Kubernetes SIG Network, 18 Oct 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Network meeting 2018-10-18

Description

Kubernetes SIG Network meeting, October 18th 2018.

A

And we're recording this is the kubernetes Syd Network meeting for October 18th 2018 and let's jump right into it. So, first on the list with the cig test, review, I was just taking a look over the test grid and it looks like everything is passing. We have no failures.

A

So I'm happy to move on from this. Unless folks have particular testing things I'd like to discuss.

A

All right, let's move on to the second item, which is I, wanted to do a quick spin through what we've targeted for 1.13 and check. You know how each of those are going, and hopefully we have some folks here who can talk to what they're working on. So let me share my screen and then I'll take a look over here at the sick planning spreadsheet. So two or three meetings back, we wrote this up and said we would check back in in the middle of October.

A

So why don't we go down the list and, if you're working on this, please give me a quick overview of where we're at so starting with ipv6. That would be you Dan yeah,.

B

Sure so so the first item remains in progress. The PR that I had put in. We we split into two one, is just doing the coop test, the coop test, part of it and the second part, is a property.

B

The coop test part is just got merged yesterday, so that that we're really happy with that months like finally there so now that that's been compiled into one of the kuvakin and the end doctor image, and that seems to work and now we're just waiting for I have to convert a Providence, a four to set up the job. That's going on periodically and so we'll, probably hopefully a few days away from having something running.

C

B

So in that and the second item- we're still looking for reviews and there's a there's, an energetic, headed to the agenda today kind of gotcha. That I mean the main. The main thing remained at main question remaining I. Think the API stuff is pretty settled, but the main question remaining is whether we want a single service, IP versus dual stack server, side, piece and there's, there's an issue that that I have in the agenda and some coding has begun.

B

There's a couple of Drs I'm about to submit a third BR for code changes, so we're plugging away and it's starting at code changes a.

A

Hit for me awesome, thank you.

A

Next on the list was proposing ingress future I think that was a if you're on the call.

C

Yep I owe you guys an update on that one, but that one were working on it. So there will be something coming. This person.

A

A

Cortinas I think is also on the agenda for later, but maybe we can just do a quick high-level status. Yes,.

D

So the addressing the scale issue, the peer is right out so I just wait. Someone is approving the peer that Chris pushed today and then we with that we can verify. We address a scale in 5000 of its only way to to verify on 5,000 notice. You have this approved and this Pai is also put in Korean else as default. So if, if the test is okay, cadenas would be default its we need this peer to be in.

D

If it's, if it's not okay, then we will, we will see. We still have some optimization possible.

A

Okay, so the plan there is that we will test the fix and a post-merge and we're pretty confident it'll be fixed. But if it's not done laughter, then.

D

We have to put another release with another team musician. Yes, we are pretty confident with it a lot of scale, but only until 2000 of Weeden, we can do with pre. She admits only only on mm. Okay.

E

D

It is, it is done and all the check are done, so the peer is now Audrina. We just need I put the peer, the fear number in the north of the meeting agenda of today, and we need someone to a GTM on this peer.

D

The test order, end-to-end tests are win. The.

E

D

Happened with automatically aways the pier can.

E

You just assign the PR enemy yeah.

D

A

All right, next on the list, skew cattle changes for pod, ready plus plus we.

F

Don't have anybody down.

A

For that was that min Han working on that it would.

E

Be minghun he's not here.

A

Okay, so we can leave that one for now, unless anybody else there was any status updates for it.

A

Apology aware routing of services, we had set a goal to agree a cap, so John's not here my.

G

Mother called him yeah I did a bunch of research and to see whether we wanted to do it do anything snazzier, because we had use cases for it, but really couldn't couldn't justify anything more than the simple case. So I sort of revised and the the existing cap, probably and and update that for early next week,.

A

Cool is that that this our source, I, guess we don't have a link to the kept in here. John. Are you the the correct owner to have in here now.

G

Yeah, for now, at least for sure, I mean.

E

Let's be clear that the three who wrote the original cap but I, don't think you want to take it away from anybody if they're still around and they want to participate, then they're welcome to take it back and drive on it. Okay,.

A

Elizabeth there for now, and we can uh give that some time.

A

So next is for audit of conformance. um This is something I put, my name next to and I have started just by wrapping my head around what we've got currently for conformance tests, hoping to get something I can send around to folks and sometime soon trying to identify what we've got and what we might want to what kind of gaps you may want to close there. If any.

A

Windows cube proxy yeah.

H

So, targeting still targeting GA for 1.13 for passing conformance tests, we have some signet work tests related to DNS that I added to the agenda to discuss soft words.

