Kubernetes SIG Network, 4 Aug 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Network Bi-Weekly Meeting for 20220804

Description

Kubernetes SIG Network Bi-Weekly Meeting for 20220804

A

A

Everybody get the announcement. I don't get the announcement all right, cool, uh welcome to Sig networks, regular meeting this is Thursday August 4th I'm your host Tim. uh As usual. We are subject to the code of conduct which basically boils down to don't be jerks, be excellent to each other. That said, we have a fairly slim agenda today. So, let's um start with triage, which I have queued up. um Let me go ahead and.

B

Share that, uh where did we put it.

A

Yeah where's my shared oh there's, the big green button share screen and a.

B

Window and make sure you get the right one, yep.

A

Everybody got that all right, uh so, let's start with the newest first, which came in 12 hours ago with just missing the first round of triage that myself and others did yesterday afternoon. So uh node part I've, not read this one. So let's read this: maybe quickly as a group or Antonio, you can give us a a brief since I know, you read it.

C

Remember so previously we have a process in the queue process and we do open an old part. They call the subject. If you follow the socket, nobody can take it in the horse. So it seems that since we no longer hold the socket, any process in the in the house can use this. This part as those part and what I thing that may happen is that some processes, using this node port, a source Port, sending a request and something is happening with the IP tables in the name, part that is causing the connection to break.

C

But this is the theory. I I see.

A

So if they select a node Port as an ephemeral port right, then the responses will never come back, but.

C

Now now what I was saying it.

B

What is the default for ephemeral ports and you have.

C

The the this is ctl's names in the in these and that now that they mentioned you, when you create the connection, I mean. Maybe this doesn't happen always when you create the connection IP table have to track the connection right.

A

uh On your uh yeah, yes,.

C

ah But well I mean maybe but.

A

Ip tables will still good question a.

C

Nice exercise for someone that wants to go deep into IP tables and and all this stuff.

D

That's the connection, but that's totally separate from the Colonel's list of what sockets are in use and should not be ephemerably assigned.

C

Yeah but the the contact table is the one that you use not uses to reverse the connection. So the thing is: what happens when you created the connection and you create an iptable rules that you're redirecting to yeah.

A

On my at least on my machine, so I I guess this is a question for maybe everybody can cross check it. When I look at uh the CIS cuddle for local Port range, it's configured by default to be 32768 to 61k, so it shouldn't anyone anything that is used by node ports shouldn't be covered by the ephemeral range, but I, don't know how every other distro sets that up.

C

D

Was gonna say that that's that's basically right when we were talking about getting rid of the code. We pointed out that the default value of the node Port range and the default value of the ephemeral Port range do not overlap, and and as long as you don't change that everything will work. But if you do change that, then you can possibly break yeah.

C

But this I think that he is mentioning that that they have to to extend the North Pole right or something like that.

A

I've been there sorry I was just pasting. My notes.

C

Yeah they are using a low rise for note boards. We.

A

Use a lot of Newport.

B

So it is inconvenient to modify.

A

What is IP local Reserve ports.

B

I know that one.

A

Empty on my machine, I, don't even know what that file is. That's this cuddle, S4, there's a lot of node ports, so it is inconvenient to modify that I. Don't understand what that means, that they don't.

C

Know those are the the cctl center that that kind of the seminar Port right.

A

uh Yeah, it's just not clear what they've got them set to um Okay, so I.

C

Know what I I understand is that he wants to say uh I, just don't want to to do work with the CTS I. Don't want to to manage the cities myself.

A

Yeah, uh but he also said, I use a lot of node ports, so that makes me think. Maybe they changed the default node Port range yeah.

C

Because the key, the example is using the 30 000, whatever uh so, okay that I said to me. I want to play with this and I will.

A

38, because so they did, they did extend it because they're they're using 38068 here right. So that's more than 32k.

C

But if that's the case, we need to do a warning or something right to say. This is going to happen. If you do that.

A

Yeah they should extend it down instead of up.

A

um We should we should uh document that or something um I, so I would like to say, like I would love for us to hold those ports and not let people use them right like that would be great, um but the code to do it was so fraught that you know we. It was better to just get rid.

