Kubernetes SIG Arch - KEP Reading Club, 13 Sep 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: [13th September 2021] SIG Arch KEP Reading Club Community Meeting

Description

Kubernetes Enhancement Proposal (KEP) Reading Club is an initiative by sig-architecture.

KEPs covered in this session:
1. https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/1440-kubectl-events
2. https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/1441-kubectl-debug

A

Okay, hi, so welcome to the next session of the kept reading club today is 13 september um as usual following all community meetings is true, follows the kubernetes code of conduct, which boils down to be excellent to each other, uh and this is also being recorded and will be posted online for future reference. So please don't say or do anything that you don't want posted online okay. So that being said, I guess we can get started. Oh thank you for posting the link, um so the first step that we'll discuss is keep cutting events which.

B

C

A

The second link in the agenda because the first one isn't big dragged anymore. uh So let's take 10 minutes post that if we need an extension, we can always do that. So I'm going to start a timer. Oh thanks! So I'm going to start a timer and uh yeah. Let's get started. I guess.

A

So, starting in three two and one: let's go.

A

Okay, I think that's time so do we need some more minutes.

A

Okay, uh I'll take that as a no so do we have any questions right off the bat for this cap.

A

Yeah yeah never enjoy it. Thanks.

D

Yeah, so I was looking at the design details and I saw that we are adding like a few new flags, so I believe these are for the cube ctl uh events sub command. So do we really so for events?

D

I think that it's uh kind of assumed that they are like watch kind of flags. So do we need to prefix the functionality with uh watch hyphen.

B

So I believe that that was just showing an example of what would need to be added if we made this work with get.

D

Okay, so I had thanks for that answer, though, uh so I had a question from the initial part uh on from the summary, so I was wondering whether even even though we'll be implementing new sub command are we trying to achieve like feature priority between cube citadel, get events and keep seated events, uh because at one part I saw like uh any modifications to having a watch. Functionality for events will also change. uh Hyphen watch for kids. It will get uh since events is dependent on cuba city.

D

So is the goal uh to pair any functionality that we have to keep suitable events uh with capacity events.

B

Yeah, so the it is a non-goal for this to have no relation or dependencies on cube cuddle get. So the intention is to build a brand new command from scratch, where we can make decisions that will make events better, because we get lots of there's one of the interesting ones that I noticed, isn't even in here is that if you're watching events, you will get duplicate events, because because of the fact that, when an event gets deleted, it also creates an event and so you'll see a delete event come by.

B

But you won't be able to tell that it was a delete event. You'll just see the same event replayed, um so that one's confused, a ton of people. So I think the this is going to be a nice one to like build from the scratch.

D

So I guess can can we explicitly.

B

D

uh In the summary that this is a current limitation, I guess uh we start with like presently cuba city will get. Events has some limitations, but so I I was confused. Maybe it's just me um even though I saw like in non-votes you've written uh that there there should be no relation to gives you to get events.

B

Yeah, I think that this was written and the kept template has changed several times. So I think that uh I think maybe things got lost in the migration, so any any um feedback we have. I can definitely send a mache and we can get it updated and made more clear for sure.

D

Thank you. Thank you. So much thank.

B

You it's funny because I I put in the chat, but we now ruined, went from a shadow to a lead to a release lead throughout this cap. So.

D

I'm happy that this is getting implemented this time around.

B

D

Yeah thanks uh thanks eddie for answering those questions. That's all I had.

C

uh I do have a question here so uh in the cap it has been mentioned primarily about the watch uh functionality uh with this cubesat event, so this is the only functionality that we are aiming for the watch.

C

B

Thought you were getting.

C

Just the raw events as well.

B

Yeah- and so I think, watch is one of the big features that they're going to want to add to be able to stream the events, um but I believe they're going to want to also search for events and filter for events. So I think that we might just be starting with the the watch feature, um but this will grow into a further command. I believe.

C

Okay and uh for the watch part, so it will be, the command will be something like cube, ctl events and minus minus watch until or it will be like cube. Ctl events watch something like that.

B

Yeah, so brian actually has a work in progress. Pr, if you want to take a look at that, this is what it's going to be based off of, so I think mache is going to come in and we're going to tweak and review it a bit, but this was the starting point for this feature.

B

So I see we do have a watch on here for object. You can specify an object, so it will just filter out events for a single object.

B

But this was a proof of concept, so hopefully we get it done before code. Freeze.

C

A

So another question I had was uh in the limitations section of this uh cap. It was mentioned that uh so with cupola get events, you can't do things like filter based on a particular event type or an object type. So this is probably like not too uh important for the cap itself, probably like.