A

A

Great so it sounds like there is progress being made.

A

Anything else anybody would like to to raise on this list before we move on.

A

All right, in that case, let's carry on so next on. The list was David to talk about the DNS tests that we just just mentioned briefly. Yeah.

H

Sure, thank you so I'm yeah, my name is David I'm here from the sick, Windows community, where we're trying to bring karate support to Windows. Obviously, our main metric to graduate Windows from beta is like, by announcing like cubelet and coup proxy those libraries to go ga through conformance tests. Now most of these conformance tests, they run on Windows without any changes, thanks to like Linux Linux aliases that we have available on windows.

H

Containers that are calling like our correct between your functions cover now I added an agenda item here, because there are, there are some special cases where the behavior on Windows slightly different than on Linux and I'm here to discuss one of these cases that affects the to DNS conformance tests, so the one for unis for cluster I think I link that in the agenda and then in us for services.

H

So so let me explain it perhaps a little bit more specifically so we're seeing different behavior on our like on the windows, dns resolver versus till the next dns resolver, in the sense that, like in how we are trying to resolve names that contain dots so perhaps host an example in the chat.

H

Let's say, for example, if we have a DNS suffix like in our Etsy resolve, conferring similar on Windows, let's program that way on Windows we're seeing the following. If we try to resolve the DNS mean the same way like the test tries to do resolve like kubernetes, for example, and that should append.

F

You know suffixes.

H

That we have programmed to add, like you, know, the namespace and service star cluster dot, local, to form the appropriate hookup saying the same way. We can also look up fully qualified domain name. Let's say you try to resolve an ADIZ thought default on service star cluster local, those those behaviors are the same on Linux and Windows as expected.

H

Now the difference comes in whenever we try to look up names that contain a period so not a trailing dot, but a period and the actual string like a like, for example, kubernetes thought default or at least on default dot service. So all those cases are treated differently on Windows, then on Linux. um The difference is that Windows is treating it as an absolute or as an authoritative string as if it's like a fully qualified domain name.

H

Basically, whereas Linux treats it as a relative name, so it still appends the service star cluster dot local to the string that we're trying to look up so.

G

David in lyrics, that's controlled with the N dots. In the result, a coppers are no equivalent in Windows yeah.

H

I'm following up on that, if we have any special like configuration parameters and certainly if we don't, we should should so, we will have a follow-up word- make sure that we have some equivalency an equivalent implementation, but for right now, I, don't see an equivalent parameter to configure that behavior, and my question was what are whether it is acceptable to tailored as conformance testing nuances of our like OS specific DNS resolver, just to be able to not block Windows going from G went from Windows to go ga.

H

Perhaps while we work on you know, similar configuration parameters like and that's the same way that mixed does or are the really important features or use cases that have a needs to resolve partial domain names. Like this, that's kind of my question.

E

So this is Tim. I clearly have thoughts, but I would like to hear what other people think before I come out on. That I mean.

G

Well, I can do an opinion. I mean I think that the expectation is that that those partners, those partial names, work and that that customers are likely relying on that. So, if we're talking about conformance, then it it would we be best to make a figure out a way to make it work. I mean they'd sort of not conformant if it doesn't work so yeah.

I

But but these customers are deploying Windows applications and using goddddd names like that, does not work on Windows today. So.

G

I

G

Only when these applications I mean it's not just generically. What about? Could you a mixed cluster, where they're trying to reach out to some service that's running on Linux that I'm Agatha? They know they're deploying on Windows and they can make those configurations, but yeah.

I

And those aren't things that I would expect to change in the kubernetes amyl. Those are things that would just be how their other app is working, so they would either use you know a single name, short name or an fqdn.

E

Right there in support of their configuration that they pass in this up. It came up in cig architecture this morning in exactly the same context, but not the exact same detail, and there was an argument made that I think holds a lot of water, which is sort of principle of surprise or non surprise. I, don't think Windows consumer would be surprised that that doesn't work.

E

It is unfortunate that it's sort of part of the API, at least in the DNS extension. Well, no I, guess it's not the end. Docs isn't actually codified right, like the the custom DNS policy is, has a search path field, but it will behave different than Windows and it doesn't, and in Docs isn't a schema field. That's in there yeah.

J

And duckfist mounted so.

E

I guess it's not actually even for an API break, so the question then is: is it okay for Windows to be different in this regard? My feeling is: it's probably okay,.

E

Unfortunately, the conformance program doesn't have an affordance yet for this is conformant on Windows, and this is conformant on Linux, so by taking it out of the conformance test, I think the only option we've got is to just take it out completely well.