C

Of it we can do the 6ctl and and wow, but you know you cannot override the idea.

A

So uh here's what I'll do I'll assign to you but I will also add a response myself uh actually I'll cop.

B

A

B

A

B

To be on this, one.

A

Yeah, okay, uh all right, you got it, let's dig into it and see if we can figure out a good answer here. uh Cool I wish there was a better way like BPF or something to say block this port consume this port, but don't leave a process running on it right um all right. Next for dual stack deployments, node addresses show only one IP. If node IP parameter is passed.

D

This I think they're complaining about the cube CTL backward compatibility.

C

Yeah I I reply it below, because the the example that he said he's based in there he's saying that it only happens if they have Cube 124 and crowd open, stack 124.. So.

C

They need to check I mean if the only difference is with the cloud provided open a stack. This will check the cloud provider right.

D

Oh this is, there is a change to node IP Behavior, with external Cloud providers, assign this to me. I may reassign it to Cloud six.

C

Is this one that you were discussing with annotation.

B

Yeah, okay, you.

A

Got it next uh API server crashes, with dual stack ciders if the primary range does not match the community's default, so I I responded a little bit to this one. What they showed me was uh uh they ended up with this, so they configured their cluster with um uh service cluster IP range V6, then V4, but they also added advertise address as an ipv4 address.

A

So our API server helpfully created the kubernetes service, set it to single stack as it should be set it to IPv6, because that is the first family uh which got allocated in IPv6 address with no selector and then we went and we wrote an ipv4 endpoint because that's what they told us to advertise. So the question this is this seems clearly wrong.

A

um The question then is: should we um try towards my response here? Should we try to use the secondary range? The non-primary range when we recognize that advertised address is V4 in in this particular case, um or should we just say, hey whoa, you can't set an advertised address that isn't the same family as the primary service family.

C

A

C

Go ahead: the problem is that there is a lot of assumptions on the advertise address and, and this this happened in openshift I- think that every week we had a backlight, this cluster doesn't boot people spinning around taking locks. Until someone take a language report, all right check it, you have the service in the other way around. So that's why we failed it fast.

C

And Dan is going to fix it.

D

So so, there's there's a a pending still pre-alpha cap on dual stack, API server, which covers some of this and what sort of validation we ought to be adding to API server arguments. um So you could assign this to me.

D

um I could there's a theoretical sneaky bit with advertising address, which is that somebody might Point advertise address to a proxy server which translates between IPv6 and ipv4 um I'm, not completely convinced that that wouldn't work, but.

A

No, that would probably work um yeah, so I mean my my feeling in looking at this. If I was a user, I would expect it to try to use the non-primary range when setting up the the API server service. The kubernetes default service, um because I feel like advertise address is a like a more powerful config, um and so it's worth at that case sort of being adaptable.

A

um We have the usual problems of what if two API servers have different configs, but this doesn't make that better or worse.

A

Okay, uh the two of you are assigned. um If you think it's actionable, I I forget who actually wrote that code I think it was you Antonio, uh but if you think it's actionable like we could just write a bug that says hey these are. This is the place that we need to change it and market help wanted. We have a lot of people who are looking for actionable bugs if we just tell them where to go.

D

This this involves lots of really ugly codes.

C

I I recommend the right to proxy before doing this or.

A

Okay, all right then! Well, then then, it's yours. uh If you confirm which one, you think is the correct path to go, then I'm happy with either path.

C

If, if to the problem, is that there is a lot of of tooling Cuban and a lot of things depending on on this order, and- and you never know who is who is going to break with the advertise addressing.

A

If it uh all right well, let's take it to the bug. Let's move forward um here, we have a a bug report that centered on customize that I don't really understand what the report is saying um something about labels not working properly with network policy with customized. They have a you know, a suspicious label, which is an integer value. So it's quoted, um but I don't really understand.

A

What's not working so I I was responding a little bit with the the poster, uh so is Dan Williams, oh yeah, he just assigned to you Antonio, uh so I can assign it to myself. I'll. Take this one.

A

um This one is uh someone complaining that there is no external DNS node address for them, uh and um Dan uh Williams correctly cites that uh it's not a requirement that it be provided. So I asked for a little bit more information to see if I can help this person, but I think it's not a bug here. Let me add myself.

