thanks.

E

Everyone Oh two weeks from today, I guess we're gonna meet, but that'll be the last one before team con. So hopefully we'll have an outline at the very least of what we can be talking about at Q. Khan I'll try to share something before that Valerie. We need to circle back on that I apologize, I lost track, yeah.

O

I have some rough slides, but they definitely need refining still I've just been busy last couple days: okay,.

E

So we'll shoot for two weeks from today: just have some food enjoy sure. Alright, maybe maybe we'll do a hangout or something in the meantime. Okay, let me know alright thanks.

A