Kubernetes SIG Cluster Lifecycle, 14 May 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Cluster Addons meeting 2019-05-14

Description

Cluster Addons meeting 2019-05-14. https://docs.google.com/document/d/10_tl_SXcFGb-2109QpcFVrdrfnVEuQ05MBrXtasB0vk/edit#

A

All right working when we want to be cluster errands meeting after some technical difficulties, we in the race Legion that we have review of action idols from last time. Justin, you already said you wanted to think about our work.

B

Yeah I have been thinking more about our back, trying to think about the idea of and I think this also comes up in the East dock, which we will talk about later on I think.

B

But the approaches that I've been grappling with so far are around having some external component the same component, which creates the or installs the operators, maybe also create as our back roles or maybe like bypassing our back entirely and then putting in some sort of alternate authorizer like the no.2 authorizer is an alternate authorizer for nodes and an authorizer, but that feels like a very big hammer. So more thing you had the first one, but hadn't really got much past the concept. This point yeah.

A

But the question: how should we organize ourselves should we just file issues for this and then start adding documents to do discuss it there? What is the usual way of going about this I.

B

Think issues and the design dog has least started are both grunt ways to do things.

A

B

This particular one, it might might end up more as a dog, but we also don't have great I. As far as I know, we don't have great ideas yet. So it's probably at the point. We can also make progress through discussion in these sort of forums. If anyone has any ideas, and also by sort of talking about the issue repeatedly, you know, maybe an idea will come to someone.

A

C

Yeah I look forward to fleshing that out a little bit more I'm curious to hear what your ideas are and then no doubt the Rezo.

A

Yeah I think that was.

C

All the action now and also I I suppose Justin did mention this, but who is the contributor that's doing patch 44 on the coop builder, repo Justin? That's.

B

It should be Jeff if I'm guessing the number jeff johnson, who also works at google. He is away at the moment, but I think he is if 44th, oh one I think it is. He is yes adding support for basically being able to specify patches in the sort of customized or coop cuddle patch, or lots of other things since and specify those patches on the CRD instance itself. So, for example, on your instance of core DNS, you could specify a patch and thereby change the behavior.

B

You could change, for example, the resources that were required or that were specified by the core DNS deployment the it doesn't allow. The goal of this is this approach is to an is to minimize the number of fields that you end up having to define, because you know you're not obligated, as the author of an add-on operator, to write a field for every value which a user out there might legitimately want to customize. You.

C

Know Definity. I.

B

Yeah I mean so like against. It gets into like a judgment. Call then at that point as to whether or not it's sufficiently popular, but you can also sort of say to people will look like for now just use a patch and then, if you see enough people that need to use it, you can smooth that process.

C

B

That's that's, as you say, patch 44 in the Cooper or declarative patent. Rico and I'll put a link to it in the in the notes in our, but Jeff is actually on holic this week that belief or I think just today anyway, he's on the with him. Okay,.

D

C

Yeah I thought that that was some really interesting work. All right.

B

C

Do a demo so I need to grab screen sharing. Somehow, let's try this. If you don't have permission.

B

C

Share you got it. Are you guys same yes, um this my mouths moving yeah and then I just need to move this zoom thing somewhere, not annoying all right, so the patch that I'm gonna be demoing. Today? Is this core DNS operator using operator SDK just pull eight on the add-ons operators, repo there's a lot of files? That's because I checked in the vendor directory from DEP.

C

This would I think Justin's approach of using go mod here is the way to go for sure, but this is how operator SDK generates your project and I just went with it. That does simplify the checkout of the repository since the dependencies are pre calculated for you when you clone in yet so.

C

If I come here and I check out this patch.

C

And we're on the branch- and there is readme- and here you can see that we've got like the classic make file setup.

C

Just and the first thing I'm gonna do is you can see that I'm not connected to kubernetes right now, but if I do make kind of cluster, what this is doing is using kind just set up a normal Koopa dome cluster, and then it's actually going to remove Cordia nests from the installation.

C

So it's preparing an environment for me where Gordian s is not installed and that's obviously, you know useful for developing this kind of problem and if you look at the patch I've tried to be pretty descriptive here in what's being accomplished and what's not so we wanted to take operator SDK first bin and I found that it did things that I really liked. One of the major things that I found was useful as a dev.

