Kubernetes SIG Network, 1 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Network Policy API Bi-Weekly Meeting for 20201201

Description

Network Policy API Bi-Weekly Meeting for 20201201

A

Okay, so this is sig network su project network policy. Evolution meeting today is november. 30 2020.

A

I kindly remember you that this is a an official kubernetes meeting. So please be aware of the code of conduct, be nice with each other and let's get started.

A

So we have the network policy agenda here and we have three items. If someone wants to add some other item, please please feel free to to instruct so the first one is about newcomers. Do we have any newcomer.

A

No okay! So, let's move on so the second one. I think that jay and abhishek has been reviewing the label.

A

The label theme the label, the the network, namespace natural policy by namespace by name and the label proposal and jay. Do you want to speak a little bit about that? What you and I share- that's revealed what's up.

B

Go ahead, yeah um was just hacking on looking just looking at it with abhishek. I think we're we're just got to figure out one thing, and that is that I gotta um compile I'm doing this right now. I gotta figure out how to compile the code to figure out it feels like the api machinery. Folks are implying that there's some kind of schema on read that we can do.

B

I don't fully understand exactly how that's implemented and I'm not 100 sure whether you get that for free and defaults.

B

Go like you know, is defaults.go called on read or only on right is really my question, and I don't know if anybody here can answer that, um but that's going to determine whether we can do the solution we proposed in the kep, which is really simple, which is just modify defaults.go so that um you know it always adds that label um and if we do that, we're fine and we don't have to do anything else, because we don't really even have to worry about going and setting old name spaces, because anytime, someone uses the api server to read something it'll automatically get that label put on.

B

So, what's in fcd is basically irrelevant.

B

um That's pretty much the only question we have to answer. Everything else is just nets.

A

What about jordan's comment about the controller.

C

A

To reconcile all namespaces, are you doing this, or are you thinking about that either.

B

He made a comment about reconciling old name spaces, but I think.

B

We had two comments about that. I think I think one was in the context of backwards compatibility, which we have a hypothesis that defaults.go might automatically reconcile namespaces for you, because every time you read you're going to get that label for free, even if it wasn't on the name space.

B

Now I don't know if that's really the case or not, but you know, um then. The other thing I think related to controller was the idea that you could just prototype something like this with a controller um so kind of either. One of those, I think you know, could work.

B

But I mean either one of those is valid, but I think the only one that's like.

B

I think the only thing we need to worry about is: can we get that schema on read thing working, because if so we're fine right? Because anytime, you read the value you'll, get that label right and whether or not old records in etcd have that information or not winds up being irrelevant and in fact the idea of whether even that label is written to etcd seems like it would be irrelevant too right.

D

E

Okay, so I think the one thing that I'm a little bit uh you know yet unclear on is how to handle the uh versions cube. uh For example, you have multiple api servers uh offering different. uh You know ones upgraded the other one system, the other one is not so in this case, if a read is being performed or served by the older api version, it doesn't have the it doesn't.

E

Have the you know the labels uh writing capability, so that's the only thing that we need to ensure that doing it in the fall sort go versus doing it in you know, strategy like the prepare for or prepare for, update or create whether that will solve the problem. I think jordan was kind of alluding to the fact that if we use the latter, it might solve the case for both versions queues.

E

But you know I haven't tried that out and I think jay you were going to try that out as well. If I, after our call, you said that you'll give that a shot right.

B

Yep, so I'm gonna, I'm just gonna see you know the thing is ricardo. I just got to see yeah like what happens when we actually implement this change like what do the objects look like right? We got to see it and the biggest question winds up being. Is there some hack we can put in there? That makes it so that old objects that were there before we started have that label. You know and I'm assuming there's something in api machinery that allows you to do that, a last-minute modification, something you can do.

F

A

In the translation somewhere, so so your way now is is trying to make this change even even before we get this kept merged just to see. If this is plausible right, okay got.

F

It I mean there's just some stuff about api machinery.

B

That we don't know that we need to figure out in terms of because tim and jordan definitely seem to both sort of be in violent agreement about the fact that this is definitely gonna work. So we just have to hack around and and see it working for ourselves, so that we can.