E

A

Nice to have feature maybe, but if you do call get events and if you specify, maybe so, uh I'm not sure so other flags. Currently that help you filter out not for google get events, but something else uh for like if you do keep going, will get pause and do a watch. So does those? What does that watch help filter out events?

A

So that's like the first part of the question and.

B

Events are very interesting because they're, not resources that you would create or interact with directly, so I think that they were originally put under the get command to just have something, but it's it's clear that it needs to be its own command, because it's a resource, that's not like other resources.

B

I wish mache were here, he'd, be able to give a lot more on that. So.

A

I I guess what I was trying to say was um in case something was so cute will get events and something was specified. That is a limitation for get events. Basically, so can there be client-side warnings produced saying that events is the command to use, or something like that, so my context is basically the apis of a warning mechanism that exists currently.

A

So if you are using an api version that is deprecated and to be removed soon, api server itself is for warning, saying that hey this is deprecated, it will be removed and so and so version. So something of that sort basically.

B

The right words.

A

B

I know what you're saying so yeah we can definitely make sure to add a deprecation message to um get events, that's something that we can just print out. So that's good feedback actually.

A

Also get event get. Events in itself is planning like plan to be deprecated once this goes. Ga.

B

We deprecate things with the intent to never remove them, so it might be marked as deprecated and it might print out a hey. You should use this event command anyways instead, um but it will probably never be removed just for backwards compatibility, but we've done that. A bunch where we'll deprecate things and try to direct people to something else.

A

Okay, so does anyone have any more questions regarding this.

A

Okay, I guess not so are we? uh Are we going ahead with storage like seafood protection cap, or does anyone have something else in mind.

A

E

D

D

uh I'm just suggesting like since uh eddie is already here. Maybe you can look at you keeps it.

A

A

D

That is that a cap.

A

For anywhere, let's, let's look at that sounds interesting, I'm down for anything else in the real containers. I.

B

Think we actually did debug. We actually had lee on the call. Oh.

A

That was for uh the note cap like fm, maybe not.

E

A

Yeah we can take a look at debug right now.

C

A

Oh wait did you is that the vr sorry.

D

Yeah there was a beer, sir. uh I just got that from the announcement sheet.

A

Oh um yeah so um wait when was this filed, okay yeah! This is.

E

The latest, because.

A

I remember there being a few significant changes uh to the chem so yeah. We can take a look at this for sure. So, just to like be clear again. If there are no other questions, we can start with this.

A

Okay, awesome I'll. Take that as a no. So um I will start a timer again starting in three two and one.

A

Oh that's time, but I'm like, I still have some uh part to go. So is it okay, if you examine five minutes.

E

A

Oh okay, so that's the additional five minutes uh just to be sure. Does anyone else require more time a couple of minutes? Maybe if not, we can start discussing.

A

Okay, uh so any questions right off the bat.

A

Okay, I can start so um I I had a question regarding like understanding, um cube, cuddle, debug and then specifying hyphen knife and container.

A

So if there's a section which says if hyphen knife and container is not specified, then you might be then you're saying then you're instructing cube called debug to change the image of one or more containers.

A

So if my understanding is correct, does that mean that in the copy of the port that is created for debugging, all the containers in that pod will now have the image that is set by hyphenation image if the hyphen i1 container is not specified? Does that? Is that what that means.

A

Did anyone understand that particular uh part.

D

I think what I read was so, if you specify, let's say uh if an image is equal to busy box and specify a container, let's say my container: if the container exists in the original part, then the image is replaced.

D

If not a new image is a new container is created with that image, and if I want to replace all containers images while copying the board I will use fnfn image is equal to star, is equal to busybox, so star would mean okay, I want to replace all containers parts.

D

Yeah, I see it's uh there in this section.

A

Yeah, so the part that confused me was that basically, the section is the modify application image by copyright, so the part which confused me most was like the second paragraph in that section. So if a user does not specify hyphen iphone container like is that star, basically uh syntax for something like I see it, uses mutation language defined by you current set image. So is that something that set image defines like the star part of it?.

E

A

Okay, yeah, the star part of it, is something you've got to set in this defense. So that's probably it okay that I think that answered it thanks.

B

Yeah that is really confusing. I I'm reading it a few times.

B

I wonder if the help from the actual implementation is any better.

B

It looks a little more clear in the actual health output.

A

But then, like.

D

A

I feel like if, if you need the star thing to replace all images of the container like what.

B

A

Kept basically read to me was that uh if you don't specify hyphen iphone container regardless of putting star or not, the image will be put into all the like. The all the containers of the copy will have the image. Basically, because you don't have a target container anymore.

B

So it looks like that flag got named to set image, so there's a dash dash image in a dash dash set image.

B

And you set image with the star: that's why I'm that's what I'm reading from the help, but yes, that is very confusing.