C

That really turned me off from ku builder was needing to modify my path during development using coop builder and I also got confused because ku builder, it seems like it depends on specific versions of kuba API server, so I.

C

That was a positive experience with operator SDK, where you have a single binary that seems to encapsulate all of its dependencies for doing generation of api's, and things like that. They made.

E

It really easy to work with I recall having to having to actually install at CD, was like to use queue, builder ones and and then you'd expected at a certain path. Mm-Hmm.

B

Yeah, let's I, we should add these a great piece of feedback for for that team and, let's, let's I always say, have questions. But let's talk about this at the end, but yeah and.

C

Then I did run into some issues, but here we have our client cluster, there's no DNS service. Oh I have to get my coop config, so yeah there's no DNS service and it could just a namespace but then yeah if I make Tucker build and then I load the image into kind and then I install the CRD and deploy it. You know it takes like I think a little less than a minute or something like that.

C

Obviously the image is cache since I've already pre built this and it just loads it into the cluster and applies all of the manifests. I did have to do some nasty stuff in the makefile when applying the manifests to like template, values or replacing namespaces and stuff like that, but it's all in there and what that gets. You is the operator installed in the cluster, so here's the deployment and then here you can just see that we have the kubernetes service and a pod, and so if I Duque get corps, DNS there's nothing.

C

But if I make install the accustomed resource, then now there's a core DNS in there and if I at all, you can see that core DNS has been installed into my active namespace and that the cluster IP was calculated properly. So that's the tenth address of the service subnet, which has been calculated using an improved version of Justin's function, that's agnostic to ipv4 or ipv6.

C

It's just a small change and then what's kind of cool about this is oh I guess you should also see that there's the config map here there's an operator lock here. That's just for leader election on the operator and then here's the example cárdenas config map which well you don't notice- is that if you actually look at the manifest that was applied to the cluster, it doesn't have a core file here.

C

But if I describe the config map, you can see that there is a core file, so that's been placed there by the operator if I edit, the config map such that, like I, remove you know, say pods, insecure, say: I, don't like that option, then.

C

Now, when I described, the config map should converge, they did not take my edit yeah.

E

Sorry does gorditas and watch the file there we go.

E

Yes, it does so the operator doesn't have to worry.

C

About that work yeah, that's because the reload plug-in right here is defined in the default config. If the user didn't want that, then you would have to orchestrate some rolling update, so that could be an option on the core, DNS Sigma or sorry accordion strd. Well,.

E

It sounds like it maybe actually I mean I guess in this context. That would make sense to say that the adoption could be something that the GUI operator must enforce, because otherwise config map is kind of useless right. Whatever I said.

C

Yeah I mean the config map is basically the only way to configure core DNS with, like kubernetes primitives is using the core file mounted, but versioning in the config map and hashing the contents and then naming it after the hash and then updating the deployment is something that the operator could do with. You know, probably another 20 lines of code, I think.

C

But yeah, if you edit, the core DNS, oh I, was editing. The config map wasn't I, so yeah I was editing the wrong thing here we go so say: I wanted to switch cluster DNS to false, because that's an option on on the core DNS and then I don't want the pods insecure option anymore. I can save that.

C

Then, when I described the config map, you can see that it's removed the option from there that should reload in the core DNS pod and then similarly, if I describe the or just get the services, then you can see that I no longer and the primary DNS server for the cluster, its recreated to service. So that's the operator functioning for two different use cases. So, yes, I.

E

Was trying to do this is very goodly thing, so much just I'm, just sort of thinking, thinking out loud really, it seems like most of most of the things that go into this core file are critical to the functionality of the operator and an actual core DNS like, for example, the path to resolve common reload, as we just said, and 5343 at the very top. So those things if you change those in any way the whole thing would probably break yeah.

E

So it seems like maybe there's a certain set of things that have to be built into the operator, and then user adds extras on top of that, just just as an idea.