A

And I don't know anything really about mongodb, so I don't know what it is they're trying to do, but it sounds like the mongodox are making some assumptions that maybe they can't uh and then the last one is this oldie um about documenting the the the intentions for the source ranges discussion, I just left it up just to say you know it's been a long issue, but it's still open.

A

That's it for trinage I.

B

Will stop sharing there's the stop, sharing button, you're good you're, not sharing it well,.

A

I'm not sharing where the hell am I, not sharing I.

B

A

It just happened.

B

Oh, you were, and you stopped successfully I.

A

Don't know how I stopped um I must have accidentally hit the button. Okay, um that's good to know uh all right, so agenda triage, so Bowie is number one on the agenda, but we have an issue number. Are you here.

E

Yep you hear me yep, yeah, uh sorry, are you presenting I, just I'm not presented.

A

E

You want me to present this yeah I. Think I don't want to mess up the meeting okay.

E

um So basically the issue um I filed was that acute proc there's a race condition where uh Q proxy may start up. Read a node look at this pod cider cache that value and then, unfortunately, sometimes the node actually gets deleted and recreated with a different pod site or out from underq proxy. What happens in this case is that, unfortunately, Q proxy is also still running and now everything's messed up. It has basically an inconsistent State.

E

um The general I think there was some discussion here about whether or not I think it was from Dan whether or not this is actual bug versus like don't do that with nodes. Unfortunately, that is the behavior of certain unnamed major cloud provider.

E

um So yeah like it seems bad to have q proxy just keep running with stale information when it can clearly tell that it's Dale.

C

Yeah, but there is one thing that during the review we find out is the note: even handlers are not working unless you have the topology aware hints fito, but this is another thing that Alexander here he is going to add a new feature to you. Proceed that need the no devil has so we have a.

C

uh This is not going to be a bug now because it's fitulated when Alexander at his call. This is going to be a back if we demonstrate to them that this happens with the notes and what.

D

But we can just change. Could you know make the note Handler get involved, regardless of the topology feature game like that? That's not difficult! It only runs when topology is enabled right now, because that's the only thing that that Handler is used for.

E

Right yeah I was going to say that if topology graduates, when we just have it on all the time period,.

C

Yeah I'm, just you know, highlighting the the new findings and and setting the timelines, because Alexander that is here is going to use this Handler too. So I, don't know how do you want to to do it.

E

I see so, it seems like the pr needs to both enable the node Informer all the time and then, in addition to this, it also sounds like this is a I yeah like what sequence we wanted to go, because this some this is basically a bug fix of sorts, not a feature, but the other one is like a feature that.

C

This I mean I I'm up to whatever you decide.

A

Do we understand why a cloud provider is doing this? uh Yes, we do, is it is it us? Are we doing this man? uh That seems like a bad idea too? Okay, you can fill me in on. Why we're doing it? If, if, uh if you want um I on my long list of docs, that I meant to write uh was something about uh node identity and in particular it was.

A

If you have a node that is named, you know X in the kubernetes API, and you do something to that node such that it changes its IP. It's it's I, it's pod, ciders or it loses volumes or I, hit a list of like five things that you do. Then it's really not X and you shouldn't bring it back as X.

A

um It sounds like we're strictly in violation of.

D

That Theory Well it's worse than that, though, because it's actually deleting the node and bringing it back without killing any of the components running on the Node yeah.

A

Yeah, exactly um without even turning the note off, it sounds like.

E

Yeah so like it's actually slightly different, um if anyone Encounters this, it's because the node actually was rebooted, but there's a stale resource and Q proxy runs before cubelet is able to update it. So that's how the race happens, at least in our case versus the cubelet is running and somehow it gets like redone.

C

If you can describe this scenario and we cannot attest, that will be much better.

E

Yeah it's a little bit complicated, but basically in Imagine, like Q proxy, somehow gets ahead of cubelet updating the node resource.

A

C

All right, so this happens okay, so they know this okay, I I, understand now.

B

Yeah Coupe privacy is running while the old node object exists in kubernetes API and has not been removed yet and then new node object gets created, uh but kuproxy doesn't see. It was.