B

We can have the same intuition that they have around how it should work. You know what I mean.

A

Yeah yeah, I agree with that sounds good like seeing it working before we.

F

Yeah I mean, if we have time at the end of this call, I can show you guys, show you all what I'm doing and you can take a look. I think that.

A

We probably will have some time because we have like a short agenda here yeah. So the next item in the agenda is about the other tech reviews. Abishak, do you want to make any review in the cluster scoped api or you.

E

Yeah last week was a short one, so uh we canceled the meeting. uh We should be resuming this week so hopefully, next week, we'll have a better update on.

A

A

Okay, so about the part ranges I'm I'm just waiting for some sort of improvement. um I think that andrea andrew is not here today. He he told me that he was going to to take some time off this week, but I think that we've had we have reached some some agreement about the part range I just can't see if, if we got the agreement, that exceptions can be dropped right now, so I've I've run I've. I I have tried to search about my my security, the security policies of my company and.

C

And, put here like that,.

A

In my case- and I have like I work in a pretty restricted environment, so the default blocking policy covers, like eight parts, mostly of them are regardless file sharing and and the remote common like rsh, that's those old ones, um extern. So having eight port ranges, I think that it is plausible, even if we put them in the cluster scoped network policy later like in the future. This is the network policy.

A

If you you can allow anything, but those parts like having those as as uh uh a part ranges as a support range feuds already, like eight arrays, so I'm just waiting for four last comments from team and andrew, and I think hopefully this is going to get merged and we can start I. I will probably start working into this also, so I can like take a look into how he's developing api machinery stuff, even if this is just adding a new field.

A

Okay, so we also have the surfsi selector. I don't think that anyone got this one right. We are still missing someone to get this to write a cat right.

C

Hi ricardo um satish, so yeah, so we I mean I don't have any context about the service selectors but uh but happy to pitch in there. um Like, I mean happy to take it, I mean I'm actually pretty new to this group, so uh I don't have any context about the service selectors and what's the motivation behind it, but uh with enough information, provided, I think uh I'll be able to pitch in.

B

We definitely need an owner so, like we've, we've had a few people sign up to own this thing, but nobody's really actually done the work of owning it. So I'll say what I always say, which is that, like anybody in this group will totally help you, um but you know it's just like anything else. It's like. We just need someone to really own it. You know what I mean and and and make it happen.

B

You'll have all the support you want like technically and you could get on the phone with me or ricardo or abhishek and we'll help you with whatever you need to do and give you context for it and everything else. um It's just a matter of. Do you have the time to dedicate to it? You know what I mean to really making sure that it happens.

A

Exactly any help is is really welcome that you're so welcome. I I have sent you the the user store the use case about the selecting pods via services, and this is on the shed.

A

I I don't know if you are in this lag, I think so so feel free to bring me feel free to bj to being app check any of us. If you want to start writing a document call up in in like collaboration with us, it will be.

E

I think uh there are a couple of other uh user stories also that uh needed some owners. So you know whatever you feel more comfortable with or you you think that is more important like there is no uh the the ability to select nodes or apply policies for nodes. The service selector is one and then I think ricardo has shared the document which has a few more user stories.

E

So you know whatever you find that whatever you think is more interesting to you and then maybe you know we can jump on a call and uh discuss more sure sure. That's a thanks. Absolutely for the context.

B

What's your time zone, where are you at.

C

uh I'm I'm actually in phd he's in california right yeah, pacific.

C

B

All right great so I'd say I'll be like did you did you want to mentor him on this? If, if he's doing it that works? For me I mean.

G

E

It's yeah yeah, which, whatever topic that he's satisfied.

B

Why don't you just reach out to abhishek on slack and say: hey man? Let's do this, you know what I mean like um sure.

C

B

It's gonna be a fun fun project for sure. um Are you familiar with reasonably familiar with network policies and stuff? Have you used them before or do you need help getting started with them?.

C

Yeah, so I've used them before I mean uh I'm actually a part of the gk networking team here at google, okay, so yeah. I do have like some context about the network policy and yeah.