C

Right, the Justins operator has a useful abstraction I think that basically, the core file has some special strings that the operator is capable of templating into it. It's a pretty common pattern from you know like. If you look at like the puppet world and stuff like that, where there's you know a standard template and then the user can provide some configuration string for which operator abstractions are like some module abstraction those values get interpolated yeah.

B

I mean I'd, say this is an important question. We should definitely figure out. It's not necessarily a like which technique to use I think the my implementation did basically didn't allow any end-user specification of the core file, whereas these implementation does and I think there are obvious shortcomings to both extremes.

B

Like a lack of customization and a lack of validation. You know I, don't know where we've full, but that's something we have to figure out, but it's I.

E

Mean one one thing that one potential way to think about that seems like you could consider having this base to take that you know can be overridden some, but in order to override it user has to do something that obviously looks like they are overriding some critical functionality and they really have to know what they're doing right. Yes,.

C

Well, for one just as a reminder, the I did not specify a config that that was defaulted to by the operator automatically.

E

C

Know field is like a core file override or whatever, and yes that is basically an override there. It gets set during runtime similar to a cluster IP losing, but if you, if you provide it, the operator is not going to mess with your declarations.

C

Which that that kind of behavior is something that I have I I. Think that that's the minimum that you can do I like the idea of providing flexible interfaces that maybe have a little bit of a better user experience or maybe, depending on the stability guarantees of the core file like ven during some libraries into the operator from core DNS. In order to validate the config, and then you know, plus Status Messages onto the CID or something but I. Don't really know.

C

If that's very useful, because you can do like rolling updates and stuff in kubernetes like we could use, we could remove the reload plug-in and then use the deployments rolling update with multiple replicas or something but I get the.

B

Four file to use the kubernetes api machinery and then that.

A

One thing else: it.

E

Becomes much easier exactly.

B

Yeah, like numbers legacy stuff.

E

Kind of very mopping glamour which have this being part of the kubernetes object and getting rendered into into the core files in size, yeah.

C

From for me, it's just that, like the mapping layer needs to be future complete like because I've run into issues. You know it's say with using prometheus operator where they put flags to change, TSD, be setting. You know on prometheus and then Prometheus operator still months later from now after I've. You know, like reported the issue and found the bits of code to change and just not had the chance to update the CRD and update the the operator, so those things are still not usable, and it's because you have to change three layers of indirection.

C

You know for that to bubble up and the contributors from the other project don't know. Yeah.

E

But then but then maybe maybe we could leave the room or somebody to provide a core file as a string as well and have a I don't know. Just another great have have a subset of behavior exposed me to release through some set of fields and have a way to just set a core file. If one really must do so,.

C

Yeah similar to to this, but then yeah you just brought on additional fields to change the generation function of your default. I like that and.

E

I think you know there are interesting kind of all things in here and it seems like I, mean Greenstein high-level use cases that that probably must explore at some point I think I would say that you know it is the only thing actually I can think of, as they like it'd be nice to be able to to to add extra kubernetes blocks in there with other domains. When you want to appoint the for dns to additional clusters and do.

C

Some sort of across cluster service discovery yeah, that's exactly what I was thinking with this, because you can specify your own core file with multiple. You know like zone delegation or whatever, and then you can do cluster DNS true and then you can have multiple core DNS is. You know scheduled, however, you, like with cluster DNS, set to false, oh right and then, like you, can you can build a multi, a multi instance topology using those resources, yeah.

E

But I thought you could do them once one core DNS you just on where you have the kubernetes cluster local blob frame. You could just of those things like just modifying this yeah so.

C

E

You know you could have like you can have like a high level to just just brainstorming terms, but the high level field, where you say extra extra clusters or connect with clusters, and you specify addresses of API service that are external to this thing. Then.

A

I'm sure somebody is just.

E

Just just as an idea right, but like aside from that, do we think there are any other these cases I mean caching parameters or anything that at that one month, might one optimizer it.

C

The one thing I kind of in hindsight, I wish I would have exposed the I wish. I would have proxied the cluster IP filled into the spec, because there's no way so you can specify whether a cluster DNS is true or not, but you cannot control this value if it is false.

C

So that's that's one thing that I, it's like as soon as you build these custom resources on top right, like it's a leaky abstraction, so not that this is mutable, so I don't know, and maybe you should never. Arguably, you should never care what this value is, but I.