D

Another thing that reboots the node also delete the node object. First,.

E

There's a race because, let's say the VM just gets power cycled.

B

Yeah, this is specific to Preamble VMS, which just disappear with next to zero warning. Where.

E

Is it I, don't see it.

C

uh And what are the other scenarios that you were thinking about done because just say that if we want to add node, we need to check more.

D

C

D

Tim was saying, like you know, the Pod IP or sorry the node IPS like I. Remember there was this problem with openshift years ago, involving VMware, where people would delete a node and then bring it back and and like it would get assigned a different IP that time and and in in that case we were failing even when things did get restarted, but you know eventually we fixed that, but it was just like impossible, so not impossible, but really annoying to make it work. If the components were still running.

D

You know across the the change, and so we've never tried to make that work.

A

Yeah sorry I had a little distraction. um This was somebody said it was preemptable, VMS, right, yeah, okay, I, remember having this argument with those folks.

A

uh Okay, um so is the real fix here just to fix the node handlers and then Cube proxy will just adjust, even though this is not a great idea. It'll work.

C

uh What they I did, they say: yeah the logic to to to to to crash Cube proxy if, if it doesn't match.

A

So then, it'll just restart and and resync.

E

That's the safest thing, because you know trying to like somehow like repatch everything that sounds like really complicated. You might as well run the whole initialization from top to bottom I.

A

I agree: having looked at Dan's um minimizing iptables rights, PR I can imagine these two things intersect badly.

A

You have to reevaluate everything that made in uh local actually.

D

No, whenever we get a node update, it sets the needs full sync flag, because topology change would require a complete rewrite. That's right: okay,.

A

Foreign, so do we have what we need to move forward.

C

We want this for for, for now or for 125.

A

I think we would want this in 24 and 23 right if, if we can make a surgical fix.

C

But the surgical fixes or with the fit to rate or without the fitter Gray.

E

Which? Sorry? Which feature gate.

C

So this this only happens if, if you have the feature gate enable.

E

I think, like a unrelated feature gate so.

B

What you're saying Antonio is that we should just tie this functionality to the topology feature gate, so we're not adding a net or.

C

No, no! No! No! No! No.

B

C

D

Just so that the the node handlers are added, no matter what, but normally they don't do anything unless the topology feature gate is enabled, except that they handle this one case of restarting like yeah, that.

E

Would be my recommendation, we do need to evaluate um whether how like more surgical, we can make that Informer enablement is because yeah it doesn't watch all nodes. It would swatches like a single note or something.

B

E

Just watches same note, so yeah and that that seems to be reasonably contained.

C

Okay, then I I got I I will tomorrow or I I will do it.

A

Okay and and I think we should propose it for a backboard for 24 and 23.

A

Okay, all right next on the agenda is uh uh exceptions that need review. So we hit code freeze this week, Long Live code freeze. uh We have a couple that seem like they need uh exceptions which I will try to look at today, but I'm gonna be honest. My meat day is slammed today and I'm on a plane tomorrow at 8 A.M, so uh to Hawaii, so goodbye, um so I could use help reviewing these exceptions, um I'm going to try desperately to look at them today.

A

um But if anybody here uh can look at them and help build confidence in them, that would be great.

E

How many do we have.

A

uh I see one two, three four.

E

Okay, that's a lot.

A

um So let me look at them. um The first one is Alexander's.

B

A

B

This didn't I approve this one I, don't know this is a different one. That I realized this morning when Antonio reviewed my follow-up Cube proxy change that I wanted to do for the HC I realized that in fact, we've introduced a regression I think which is specifically around the fact that now, whenever there's an unscheduable node, we will also remove it from the lb set and Clayton raised the pr a couple of years back where he explicitly removed the schedule ability predicate from having any impact on the lb set.

B

Okay specifically because it created a production outage and looking through his PR uh and his reasoning, I kind of realized that yeah it's completely normal because schedule ability just says that you can't place any new notes.

A

B

Even node, that's.

A

B

So if you have a pod running on node X, where the load balancer is associated with it- and it goes uncheurable that pod will still be there, but now we move it that node from the lb set and so we've just screwed it its Ingress completely. So, okay, okay,.

