Kubernetes SIG K8s Infra, 12 Oct 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes WG K8s Infra 20181012

Description

GMT20181012 160405 k8s infra 2058x1350

A

Okay, hi everybody. This is yet another meeting of the kids in track team. October 12th welcome everyone. We are recording this, so please, you know speak appropriately, so we do have an agenda. I! Think I, don't know if you have quorum. Do we wait for somebody else, or can we get going? It's good? Okay, let's get going so on the agenda. The first thing that I have is me and Aaron had a quick chat about charter and we discussed a few points. There is a doc, please open up that doc.

A

So before we go our let's open the doc, let's go there, so the the idea here was: can we use external facing services as a list of goals that we would provide to the community in general and I listed six of them at this point?

A

Maybe we can combine a couple of them like GCSE, the apt rpm might come at a GCSE, for example.

A

Maybe I should just do that right now, or is there any other organization that people can think of that? That was the first thing.

B

I'm talking that I guess we do the same as we're doing as Justin suggesting for cops, which is s3 and TCS right. I've actually started a doc which says exactly the same thing is Justin's pretty much so we're just gonna merge into his.

A

Right so so, basically, what I'm saying is these: are the goals for this working group to provide these services and I'll reef I, you know, say it in a different manner, but in effect these are the list of services that we are going to provide right. I.

C

Mean those are the starting services, yeah I, you know obviously over time there's those changes right. Yeah then.

D

Basically, these will be like a sub projects.

E

C

Doc and take notes: I lost the doc now yeah.

F

Sorry, I'm mobile, so I can't see the notes either.

A

Okay, you know, let me share them, say.

F

Sharing cheering would be yeah.

G

So I see we call out gke clusters for running bots utilities, proud setters I, don't want to call out more of the tested infrastructure or is that? Because, like I mean there's, you know Wow, but there's a bunch of other stuff there's like all the.

H

G

We run and test grids, and things like that know if it's worth explicitly calling all that stuff out or if that just kind of falls under he's already yeah, it's go ahead. I.

F

A

F

Going to say the the sundry like test infrastructure that we've run on clusters, I would consider DB etc. In this context, like I think my it's tough for me to read this sorry but I.

F

He focus on more of the base level infrastructure before we focus on the testing for stuff that runs on top of all of that to.

C

Jeff's point, though, the test a lot of the test infrastructure doesn't specifically run on gke clusters. It runs on individual GCP projects right in my interpreting correctly Jeff yeah.

G

It's a whole bunch of projects, and we generally aren't necessarily using gke, is just GCE BMS right.

I

C

I do think that falls under our umbrella, so.

F

Are you talking about the pool of projects that Costas manages when we spin up content clusters or more than that, I.

G

Think that's what we're talking about here. Okay,.

F

Yeah as I would consider. This is something that this is why I like, when Ben tried to scope out moving prow and whatnot, it was going to be a little bit of an extended effort because we wanted to be able to plan it in the context of billing, which is a key requirement for all of these projects to be able to describe what resources were using.

F

How and why, and right now, for testing I think that's spread across a pool of projects that were, at one point dedicated to specific things better now, just kind of test pool projects, so I would consider like, in the context of tests infra that we're going to want to talk about like a project to run some of the infrastructure and then a project that is for hosting all of the cluster. In like testing capacity, sort of right.

A

So I added, can you guys see the dock and now? Yes, yes, okay, so I added a full of computer sources for testing. Would that be a fair way to characterize it? That's.

C

A

Okay and then the next thing I wanted so fine. So let assuming that this looks good, so the things that we need is credential, store certificate, store and github repository for storing the artifacts for requesting new resources.

A

Anything else we need there to start with again. This is just as a starting point. Yeah.

C

And I mean even the like credentials and certificate store, aren't obvious that we need them just yet, but probably will write. One example.