C

It makes it kind of difficult if you really want to like use the 11th address and the 12th address, or something for reasons. This.

E

Is I think one of those problems that, as part of this group we should we should discuss more because with DNS, you have this issue where you know there's this thing that gets passed around, there's a cute little flag and it is also filled with a service, and you know those those definitely link up. But there is no inherent linkage there. So I was wondering whether whether we should consider trying to solve some of those problems.

E

Somehow specifically so one other similar same thing, which is yeah not very similar and I mean they're due to about DNS, is that the domain name is something that is part of the DNS configuration and social class 10 as a Cuban flag.

E

Okay, we have a default, which is something everybody agreed on, but like the the IP address is a bit is a bit trickier and the the other very similar thing that I've encountered in eks or well I, guess more generally, it's a thing that that is that can be observed in the AWS, GTCC and I. Think maybe the EPC network driver by aw. Yes, that that uses elastic network interfaces and the secondary keys on lots of network interfaces has fought IDs.

E

So that brings up a limitation to maximum number of thoughts on cubelet can run, which is based on instance type. So essentially, if you were to use either Leah's gni network driver, you need to set max pods in your queue length, config file or a couplet, and you know so. Yeah.

C

E

So how it relates the chord DNS, but if there's a so it is, it is something that is well be. The network piece is effectively an add-on, yeah uh-huh that imposes a humid flag. Similarly,.

C

Across the dot local, that's a component config thing yeah, it's yeah.

A

C

Chat about that in the component standard working group, what.

E

I guess, but it's me inserting I think I think it is and I don't think as well. I mean hey.

C

I do agree, yeah it's it's in the same space yeah, so I'm.

E

Just I'm not saying that is something we should jump to addressing, but it seems like something that we should possibly be plausible to discuss a bit more down the line. It's it seems like you know, there are certain add-ons that they do have those kind of implications and I wonder what there is that a you know the waited to address those or if we are gonna, say that no, there is no way to address this.

E

We're never ever going to address this, and anybody who has a special use case by that has to deal with that. In this case, I.

B

Think we should I think we should absolutely tackle those issues, but I think at the same time that is common. We now have two approaches we might be about to have three, but we have two approaches and I think that those issues are common to both approaches, whereas I think we should look at the things that are different between the two approaches and try to understand the strengths and weaknesses of each right like so, for example, the path thing felt like a difference.

B

It feels fixable, but you know it feels like a difference and I was actually like. Thank you so much for doing this Lee, because I was really I thought. The difference between the two approaches was actually at the end of the day, very small and actually boiled down primarily to whether it was in in your code. You built the objects, the kubernetes objects in code and in the I. Guess my god, but you know the other one. We built it by essentially loading a gamma file and I guess I guess.

B

My first question is like: do you know if operator C can mandates that or definitely not? In fact,.

C

B

Started during.

C

The declarative pattern, the control loops that are generated are by operator SDK and qu builder are very similar as.

B

C

Dependencies, yes, yeah.

B

I was I was like if we, if we put like, if we put the pattern into operator CK, it felt like they would be essentially.

C

The same yeah yeah so I was like. That seems especially if you did the go mod hacks that you did either way. We should like.

B

One day we'll get there but yeah I'm sure I would have also had 9,000 files in my PR. If I had not.

C

And then, like the only thing to really consider is trying out the operator. Sdk UX is obviously different, and then they have like an opinionated build with a docker file as well as you can use like bilder I, think, and then they have integration. So the one additional dependency, that's not a cougar Nani's dependency in the go package is.

C

From core OS and it's from prometheus operator force I believe service, monitor, so I would be surprised if that was available in good builder, but basically that's instrumenting. The operator which feels.

B

That feels pretty easy to yes: either system, I, guess yeah, yeah, I'm, gonna or add to the other, or what am.

C

I, especially after chatting with Lucas I'm, not sure you know how much Red Hat folks want to comment on up streaming or like doing kind of something governance related with operator SDK and like merging it into goo builder.