A

We do have a an affordance, for example like if you're running on GCE, then the conformance test behaves one way versus not on GCE I. Think that same test has additional assertions in that case.

E

I

Other thing is convention is that this is just a test case problem, so if we were to just allow the test case to test resolved in kubernetes with no dot that would work on both legs and windows, so.

J

The packet, the test case, is passing three of the names, so it's like the test case passes kubernetes kubernetes our default and covenant is dot default or SVC, so that three names are passed and all three names are checked against the result. So for Windows, the Covenant is alone passes, so it's like we either. We can split the test case and keep the kubernetes as a conformance and keep the other two resolving name as a like. A new test case that only works for Windows only works for Linux is that an option I'm. Finally,.

E

Splitting the test case from a technical point of view, it makes sense, and so we can then at least have the conversation where we say same name say short names always work. That's part of conformance and cross. Namespace names is up for debate and was to whether that's important I think that's fine.

E

The question is whether we actually want to allow conditional conformance, I mean I. Take that back I think we effectively have to allow conditional components we're in this case. The only condition we support is the architecture are the the OS, but I. Don't know that the conformance leaves have sort of formalized that yet so from a tactics point you can use, can somebody send a PR to break that into separate test cases, and then we loop in the conformance people and see what they think about it. Yeah I, I'm, okay with it I think I.

E

Don't think we have a lot of choice there and I. Don't think it's reasonable to hold that line. How many disagree.

F

F

Well, maybe I wrote it yeah I.

G

Mean obviously, they know they're deploying on Windows, and so they can expect it to behave in a certain way. Yeah.

E

And honestly, we shouldn't base the conformance on what's available in the current to us. As we support, we should base the conformance on principles right and we've sort of conflated. The two in this case mm-hmm.

E

H

Okay, yeah so send OPR, perhaps and then we'll loop under conformance. That's.

E

Right send a PR just to break it into two test cases, and then we can say specifically we're failing this case and we're passing that case. Okay,.

D

Okay, just one question: I'm, looking at the test, this specific test right now that which is conformance IT there is already if it is GC or gke, then we added two other name to resolve google.com and metadata. So do you mean that we should not have any if provider in the conference, so we need to speed this part that existing partial, also I, think that's probably true.

E

I think that the testing of resolving of external names should not be covered, like the conformance I, don't think it's a requirement for kubernetes that every cluster would be able to resolve externally to.

F

E

Need the test we.

F

Don't need it to be in the conformance yeah yeah.

D

Okay, so right now the conformance test is already a little wrong, because there is, there is inside the government's test to case, in fact, one we are gcgj and the one that we are not all right. We should root goes out.

E

Of the compartments part of it, okay, Casey we're gonna, look at the compartment stuff right, yeah.

A

I had already spotted that one and I've made a note of it. Cool.

E

We should I think we were. One of the networking is gonna, be one of the harder' conformance things to tease apart. What is implementation? What is conformance, though, it's good to just discuss them, sort of case-by-case.

A

Yes, um cool so I think we've got a plan there. So, let's move on to you gain with dual stack design question.

B

Yes, this question better suited for the mail list, but Justice Breyer described it just for food for thought, I guess, but in in the current dual effect design we're proposing that we just support a single family of service IDs. But things like no important external IDs would support dual static access and having the single family service. Ip's is going to be able and it'll, simplify annotation and save some work at least that'sthat's the thought.

B

But there's one thing that I've been thinking about where it may be more work, a little bit more work involved in supporting the single family service eyepiece, and the problem is that when you, when a when these are containers of no import service, that that service always gets the server's IP assigned along with the note port and then IP tables, all the rules are set up for both the service, IP and and the note port in the dual stack design.

B

When, when the user can think, there's a note for service there'll be one of the tables either. Ip tables are tables that will have both a service ID and a note and listening out a note port and the other tables will just be configured to listen.

B

Listen on the note port, so I I'm, not sure if I'm not really familiar with the workflow and coup proxy, but there may be a dependence of when, when a notochord service is configured that you know, person configures the service IP and that sets up a little balancing everything and and then it tagged in it added in the node port access.

B

So in order to implement this, you know single family service ip's. With the dual side note work, we may have to rearrange a lot of those the workflow of of coup proxy I, I, don't know if I'm, if I didn't make myself clear enough or anybody has any thoughts on that spectrum. Alright,.

E

It is this hypothetical, like you, don't know or hypothetical like you looked at it and you think that's this perfect. The.

B

Only thing I've looked at it or the natural and and I see that, for you know, and you set up a note, note port. You know it's got the front end for the front for the service I peed in the front end for the note port and then they both refer to the same low balance a part at the end.