B

Oh, that's awesome, right, okay, cool! Thank you! So much. We really need someone to step up to them, for this it'll be really interesting.

A

Okay, great deals.

A

A

Okay, so I think we are done with the agenda right now. Anyone wants to add something. Otherwise we can see what's going on with james hacking, we can also stop the the recording and and stay here like hacking, things.

A

Anyone okay today was really fast, probably folks are in in the holidays, moon right.

B

I mean, I guess we could maybe record a little bit of the hacking. If someone wants to see it, you know what I mean. Yeah might be interesting, maybe end 15 minutes early. We have another 20 minutes or so 15 minutes sure.

A

Okay folks, so let's get started jay! What's going on with your cat, I'm gonna stop sharing here.

B

B

B

All right, you all see my screen right so.

B

I did um I'm so the only thing I really modified was I modified the package apis, or can you put a better coloring.

F

You don't like.

D

Green ricardo, I can't see anything what do you? Let's? Let's? Okay, let's see we should.

B

Vote on this, how about this one yeah, this one is better wait a or b it's like being at the end. Optometrist right come on jay. This.

D

One yeah you like.

B

D

D

B

That's all I changed right here right, so I just want to see if this works all right. So what I'm doing is.

A

I think I've never used it to look a little closer.

B

You never use local app cluster.

A

F

I usually compile things and put in in kind imaging I'm switching up on you. Sorry, I just gotta see if I can get something. That's easier.

B

Higher contrast, there we go okay, this is good there we go.

B

All right, what was that that didn't look? Nice seems like it printed out.

B

uh Unsupported value.

B

B

Something, I wonder if someone somehow hack local up cluster is broken on head right now,.

B

Yeah so uh anyways for those of y'all that are oh, I know what it is.

B

I think it's that uh something is wrong with your dns input get grab. Something is wrong yeah. I remember this and the reason I remember this is because yeah there's something when you run hack local up cluster, that you need to have um the coop dns stuff set up correctly, um but you know what we don't need that right, so we actually don't have to exit here, because um we're only testing one really stupid, simple thing. So, let's just see what happens if we run this without that exit?

B

um The only reason I know this is that I think I was the person that put that something is wrong with your dns input into the hack local up cluster like a month ago um for some other thing that I was trying to do, um but so I'm assuming this is going to come up and the experiment I want to do here.

B

B

Vns is invalid, something wrong with this input. It looks like it exited again, but I don't. I thought I commented that out. What I just want to see here is that the default namespace gets, for example, gets a label put on it, because that would have come up.

B

Actually, no, the default namespace is actually being created. This is tricky because all these infrastructure components are being created.

B

After this thing is already up and running right because of by the fact that I'm spinning it up from source, so the only actual way to test this would be actually to compile the cubase api server and then copy it into a running cluster. Right.

B

A

Probably would striking it could be called adm cluster. What's that probably bootstrapping it could could be atm cluster and and copy the kbps yeah.

B

It's like something like that. We just got to do yeah I mean all right. We could do it in kind anything. We could also do it in local up right. We could.

B

But anyways it'll come up in a second and then I should just be able to once this api server comes up, okay cool, so I should be able to yeah. It seems like it's running. I just have to do this uh ctl.sh wherever it is.

B

B

It looks like this falls. This is the problem, but um where's my coupe ctl. I don't think you need that's. Oh here it is yeah there we go so I should be able to do cluster coupe ctl.

B

B

I gotta do the set context thing cluster.

F

Coupe ctl config: why don't you copy and paste everything.

B

I know I don't know man, I don't know why I'm doing this I well so the reason is because my it's not calibrated somehow so once I started screen sharing. Have you ever had that weird thing where you get like? Where, like you, try to copy something, and it's like three lines above I'll: try it anyways, though okay, actually it is working now, so I can just copy paste it. Okay, you're right.

D

You were right, ricardo. I was wrong, see you figured it out.

B

Okay, so I can get the labels right. What do I do? How do I get labels.

A

Dash, oh yeah or.

F

Yellow print out the yellow yeah, let me see the whole ammo. Okay, yeah.

B

See looks like I got it right so.

D

Yeah, it's working so I mean this. Does it.