C

But obviously we have existing initiatives to you know get all of the KCM loops to be COO builder loops, and it makes sense you know to to have the community using unified tooling, not that multiple ways can't exist, but for upstream components it makes sense to use qu builder, in my opinion, but yeah, it's they're, they're, really similar. That's I.

B

Guess I guess the question I would have then is: um do you Li and do we as a group prefer the declarative to approach where we essentially have a Yama flower or do we think we want to build them in code and I have diocese and I can leave like.

C

We can so like I will I commented in in my patch that, like this was time zooming yeah.

B

I didn't know what they thought it was time consuming, but worthwhile or time consuming, but not.

C

Yeah and I mean I, guess you know it's like you can not even know which patch this was probably this one has like all of the constructors in it, yeah I mean I, don't I, don't know if this is really less frustrating than yeah mo. It's I I think like really, if I reflect on authoring yah mo it's usually copying and pasting from other places and like making sure field names are correct and then trying to apply them to the cluster and running into type errors.

C

uh I I, don't know if, like authoring, I I just feel like like authoring kubernetes yeah Mel. The tool chain is like not good. I'm.

D

Always certainly.

E

C

Validate yeah yeah.

B

C

Far as like, knowing that this was correct as soon as it was written, I didn't have any problems. So that's the thing but yeah.

B

I'd say the I to the to the to ask questions. I want to ask our like do. We then have to so I think I think the batches are that a Yama file was more. What our intended audience of like accordionist, Phillip ur, will sort of expect like they've, been writing a memo file today. Now they can wrap it or not, braid it without too much work, and then I guess the question that I have is: do we have a way to not have to build a new operator so like if release 1 3?

B

If according mysteries is 1, 3 2, it looks like I think I saw one free one. We have to build a new operator right. Yes,.

C

Yeah, you would have a.

E

Which is a little bit important I think there are quite a few trade-offs here. Definitely I I definitely appreciate some of the benefits that you get when you write out the go starts, and you know if you did that you come your program, compiles you're, pretty much all set it's like. If you check them all. You have to then use BIM data whatever to turn that in and then you have to test that and do all that stuff right.

B

And what we're now fuse been data, but, okay? Yes, you have to use as many attesting cases it's harder. Yes, yeah.

E

You need to to to make sure those are in place, and one thing that I found is something that you may wish to address here or elsewhere, and when I'm hoping to start addressing that, somehow, basically that, if you, if you have like a at least define in a mall, say parcel or you know a multi doc parsing that and loading that in and and creating or updating object based on that list is surprisingly much much harder than than I ever hoped.

C

So I just want to move move on I'm.

E

Not really about.

A

C

Later yeah there's in the document that I posted I have a whole section on packaging, which I don't think that a go file with a bunch of structs in it is acceptable packaging. So, to your point, Justin I I would be very interested to have a more full understanding of crew builder and the declarative pattern, but I'd excluded it, because this was my first foray into operators. That's great.

B

I can I'm happy to get like a quick focus demonstration because, like to Ilias point? Yes, it is more work than you would expect and we've put that boilerplate into the declarative pattern, along with like being able to load from like files or HTTP or the models.

C

B

C

Type anything so there's.

B

C

Fancy stuff in there that's like epic hard to do like reconciliation of files like when they're related things are different and stuff like that which I have comments on in this patch. What I do want to highlight, though, is that if you look at this commit, this is a productive thing to look at is the updating operator are back with granular permissions and comments. I. Think that something like this is going to be good practice for distribution of anything that requires privileged installation.

C

So, even if you're not using an operator, but you should, you should have like some distribution of our back definitions that can be purposed for what you need in a specific, namespace or set of namespaces, and you could maybe key that by like some namespace key that gets overridden by user options and then also the cluster wide things and they're split up into separate rules.

C

So, if you don't know the are back API like you can specify redundant rules that override each other and they all eventually Union together to be one effective thing, you can also bind multiple things from multiple levels to the same service account. So that's a that's a thing like I'm, using role by names and cluster rule bindings to get the proper mixture of permissions for single service account across the cluster for certain things and in a namespace for certain things.