A

B

Like very minor, so the yeah, the fix that I did actually there's another another thing. The reason why we got confused about it was because the schedule ability was a part of the update, predicate that decides on whether we should actually sync the node in the update function. Right.

A

B

That was added by Andrew saidkin after Clayton, but he didn't really give a good reason as to why that attribute did has any meaning at all. So this fix is removing the judge ability predicate for okay from the CCM, because.

F

B

Didn't see a reason to have it and I thought Clayton's reasoning which was proven and uh logical. So that's why okay.

A

um I will take a look at this today that the code changes small, the test, changes bigger, but.

B

Yeah yeah, that's, okay, removing the test cases we just added a day ago. Okay,.

A

And then uh then we have two from survesh. Are you here, yeah yeah.

F

Hi, uh so I did just get an exception till Monday uh for getting this uh merged, so uh I think the API change team you have already reviewed most of it uh just like need a final uh plus one uh and for the controller, change, I, think Bowie and Antonio both have been reviewing. It.

F

uh Antonio has some uh like uh suggestion to make it level driven but uh I'm a bit nervous to like make the change at this very last minute, uh but yeah most of the the pr is reviewed already so I just need a final uh review and then hopefully we can get it first.

A

Okay, so the the I want to be careful that we don't set. The bar super super high for things that are completely alphagated, like the point of alpha is to be able to try stuff out and make incremental progress. So uh I'll look at this I'll mostly be looking for confidence in the gate, um and uh that can let us move forward.

A

So I'll I'll try to look at that today, but if I can't give it a super deep review, then I will um approve and I'll leave the lgtm to uh Antonio or like you're in Europe, so you're gonna go to sleep soon. uh I'll leave the final LG TM to either Antonio or Bowie.

A

Thank you. I hate. When Antonio's responding to PRS and I know it's three. In the morning there.

C

No I'm not telling them.

A

Okay, one in the morning.

C

A

You're a bad example: um okay uh and then the last one is. uh Oh sorry, one question uh is the: is the implementation inclusive of the API PR or are they just PR's.

F

B

F

So the address yes but I have replaced the the implementation over the API PR, because I needed to test it out.

A

Okay, so if we just approve the implementation, then that one PR is complete yeah okay, so we really only need to get approval on 109.090.

F

A

Okay, cool I'll I'll shift my uh energy to that. Okay, uh sorry and then the last one is Dan's. Minimize iptables, restore input, uh I haven't seen. I saw, there's updates to it.

D

A

D

You had suggested doing a mini cap which I did and I filed that, and you think oh you did, but but I was going to say like since all of the heavy lifting for this PR has already merged. If we're going to do a feature gate anyway, then could we just throw this in behind a feature gate um and get it into 1.25?

D

A

You uh don't, we need prr review like adding.

D

I mean if there's actually going to be a cap, yeah yeah.

C

Why did you say that this is a fatal guy? The previous Pierre I mean you did just.

D

So the other thing I said is: is that if we're going to put this part behind a feature gate, then we could also take the the iptable save performance Improvement that I did a month or two ago and throw that behind the same feature gate so that again, if there's a bug in that it doesn't break everybody.

A

The the distinction there, though, is the iptable save stuff, had existing tests that we were confident in that convinced us that you didn't break the test right.

D

A

D

I mean you know it: it had the existing unit tests that we had added in the previous cycle, but um actually amputable safe. We don't really test much at all, like um the ambutable. Save patch makes it so that we don't delete stale rules right away, um but it shouldn't matter.

C

I, don't know, that's the thing that instead of deleting and regretting everything, always you only do that in every single period, and you have intermediate the state.

A

That's this one right, the sorry you're not with my screen uh the minimize input.

A

D

That's the iptables restore one there's a link in the one of my last comments at the bottom of the pr to be IP table, save one. You may not have seen that because Antonio ended up reviewing it and it went in while you were busy with other things. So you may have never reviewed that.

D

But but basically we had gotten to the point where the only reason why we run iptable save is so that we can get the list of rules that we need to delete or change that we need to delete uh right and but IP table save can be very slow if you have tons and tons of rules, so I changed it so that, if you're in a large cluster, we only do that cleaning up stale rules like once every sync period, instead of doing it on every single sink, and then that saves us from having to run iptable save every time.