A

Okay, I will I will reach out to the author about this, maybe for ga they can clarify it up a little bit just like a general uh enhancement type. So question so can like cosmetic edits, be done to caps after enhancements during the release cycle, or does that have to wait for uh next release? Typically.

B

Navaroon can correct me, but I think we're always able to clean up and clarify wording of caps.

D

Okay thanks: if it's not a major change, it's fine, because uh during implementation, a lot of things get more clear and it's okay to change minor details here and there keeping in mind the essence of the cap does not change. Obviously, when the cap changes you have to get approvals of the sick leads and as well as pr approvers will already be approving that so yeah.

A

Six years for me to sign sign up on it, thanks.

D

Looking at the use cases, given it's very complicated to decipher all the cases that that are possible and all the possibilities of cuba, city work.

B

Yeah lee is very adverb, is very awesome and receptive so feel free to shoot all that feedback over them.

A

Okay, uh any other questions regarding this.

A

So, if not so just another sort of clarification and just to make sure that I've understood it properly, um so there are two levels at which you can create or debug fml containers. So the first level is that if you have process namespace sharing enabled then by default, all the containers in the pod will share the namespace of the pause container and then, when you create the debug fmeri container automatically that shares in the process.

A

Namespace that's one level, but if process name share sharing is not enabled, then you need to specify a target container and then the target containers namespace is then attempted to share with the fml containers. Namespace provided the runtime supports uh process namespace sharing so like. I just wanted to make sure that I understood these two levels and obviously, if the runtime does not support it, then you can't uh create a funeral containers of such nature.

B

Yeah, that's one of those things that I had to play with to understand at all. um It was pretty confusing, and I mean this is all feedback that we're supposed to be capturing now right. So that's good and the the recent addition was adding the profiles, because that was one of the feature requests. So that was the pull request that you it was linked.

B

The people wanted different, like sys caps on their containers to debug them, so.

A

Okay of sorry, what I'm going to.

D

Do you know I was just making.

A

An observation like uh process namespace sharing, like I saw that it's enabled by default since it's stable since 117, uh so I'm guessing like only if someone goes ahead and explicitly sets the cube that flag to false, then such an issue would come up. Let's say.

D

uh Yeah the question I had was or call it out, um so I see two terms: one is process, namespace sharing and the other is container namespace targeting. So it says like if processing space sharing is not enabled, then we will try to target a specific container and it will be created in the namespaces of the target container in runtimes that support container names by stargating. So are these two things the same just with different names or they're, completely different container runtime features.

A

So from what I can tell uh process, namespace sharing happens. Sorry, uh I I feel like I might have misheard your question. So did you say like it's? It's two different things as in the processing space sharing in general, like the process were sharing of the pod and target names for sharing of between two containers or.

D

Yeah, I am I'm.

E

B

D

I don't know the concrete answer, so are those two things, the same things or they're different.

A

So what I think, at least is the difference. Is that in process namespace sharing, as in like the feature called process, namespace sharing, what happens is you are sharing namespace of the pos container, which is created with all the containers that are created in like as part of the pod, basically, but in target namespace sharing? What you're doing there is?

A

You are just sharing namespace with the target container uh that you want, the that you want to debug with your fml uh container, but then again a follow-up question that I would have is from what I've understood with pause containers and how they work and like pods in general.

A

Is that when you create a pause container, you are by default, sharing the process name space with the containers. Oh um sorry, sorry, no, I confused myself for a little bit uh but yeah. I think I get it now so.

D

Thanks so uh I think now how I see it so from your explanation and from what I understood about pause containers and containers inside the pot is so usually, if I may be wrong here, I don't have like in-depth knowledge of the runtime but pause.

B

D

And the containers which you specify as part of creating the part they share the hostname space or network namespace. I don't know what it is called exactly and they don't share the process namespace by default. So I think, since kubernetes 1.17, I can specify shared process namespace shared process. Namespace is equal to true, which will make the child containers of the course container to also like inherit the same process namespace, and then it would become easier for us when starting ephemeral containers to assume that road.

D

If it is not present, then we have to find the process name space of the container that we want to target and then attach or run run whatever image we are trying to run in that process. Namespace.

D

Okay, so now I now, I guess it makes it clear thanks mother for pointing.

A

Me too also uh the two links that I've pasted in the chat.

A

These are the only two ones I could find uh like explaining pause containers and like pods in depth, so in case anyone is interested in learning more about them.

D

A

Any more questions we have just like a minute left. I guess.

D

Thanks for sharing those two blogs or articles looks very good.

A

Okay, I guess we can wrap up. We are at time anyway, so thanks for joining again and please feel free to suggest steps for next. The next session.