C

There are other weird things in here that I expected operator SDK to generate for me nicely that we should fix or and the same thing in goop builder, which is that, like leader, election should have its own section so that that never gets conflated when the user is trying to mutate their own things really I think it's an interesting thought experiment to explore how we could generate these rather complex definitions, but right now.

C

The reality is that you need to know how to how to write these things and- and you need to know what your operator is doing and what verbs it needs and what API groups and resources its operating on. There's things that are not incredibly clear, like you know what the name of the CRD is and how to reference it, but yeah this is. This ended up being more granular than what's on Justin's, PR and Mike. That's probably just a function of time and attention. So that's a learning thing there, but the comments are helpful. Yeah.

B

We should definitely make sure we have to come and tell at that I'm conscious of time. Sorry, yes,.

C

Let's move on if again, all of this stuff is in open, yeah, real.

D

Quick on the Jo from the operator, SDK team, so first like this looks great, like thanks for a lot of the feedback. The other thing I want to bring up. Since you mentioned it is that we've started to look at the possibility of how we might converge to builder and operator SDK. So if you guys have thoughts on what you think would be good to pull into queue builder from SDK or vice versa, definitely would be interested to continue. That conversation.

D

One point about the our back stuff that you were just talking about the so the operator STK has a helmet art support which actually will parse the helm, charts and generate. All of this are back from the helm chart. So.

B

D

Could be something interesting to look at in terms of inspiration for how to do this? Mm-Hmm.

C

B

People it has the ability to like look at your comments. It doesn't do sorry, your comments in your code, but it doesn't come at the output Gamal, so I'd really like to get that more granular but yeah I don't know operator. Ck has granular output, yeah.

C

And serially DC output in ml from go that has comments in it is yeah.

A

C

Kind of non-trivial so anyway, thank you, Joe. That would be really good to make some progress there on factoring the projects together. So I want to definitely give Evans some time to talk about OLM, because I was really looking into it and it looks like we might in my opinion, there's there's nothing that's doing what OLM does so I can give up sharing there. If anybody has in any other comments, please PLEASE close on the patch and go download it and run it and modify it.

C

Executive king, everything.

C

Looks good hey um so don't have a huge amount of time, so I think I'm, probably just going to try and paint some like broad strokes of what om is and attempts to do.

C

Essentially, we are trying to think about applicant creating applications and operators as extensions to the control plane. The CRM.

A

User API services.

C

And so the question is: how do we open up the cluster for extension by developers and users apologizing the silence.

C

Until we try and think about what it looked like that, like a set of extensions working together in dependencies and tucking me safely, a lot of changes.

A

To those things.

C

That are trying to deal with updates and so the model that we're gonna that we have right now. um You know to use very much for D package and act or art Neiman young to actually have two separate pieces of software that Olin operator and the catalog operator on the new Olin operators, sort of the analog to rpm or any package images. Just the individual magnetism selves and the way to represent them and very similar to those flight specifications are used for in operating system package.

C

We collected metadata about what an operator does into the way that it extends the cluster so that we can make decisions about what should be allowed on. So we go to offer you in gently and just like, walk through some of this basic workflow that we have so similar to how you might have an operating system. We have our posit Ori of operators for install and fine I've, never installed , the horse I'm just going to see if this is even a good operator.

C

So this is sort of the young install equivalent great, so I'm saying.

A

That I went yeah.

C

I went coming to be installed and subscribe me to updated us. The main difference from like you know less package system is that it's.

A

Almost like mixing like in Omaha style,.

C

Update to operating system packages, I'm sold stalling here- and there is an intermediate step that I'm gonna quickly box over riches that we have it's all pencil it. What happened is this generated install clan I'm, which tells me which packages have been are being managed by the cluster right now, you can go down into this and see what was installed and changed out. So in this case we created this here D that I mean so this is an important variable and is taking the ability to create a series away.

A

From end-users and putting.

C

Away your abstraction between so Olin creates a CD for user, and then it also created a service accounts, cluster, cluster or binding that are required by the operator to wrap and then CSV and their customer service version is the equivalent of our packaging format for an operator, and so we derived all of that. All these things are needed, formal, the definition of the CSV I'm going to go and look at this.