A

From Stefan was he's using a gate itself to store, get clipped, I, guess or something like that for the publishing bot. So in effect the information isn't it, but it is encrypted. So maybe we can start with the just that the.

C

Information, oh the credentials for the bots to use yeah publishing BOTS to use yes. Yes, all right point taken yeah.

A

So we can start there and then we we can see what what we we we can grow things as we need. So this is something like you know here to figure it out over a period of time, but we definitely need a git repository and we can get started with that. I think so.

C

We have the case that IO repository, which is where the DNS can fake lives. Now we can continue to use that you know as the list of things we want to get checked in grows, we may decide it that doesn't fit the scope right.

A

The one reason yes I agree with the artifacts part: how word for incoming managing incoming requests like, for example, the cops folks we're asking for you know, access to it, some a dubious infrastructure right or the cluster API for cluster API provider for AWS. They were asking for some resources to test the code that they're developing. So things like that, we need issues right now. We use all get the kid k, dot org for the data hub, related issues right. So what do we use for for us? So sorry,.

C

I'm releasing what do they want to check in so.

F

Say they wanted to be able to use AWS to test the cluster API provider project, and so for me, that kind of falls under they should file a ticket which testin fret asked to be able to use tests. Infra on AWS I feel like we are not at the point where we want to create some kind of ticketing queue specifically for this working group ingredient.

G

F

Because we're working group like we, don't we don't own code, we should be finding the people or the appropriate groups to own the code. For these things, how.

A

About for cracking our own work, can we continue to use kits io for that I think? Yes,.

F

A

F

Be great and as long as that's what you're asking.

E

F

Fine, it just sounded an awful lot like they had a request. It'd be great if we had to take it in queue for them. That's we're not there. Yet the.

J

The other thing that we can possibly do is there are like organization level project boards in github. So if you we wanted to like track requests that we're in both Kate's I/o or mice- maybe something and testing from, but it's all related to us, and we want to track that work together.

J

We can do that control country back so started doing that I.

A

Seconded okay and we would the project be in the case, reports of.

F

Yeah in a kubernetes org, you can create org level projects and then you can assign permissions to different teams to be able to write or read to them. Okay,.

A

That sounds good to me. Yeah.

J

So they're not associated with any one specific repo, and you can add issues from any okay and.

K

I have to mention that these projects are visible only to their arc members and I. Suppose that's that's fine. In our case, it's probably.

J

Okay, we can make them public as well. If we wanted to contribute, was for a while restricted just to the org, because we were just testing out the board, but it is possible completely to make the board public debt are quite.

K

The egg white bird- yes, because approximately a year ago it was not possible at all. Yes,.

J

Yeah, it's changed.

K

Okay, missed it.

A

Okay sounds good: okay,.

L

A

And then going to how we work so do we need to what to establish it's a project? We know that we are starting with a few above, but then for anything new. So.

F

The tricky thing for me, maybe I'm, the only one who cares about the details on this- is like working group barely on some projects because of projects our code. What are the efforts that were focused around? We should figure out like which sig does this thing belong to, and we have representatives from all of the SIG's that this working group cuts across so I think all of those sakes should have their charters in place to figure out how they establish some projects.

F

Historically, I have only seen SIG's choose the tech leads option, I'm behind the ball on getting six hustings charter up, but that's the option. We're gonna go with as well right.

A

But basically the why I'm asking this question is: we need to name at least a few people who are interested in making something happen. How what is the process for making sure that they write up, something which somebody else approves. So we can then say: okay, you are blessed and let them go their merry way and add more people recruit more people to get whatever they need done done right.

F

So, for what it's worth, I was thinking that, in the context of our charter, we could we don't necessarily have to hash all this out today, but we can describe that part of the scope of our Charter is defining the processes and policies to run and maintain this infrastructure. As we hand it over to the CN CF, potentially I, don't know how this group feels about the idea that maybe one day the CNC F takes over management of this stuff or whether this stuff will in remain managed by the kubernetes project in perpetuity.