B

But I have not looked at the the coup proxy code to see. If it you know at first as a service IP, and then you know that does that does 80% of the work and then and then the no importance added afterwards just tacking on to the the tail end of the.

E

Rules yeah, that's basically right, I mean well it's right in sort of the sequence of the code, but the code is what it generates as an IP tables restore file which it then restores atomically. So there's not actually a like real-time sequencing problem, I think if that's you're getting too.

B

It's not yeah I'm, not worried about the real-time sequencing more. You I thought it would take a lot of code refactoring to with with so that you could do no important without, depending on the the service life you work already have been being done. Yeah. Maybe it might be worthwhile refactoring.

E

Anyway, okay, yeah I, think I think you're right. There's one big function that basically processes all the different conditions in sequence and so I would guess. The refactoring we want is to take the logic for generating the curse service and per endpoint chains and breaking that out into a separate function that you can call from the different places, depending on whether you're, the primary family or not.

B

Okay, well, that sounds like it's not a real thing. Showstopper then be able just keep going ahead with a single family service might be approaching.

B

E

It's bill in it.

E

Okay, I think it's still overall in that simplification and not worth going back on just yet, okay, perfect.

B

For me, thank you, cool.

A

Thanks Dan next up, we've got four good eNOS.

D

Yes, I think I'd call ESL release it by my main concern was the approval for PSO. Now it's assigned to Tim Tim, just one thing about scalability: we are the meeting with six scalability last week to define a how do we? What does it mean passing the test for core DNS, knowing that the memory was that exactly countered the same way coordinate? So, to be honest, the the point of view of first second on six scalability is pass the test as long as you pass a test, you're good, so I thought.

D

Maybe the test does not evaluate everything, but if the test is improved, then you will have to pass the tests again. I think that's fair! You make Wojtek happy! You make me happy. Okay, that looks like you just need to push the button.

D

Alright. Thank you.

A

Alright and last step is Alexi.

K

E

Better, it's just soft. We can at least understand you now.

K

K

Okay: okay, okay Tito, we are trying to implement the host alert support in coordinated, it's C night Morrigan, it's a sub-project of OpenStack, it's a token for using OpenStack ports, Natron ports. Maybe if you know we're following the same approach as in Charles, the host user arsenide or again so we have only in it has the user. You know the main socket, but we don't have a th0 interface inside container.

K

So we faced in the issue that kubernetes in as enter average, doesn't work for us because no interface inside container, so I prepared a page, and then we answer already reviewed it.

K

It's a search for word waste, but unfortunately, I wasn't able to push into the same for requests. So I had an issues with this page and I. Had questions to Dan.

L

K

Unfortunately, him did not answer the question.

K

I

E

So I, can you talk more about what it is that you guys are doing I'm not really with it? It's.

K

About seen, I am M output. A currently kubernetes, you know, I've written, doesn't read IP address from Oregon's output. It obtains an IP address from container with a kh0.

K

Network interface is IP, address, Mike.

K

M

Lexi, a quick one for yeah, so I'm, not exactly familiar with what the particular limitation of CNI is, but I'm gonna shoot. A link in chat here is that there's been a total refactor of that. The host user CNI is now a user space CNI, and it supports a number of quote unquote: engines for kind of user space, networking through and I, so just throw the link in here. As that, might you might find it useful as a reference or you know, as a project to contribute your work to otherwise just Linda?

M

Let you know about that.

K

Yes, I. Remember then I mentioned that he want to do something with c9 and other America wanted to do something similar.

K

But we don't see some reference being called something else. Maybe specification or already prepared pages.

M

All right also just FYI I'm, just struggling with the mobile app, so I can't paste the link to it. But if you, google, user space, CNI github you'll find it as the first link. Just so, you know: okay,.

E

So, just to be clear, are you looking for a patch to be merged? Are you looking for feedback like I, wasn't clear to me what the result of.

K

This both feedbacks and maybe.

K

Yes, feedback, I, think, okay,.

E

And this is you sent this to the container networking org or to kubernetes I? Don't think I've seen it.

K

About Miranda that balban I think yeah.

A

If it's a kubernetes, PR I think the link is in the meeting notes: okay,.

E

I'll try to take a look at that.

K

Okay, thank you.

A

All right, so that was the last item on the agenda. So unless there's anything else, it would be good to discuss. Now we can get 22 minutes back.

E

All right everybody go write. Some tests, I.

F

E

Fix some tests don't read anyone's.

A

That's good thanks. Everyone see y'all next time. Thank thank you.