C

This is an example, so the main thing that we use when we're doing this is an operator describes which sear these it requires to run. So, in this case, this is.

A

The one that this operator is responsible for managing so.

C

This indicates to us that, in order to use a common object, you need to have this common operator installed right and the other can use this word for saying things like once. I have this installed can create another algorithm that also says that the ones come because we'll start fighting for control of their comments there. There is. This doesn't have any dependencies, but there's also you can in requirements and can depend on another operator, and then during that install set, you don't find provider that API solidly much like custom research definitions.

C

We install API services if necessary on the this is not even get service, so it's empty, but there the syntax is much the same. We do we set up all the aggravation API services for you and wire it through, so that if you want to write an operator as an API service, instead of as a charity-based operator, you can do that.

C

Another thing that comes into play when they're dealing with extensions to the cluster is where operators are allowed to operate, and so this is I, think sort of where the first bit of complexity comes in and because, if you have, for example, an operator installed on all namespaces.

A

Not pretty installed.

C

Watching single name space, but they attempt to use unique guys, the other problem and so not a lot. Raters can be configured to watch all night cases or one make space for many. And so we ask packages to tell us which things they can do and then yeah down in the attics.

A

They can know the way, but she didn't solve.

C

It so this is all sort of like the metadata around like what one needs to know to install and run thing. We also have requirements for the operator itself, so.

A

In this case, this.

C

Doesn't in order to install the software here, it needs to have these permissions cluster permissions indicate that it into another cluster scope. So when I created that subscription and I'm installing the catalog operator, we call it reduce that down equivalent when figured out all of the necessary are back from reading this description here. If you're, not using a capo operator and I, create the CSB directly, it doesn't create it for you, it just with blocks and says I, don't have permission to install the permission.

C

I need, please create something that so when we're talking about the relevance to cluster atoms, I'm, not sure like there might be a stage at which we'd say you don't want automatic resolution of this.

A

Type of cleaning to be bootstrap in some way like it's.

C

Very much a two-stage process and then, if all of those things are met, then we have a definition, an operator clearly as a set of components, and so again this is where I guess it's the main cases that it should be watching when it starts.

A

C

Then we have a bunch of status around what things are happening for this operator, so in theory this should not be running.

A

C

Succeeded and then I should be able to create a con. I have no idea what this does, because I've never used it before. It seems like it creates a bunch of ingress which you expect for home some of the stuff. So the reason I'm using the UI is because we also collect some information around what the CRA is doing and so I can associate the CR with things that have been created because I'm crui this is I'm just running a mini view. This is not the Winship I'm just running you.

A

Know if that's.

C

Using owner references Jeff like is that just a controller on the owner, X yeah, this is using owner references, but it's we because there's not a way to do American sister equity, the pocket expect just says, tell me which types of resources support and then you creating those in debates.

C

So it's dynamically, creating a controller to get that info. Well, this is actually. um This is all ok cool thanks.

C

We could easily do it. We do like we do interpret.

A

Item and add labels and use the labels to query finds item.

C

C

C

A

I guess maybe if.

C

I go into service accounts and our old windings and buy.

C

Delete list, or maybe I shouldn't see my operator go unhealthy eventually.

B

Of course, discipline healthy, or does it eventually reconcile it.

C

That makes sense, because if you wanted to revoke it, you wouldn't want to be fighting, there's, probably more mature ways to do that kind of thing, but yeah. If it's if a role binding disappears, there's probably a good reason, but.

E

C

Something I didn't talk about in my patch, but each core DNS gets its own sets of role bindings. Even the cluster ones are namespace by name. You can revoke individuals.

A

C

C

Right now is a big file that points to image. You have a deployment just some things that were you know it's like how it was the best way to represent set of resources that represents an operator.

C

It's not doing a big, interactive chemical series, so forgetting about the analogues to like helm, has a.

C

Obviously, I based format and rest as opposed.

A

To a based on that, through various sets.

C

Of nano manifests, we might make sense to use something similar for operators or even using one business system formats, so that kind.

A

Of changes of the guys a lot because there's.

C

Less stuff directly anything.

A

Yet on the cluster we see there's more stuff in.

C

Image definition: I'm similar.