F

It just happens to be funded by the CNC yeah I. Don't.

C

Think CN CF wants to take ownership of these things. I think the the position they've taken so far is as administrators of the property rights and the business side of things and less about the technical side of things and I think that's appropriate I think this needs to be something that we plan to own forever. Okay,.

K

That's that's correct, so we're owning like on the bill, insight and administration side and we are CN, CF I mean, but we as the community group, we are owned, and so you, you are working on the technical side right.

A

But II or over a period of time we might actually get some professionals to manage these resources right because it's we can't do a bunch of things with the volunteer army.

K

It can be discussed anyway, like the intention of this. This movement was to move all this assets to the community itself right and the community will manage them. So not CN CF, not Google by the community, understood.

J

But if, if if at a later date, we decide like hey, can you fund hiring? You know a whole time, sis admin or something to to do this? To do this work, we would have the ability to decide that in the future, yes, I.

K

Can cannot say yes, but I cannot say no, so it can be discussed, but I don't see any clear reason why it should not happen.

F

Model I was thinking of, for example, is how one day, long long ago, we used to have Google running its own CL, a bot, and then we switched over to the CN CF CLA and the CN CF has provided a bot for that. They also provide a help disk, which has been tremendously responsive and follows a really well-known script on how to help people with common CLA issues.

F

And so it would be my hope that this group is in charge of developing roughly speaking, the run book or playbook, and that we could maybe hand that off at one point in time. Yeah.

K

So CN CF can provide some extra sources to do. Projects like you're, probably know Zac from sick dogs, so write kubernetes had issues with documentation, so we hired to help the communities communities with maintaining dogs right.

F

So it's somebody wanted by the CN CF buddy who works under the guise of the project, correct.

K

Great but that's again, I'm, not a person who makes these decisions decision, but I I should say that it can be discussed and I definitely don't see any any strong restriction why it cannot happen. So, let's, let's just keepin that in mind, then if one day.

H

K

We should hire a person we'll discuss that with CNCs for.

C

Analogy we already pay other services to host things like the website. Right, like we pay money to netwo fie to host the site, so I think it seemed great.

H

C

In the road, if we could scope this to something that a contractor or a service would run that, that would be appropriate. But we'd have to able to scope that clearly, absolutely.

F

Yeah and that's all I was asking is from a scoping question- is that the goal of this group I'm not looking for a hard answer from CN CF today, just understand in the definition, in the context of how we work I know it's really important that we're kind of in a bootstrapping face so like we can't necessarily do things like enforce maximal representation right now, but we aspire to, and so like. One of the things we aspire to is to be able to hand these things off see if it makes sense, I mean.

A

I'm sure we have better things to do extremely important for us, so.

C

Yeah we need to, hopefully also by the time we're done. You know with the migration process that the rest of this becomes a very low impact responsibility and it's sort of just a service duty that people will pick up and it will consume an hour or two a week, and that should be it right.

A

F

Was thinking of being able to get to the point where it's well-written.

H

F

Where we have like the contributor role board or whatever, where, if you have a well-defined role with well documented responsibilities, you can ask hey if anybody wants to help out doing these specific tasks like Christophe and I, just got to community people to take on managing review of Oregon ship requests. That's what those sorts of things be great and.

K

We have the CN CF service disk can be confused with a live help desk, but CN CF service desk. Where can you send your requests on hiring contractors asking for some support from CN, CF and Samaras, and so ok, great.

F

So like that, I didn't mean to rathole on that I'm. Sorry, yeah.

C

I was just gonna, say: I. Think we've spent enough time on this topic. I know so.

F

To go back to the broad strokes of how we work that all looks good to me, especially factoring in the thing from the product security team process, because they spell out the concept of selecting people for sort of lightweight duties and vetting them before allowing them to take on four responsibilities, which I think is kind of crucial here and I think ensuring we have distribution across companies. While aspirational isn't feasible. Now time zones may be something we can push for a little sooner and and I personally feel like a call tree per team.