A

I see I, don't think I reviewed that one, but okay, it sounds plausible, but it also does sound scary, um okay, I'll look at this, but honestly, if I were CC, I would be saying no um like too late to get a new cap in too much risk at the late Point did you did you file an exception for this I.

D

Have not yet I wanted to get your opinion on it.

B

Are we in a big hurry, because I have found that if you get something in to say, 1.26 really early people love that so instead.

D

B

Being late, you could be super early.

A

I I want this in I, get it in fact. I talked with some scalability folks this morning and they were like yeah. That sounds great, um but I I don't know if we should push this one right now.

A

I talked to Cece yesterday about some other ones, and she is clearly under a lot of pressure and I. Don't want to be that person who makes her say yes to something she doesn't want to.

A

Is it a big deal then, if we just say we're going to save this for 26.

D

It's not um the only reason I was arguing is like I said, because the hard part of the pr already merged or the hard part of the the rewrite already merged and.

B

And what's left.

D

Is basically just adding a single if x then continue.

A

Well, but like as I looked at, this I was like where's the metric that tells me how it's going right so like I.

D

I and yeah and and I mentioned that in the enhancement that yeah we should add metrics so right, okay, so, let's see.

A

No I want a metric that says: how often do we actually do the the full sync versus the partial sync and how many we're doing in the partial sync like I, don't have any visibility into what this is doing now, how.

D

Often, do we hit the code path where the partial sync fails and we fall back to a full sync on the next run. Yeah.

C

But you have metrics of the IP table rules that you do in each round.

C

A

We do um it's a sort of ambiguous signal if that number drops right.

C

A

C

Weird yeah right I need to check those methods how they look like so.

A

This is the prr review right. This is this is the stuff that we haven't done because it was late in the cycle. I love, the pr I think it's really uh cleverly done the way you uh moved all the things around, and then this just becomes a really easy change, but I think we should punt it to six to 26., okay, okay, um cool, so I won't focus on that one. Today then yeah.

C

But um what happens with the previous one? Do you want to Roberto.

A

uh I didn't look at it. How do you feel about it.

C

I spend a lot of time on it, because time was chasing me and I mean I.

A

That's fine I mean if we spent time on it and we've got tests and it's been in for a couple of weeks. Then I'm less worried about that. Although I would go back and look at it and see if we need any extra metrics there.

C

I I would check them at the sun, send an email to you to to verify.

D

How they look like.

A

C

D

A

Those in after code freeze, that's okay, right, okay,.

C

A

All right, um I had thrown the idea that we would look at the cap dashboard, but maybe we'll um see what else Rob? Why don't you go next.

B

Yeah, this is really uh quick. I just wanted to mention that we have uh Sig Network, Deep, dive and intro in kubecon Detroit. This time it's been a while, since we've done one of these, uh if anyone has content, they want to make sure we cover uh or wants to be more involved just reach out to me or Bowie um want to get more diverse perspectives on this. If you want to be more involved, just uh just, let us know, are you guys going to do the presentation?

B

Yeah? That's that's the plan right now. uh Okay, I'm always open to help.

A

Yeah, if anybody wants I love to have shadows on these things, so if anybody else wants to help prepare and do the presentation for this either on the intro part or the Deep dive part, um let Rob and boy know.

E

Yeah and it the at least in the previous couple, that we did it's very easy like you, you get like one or two slides one, just like a single topic, and that's all that you need to kind of be responsible for.

A

Yeah yeah I'd love to see us cover all the cool stuff that we've been doing. um Hopefully uh for 26. We can actually have a story for the topology and the terminating endpoints and all the the kepts that are sort of paused at the moment. I'd love to unpause those and and uh talk about how those are about to make the world a better place, plus all the Gateway Stuff Plus, all the iptables minimization stuff plus, like we got a lot of content to talk about.

A

That's just you know things that are on the front of my brain, I'm. Sure there's a lot more than that.

A

Lb set tweaks like all the stuff.