B

And that's different of the big gala file. You had a shirt, the start with like had that CR DS and then the deployments and their custer roles yeah.

C

B

Very similar to that.

C

Is on the love engine, water, yeah.

B

I was almost wondering why you had that, and why, like, how much that can just be inferred from the amal manifests that you're gonna cook could apply anyway.

C

Well, that's that is the artifact essentially so.

B

So the service version is all those things combined.

A

C

Can but if you have some way to talk about a set of resources as a single entity and then you might not need a real ya, know, object and.

C

What was that second OCI format he talked about? There was the home 3 format and then there's called over or rats or yeah. It's the one thing: it's a microsoft saying something see now setting the bill but close to a part of tunnel seen up I. Think.

A

It's part of seeing it I think it's the.

C

I might be mixing stuff up, but I'm pretty sure it's the registry.

D

Side of CNN yeah.

C

I I think the packaging conversation is really important. It's as important as the security conversation like Daniel said. Please go read the doc. We've started some enumeration of things to talk about there, I also like the idea of just a customized base. You know get repo referred to by Hoshi courts, get library as a package I think that that's a really solid idea from the customized project, because, as an operator like or as as a human being working with kubernetes clusters like setting up helm, chart repositories and stuff like that is oftentimes unnecessary.

C

Especially when you're just trying to fork something or or extend something in a really simple manner, supporting a good repo is a good move but yeah the supporting that arrests format from scene AB could be a really powerful community. Sensitive move as well.

B

We should try to stick with things that are part of communities, I, think and not things that are not part of communities, but we should try to figure out what that offers to us. We.

C

See, and is the only part, is over those okay, so I mean like having a packaging format that the community is already ratified, makes I'm just.

B

Saying fully before we before we go outside the community, we should look at what we have in the community. I think.

C

B

Just support events. People would be good at then.

C

B

C

Customized does.

C

Yeah, it looks really useful. Thank you so much for your this short demo, yeah and thank you. I was.

B

Really that was really great to see I can show you I had a whole big presentation. If you wanna share, we do.

B

If you won't put it in the agenda, Abby I don't want to see as.

C

B

Sorry, we cut short your time. A little bit notice cater can able to paste the link into the agenda. That'd be great yeah and.

C

Any other resources as well, if you want to link people to videos or blog posts, I link to blog posts that a contributor talked about OLM in the chat so could also give.

A

You some some time in the next meeting. Absolutely hey I, really think that it's a powerful.

C

Component, the dependency management that is like very good so.

C

Because yeah, if you have stuff that depends on custom resources when and the CR D is not installed like a clustered, bootstrap doesn't even make any sense. You have to have some kind of ordered bag.

C

A

You do something almost.

C

Like bluetooth, where we have just enough kubernetes around to start up cluster components but then having all those cluster components as hold on things like strip down rollin, just as a she became like package or took your names and again things that describe the way to interact with each other yeah, there's a there's, a section at the bottom of the doc about add-on management, which is exactly like in the space of OLM, so that dock that we have to postpone because of time. But there's a there's a section at the bottom.

C

For like example, proposals, if, like you, want to write some interesting ideas with regard to paring down components or just proposing outright using them. I already wrote an example for using OLM to manage operators or manage add-ons those operators so well yeah find that talkin. So it's yeah.

C

B

C

At time right so like, as you say,.

B

Daniel then sorry, let's you say Lee we probably should punt your your thing to next time. That's right, but geez! Everyone! That's here, have a look on in the in the agenda. There is a links to Lee's dock, which describes a lot of problem space where we can I guess have that discussion and at least just get that back into caps and update the original captain. Do all of those sorts of things. I.

B

Think Lee, you and I should also figure out how we feel about the to add-on operator approaches and anyone else wants to comment on them. Please do do so. It does seem like I, don't know. I felt like there was a movement towards going more declarative and looking at what that would look like even with operator, Sookie and I. Think the nice thing is it then I, honestly I don't see much difference. So if you wanna use I've heard a Sookie, that's great, but yeah. Let's talk about that more next time, I guess.

A

All right thanks, everyone and I guess we'll see each other in two weeks or next.

B

Week at cook time.

E