D

B

So this does it now the question winds up being this is running right. So then, is there a way I can patch.

B

The the the the question would be if there was a namespace that was already running.

A

Yeah, so this, I think this is the comment from jordan about the reconciliation thing right.

B

Yeah um the old name spaces, I guess so yeah.

B

How would I do that? There's got to be an easy way to do it.

A

If you try to remove the label, what happens.

A

F

That's because you, you didn't put the validation code, that right.

A

You're writing.

F

You're, a genius ricardo, you figured it out. That's that's exactly what I need to do. Edit.

B

Okay, now, let's get rid of that label right.

B

Let's see if this runs and if this works.

B

Then everything works.

B

D

That's it okay and I'll go home yeah. I just came back, I'm a second. Are you watching right now.

E

Look at this I'm hearing, I'm listening to you.

B

What have I done.

E

B

Now, let's just okay, now yeah, it's totally it's just! I don't get it. It's magic totally.

E

I think the only thing that uh yeah the defaults go. It seems like it's working right. I think the only concern is that the mixed kpi server versions, like the one which does not have uh this code, and if that is serving some name spaces, then how does it react to that and from jordan's comment it seem like if we use the prepare for update method, we could uh potentially address that.

E

That was the thing that I wasn't quite sure, because I have never tried that I mean in this case, though,.

B

We're doing we're doing exactly what jordan suggested. I think.

E

This is what uh tim suggested and jordan kind of agreed.

D

Yeah, it's like he.

E

Yeah but but he didn't leave him comment on the the version skew section uh which kind of handles, uh which kind of is satisfied by doing the changes in the strategy.go.

B

Yeah I mean I'm assuming we'll see I'm assuming they're not going to push back too much on that, but we'll see yeah I mean if you think they are feel free to like.

D

Correct me, I can be wrong, but, like I just I feel like yeah, I agree with you. I agree with you and this is it.

B

Ricardo, it's over man.

A

Yeah great I'm going to start hacking into the end part. So as soon as this is also approved in the cap, we are going to merge it, probably as often v121 yeah great job changes. So I feel like. Let me see also if someone wants to to pick this up like the end part when this is a prove it. I I don't care like not having this as my code, so please join me.

B

B

Okay, so I mean, I guess, that's we can kind of close out. I mean as far as I'm concerned. That's that's all. I got abhishek ricardo anybody else. If you all want to maybe stay on after this and talking what we can, I I think abhishek ricardo, and maybe you can just I think, abhishek mentioned there's a couple things he's going to clean up and then I can clean up this part of it and then I feel like we're pretty close, but I'm happy to hang out more if y'all want.

G

Yeah, we can speak tomorrow sure tomorrow's fine, okay.

H

Hey everyone I j. I would just like to introduce myself sorry I hopped on late. I couldn't figure out the meeting password, but um I'm andrew I'm from red hat. I'm a software engineer at red hat and I've been working a lot on network policy and upstream of in kubernetes, so um thought I'd hop in here and try to help out where I can so I'll should be around from now on.

B

Oh cool andrew: we we've worked with some folks over at red hat before for sure we uh we were working on some network policy stuff with antonio and stuff. um Are you in that group or.

H

Yeah, I'm pretty adjacent to them. I'm working with uh the openshift networking team right now, but I'm part of the octo team, so kind of kind.

B

H

Buzzing around.

B

Yeah we, you know, we have this policy validation, suite that we were just running on ovn kubernetes about three weeks ago and we found a bug and we helped you all fix it and uh right so I need, but I need help getting that finished. The reviews finished on that pr. So.

H

That but yeah, if you wanna, if you wanna, link it, I can give it a look. I.

B

Mean if you had an open shift cluster I'd love to know that we had passing openshift results because we've passed it on other clusters.

H

I don't have a long standing one, but I can spin up temp ones: okay, cool.

B

Are you available to chat like 10 or 15 minutes after this call.

H

Yeah, that's fine yeah.

A

Okay, so I think that's it for now, folks, uh we are in the end of the agenda today and see you all next week, next monday. Thank you. Everyone stay safe. All right, see: y'all yeah thanks. Everyone.

H