A

That's on my screen right now: um okay, uh where to put the agenda there, you are um all right, so we've hit the code freeze, uh but we haven't hit the 25.0 release for me personally, I like to take this little time, interstitial um to look at Tech debt and things that we'd like to pay down that are neither new features uh nor new caps, um and uh so I wanted to just put it out here that when I get back from my vacation, I intend to just go hunting for some tech debt, low hanging, fruit, stuff.

A

That is ugly, that we could start queuing up some PRS for whether that's logging stuff, although Dan you know I gotta hand it to you. Cube proxy is a much nicer code base than it was six months ago, um a lot less low-hanging fruit, um but uh just looking around for old issues that we know we want to fix, but we haven't been able to fix um those sorts of things. I would encourage everybody if you've got a few. You know free cycles and you want to um take a breath.

A

um I think getting some tech debt paid out in this break makes the next cycle easier to achieve and and we stop accumulating issues so there's plenty of Sig Network tagged issues in the repository. If anybody feels like I want to help, but I don't know what to do. You know, let me know or I'm sure Antonio can help you find stuff uh or Dan or Dan or Rob or Bowie. We kind of all know where the bodies are buried so like they can Implement a mirroring controller. That goes in the other direction. Right, Rob.

E

The infinite varying controller.

A

Or or fix, or fix, Cube DNS something anyway, um uh so we've got 14 minutes left. Let's maybe do a quick look at the dashboard and see if there's anything we want to update there. Let me do a share.

B

Screen again uh share a Chrome tab. Where are you can I search? No I can't search? Oh great? uh What's it called apps, of course,.

A

A

Why did my mute go on it.

B

Says you're not you're, not muted, now are.

A

You is my screen: sharing yep yep we're looking at the caps weird I gotta. It's gave me a message that said your mic is disabled when sharing something with audio, so I think it detected that a Chrome tab could, in theory, play audio.

A

uh That's weird, okay, all right as long as you can see it- and you can hear me at the same time um all right: let's, um let's go backwards from Alpha, so I I've updated it a few weeks ago, but I want to make sure that I got them all um did anything that was ga uh get their Gates removed. Did we remove the gates for namespace Ingress class.

B

Anybody I need to double check, I yeah I'll, get back to you. Can.

A

You double check because if so we can move it out of the yeah.

B

Oh, no, sorry this is it this.

A

Is already in this is already in the gate, removed, column, sorry, I'm, I'm off by one um not removed um uh all right. Dual stack support is for next cycle, node ports, this next cycle and load balancer classes next cycle. Okay, cool did anything beta, go ga. uh No, this just went beta right and internal traffic policy did not mixed protocol.

B

Basically, it's being me, but I can't really see what you're looking at I.

A

B

Can see what I think is probably an old version of your screen, yeah.

A

B

Not moving it around, it is just the same: Eric's caps I think it's like it froze or something like.

A

Yeah, when I hit the button here, it paused my share I guess um so: I, don't know how to share and have a microphone at the same time. uh Maybe yes, that is super weird pause, audio share.

D

So you did something that made it update. I I, see now everything probably navigated to GA merged.

A

Can you hear me now, can you.

B

A

We can hear you, can you try.

B

Scrolling up or down or sideway, okay yeah we're good yeah.

A

All right, there's a separate there's a pause button and a pause audio button. uh Okay, don't use Chrome web.

B

A

B

Protocols I plan on moving that forward in 1.26 as it's my Milestone there, okay.

A

uh And grpc did that change.

A

It's not milestones at all Bowie.

A

B

I, don't think that changed.

E

uh Yeah I don't as far as I know, nothing happened. Okay,.

A

So I'll tag it for 26. uh topology. Are we still looking to move to GA in 26 yeah.

B

I was just talking about that. uh What we need for that is a clearer definition of what it mean. What we need for ga uh my hunch is that we might need to provide a different option for an algorithm and probably make our tests a bit more thorough than they already are. I, don't think it's going to be major changes, but we need to actually Define that in the cap somewhere.

A

Okay, so when the kept cycle opens, let's make sure we focus on that I'd love to get this beta column emptied out all right. Anything Alpha that went beta, Network policy status did not terminating endpoints did not and uh I don't think. I saw any PRS for this. These are all tagged for 26, so, okay and did anything sorry go.

D

Ahead, I was gonna, say the IP tables cleanup ought to be an alphagated code, is merged and I thought I had moved it. Maybe I moved it into the wrong call.

B

There we go admin, Network policies, merged I mean the first V1 Alpha One been working on Docs I'm, going.

A

To throw it in.

B

There excellent.

A

uh All right, uh this did not make progress. This did not make progress. We got to figure out what we're really doing there. Dual stack. That's pause.

B

Okay, all ports so rotten and you.

A

Know if you come back to that, um ipam is going Alpha. Hopefully we'll just leave it here until we get it actually merged.

B

um And what else let me remove this a.

A

Host IPS did not make progress and prefer did not make progress. The cycle cool. We got a lot of kept work to do.

B

Okay and this one did not make progress new.

A

No progress on that.

A

Oh all, three rotten, I'm gonna come back to these uh okay.

A

uh Why is this a new, not evaluated tracking terminating endpoints?

A

Didn't we have one for that, but.

B

It has a milestone.

A

Proximity and points- oh- maybe it just didn't, get added to the right column. Okay, uh Port range and uh Ricardo hear you here.

A

This did get merged right so.

B

He was here if he dropped off, then you can check with him. But okay.

A

I'm, pretty sure I saw that go in if I didn't approve it myself. Okay, um we got a bunch of PRS open against caps. We'll have to go. Look at these too.

A

Okay, that's the kept dashboard, um looking pretty good uh as the cap window opens. Hopefully we don't have a whole too many new ones and we can spend our energy trying to get these ones um moved through awesome thanks for sticking with me, while I figured out how zoom's new share works.

A

Sorry, Antonio, what.

C

No, no I was taking the the dashboard.

A

C

I think the one is wrong: I I would which one okay.

A

Go ahead, they.

C

Won the the main my my my filter is not going to better it's not even now, which one service? ah No, it's, okay, it's the other one.

A

It's in the pre-alpha column, right.

C

uh But we have the other one with the reserve IPS. So what what's the deal now is you? You spend two releases on beta right before going ga.

A

uh No, you don't have to spend two releases in data.

C

Yeah I thought that was the recommendation.

A

For ones that really do need feedback. Yes, so for that one, you might choose two, but it's not a requirement. I mean some are more obvious than others right. In fact, uh I want to be more thoughtful about whether some of these even need to go to Beta at all or whether they're just like. Clearly they could go from alpha with a gate to GA with no gate right.

A

The goal of alpha is to give the rollback ability, um but some of them just they don't need to be beta, like maybe some of the cube proxy cleanups. Maybe don't need to go to Beta.

C

Yeah we have these minor scans yeah.

A

Because, like the beta just doesn't really give that much value if we're confident in it, if we've got tests and everything else, then you know it's just a code change. It's not a there's.

F

A

Feedback: it's going to make us change our minds. Okay,.

B

um Question actually about that Tim now that it's changed so that by default beta is not flagged on as instead of how it was fly down by default in the past. Oh.

A

Did that actually, finally get committed.

B

I remember seeing something about it is.

C

B

Actually true, and if so, does that change anything for.

C

Us, but let me explain, because I I had the same misunderstanding. So what is disabled by default is the API.

C

The filter rate is enabled by default, so what they are doing is they are not exposing the apis by default, so you do enable whatever feature the feature gate is is better, but if you want to use the API that this is that thicker rate is not is not published in the API server.

A

So you also have to tell it to expose V1, beta1 yeah.

C

That's the thing big one due to explicitly enabled that.

D

C

The filter rate is still enabled.

B

Thank you. That's interesting, yeah.

C

There's legit and David did well yeah. It.

A

Just seems I have to go. Read that uh okay, we're we're at time. um Anybody else have any other business.

B

A

Right then, we will see you all in two weeks time uh uh and if you've got time in the next two weeks, let's look at some tech, Debt Pay down. We certainly have some debt I know we do it's buried in there somewhere it's hard to find I'm sure, but we'll we'll find it.

C

We don't have, let's see.

A

All right thanks, everybody we'll see you in two weeks, hi.

C