F

That escalates to a call tree for the whole team is the approach to take okay.

A

That sounds good, so the only other thing I had in this dock was. Nobody else. Has this kind of a charter? If you look at the other working groups, so I guess we will be the first one will have a charter similar to a sig, but we are working as a working group.

F

Yes, my right so I had something started. Sorry push it, it was gonna, try and drop it all inside the the security audit team and a couple other people have a bunch of extra content in their readme, so he.

H

F

Go that route, but I do feel like because we all feel it's important here. That's having a thing that College Carter is fine. Okay,.

A

That's fine, so so, unless anybody else has any other things, we can switch back to the next item on the agenda. Good.

C

A

I think it's time for us to get something where we can try. We need a GCS bucket. We need a Yuki cluster for the publishing board, so I'm combining the next two items right. So if you look at the utility cluster for publishing, but there is some detailed requirements from Stefan in the doc about things running under things running elsewhere, so that's one I mean so. Basically we need to run something.

A

The second one was Brandon. Phillips wanted to run a bot, so we have two bots which need a home. So I think it's time that we get a cluster where we can try things out and get these bots Ronnie.

A

Okay, how easy is that? Is it to do that? Tim, Jeff.

C

I mean turning on a cluster is pretty easy. I would like. Well, let's assume that we have a volunteer that isn't me that will make time to do this in the next week or two. Then I would just like to see a proposal for how we want to govern the cluster like what do we want to set up in terms of our back rules, and how do we want to invite people to it? And what is the scope of it? Do we need a regional cluster? Do we need hae need multiple clusters?

C

You know global replication. What are the, what do you think the requirements are I can I'm happy to share what we're currently doing and use that to inform where we can go from there.

A

I think we can clone what you are doing right now, but just for these two BOTS it doesn't need a chain Eid Global stuff. Either do.

J

We but I think I think what Tim is suggesting is. We should make some decisions around what we're doing like that, but with both of those use cases both of the publishing bought and the security bought, the brand is running they're running right now like there isn't.

J

There isn't necessarily like a time crunch like we need this in a week, but those are both two very good candidates to move and identifying the right identifying the dependencies that they that would they would need, which I think are very like they're, very simple, but they have like basic dependencies and they have a credential for github that they need to manage and, like those those kind of you so identifying what they need, how we're gonna manage the cluster.

J

Are we going to use like a tool like terraform or are we going to just you know, use g-cloud commands like whatever our procedure is for standing up administering the cluster. Are there any naming conventions that we care about right now? We can always go and sick some of this stuff later, but at least having a base framework to do. That would be helpful. So.

A

The the question data is, do we want to prototype and then write it down or do we write it down and then we try it out. I'm.

C

Happy in either direction I, if it's on me it'll, take a while, because I'm just only able to allocate a small slice if somebody else is gonna proceed here, I'm happy to grant cluster whatever the appropriate I am roles are to somebody who wants to sit and play with it within a sort of a time box, because I don't want to spend all the credits on prototyping, but that was a joke.

A

We won't mind that much because it's.

C

It's too early or too late anyway. Yeah it needs somebody to own it and obviously I think moving BOTS over is probably not the simplest first step.

C

I think the simplest first step would be to move things like GCSE web over, which is a pretty dumb, stateless application, but it means we can set up the patterns for namespaces in our back and network policy and like what are the things that we want to put into this cluster so that, as we add more stuff, we have confidence that it's a safe thing to do like this is we're effectively running it as a multi-tenant cluster with trusted, but not completely trusted parties right I mean that's how we should be treating it. I think.

E

J

I'm reluctant but I'll, say I'll volunteer for in two weeks, it'll be the one action item that I could take on. Alright I can write up a proposal for how and look at least the base framework of like what the cluster will be named. How it'll be stood up, I can write. I can get something basic down so that we have something to try in action and I'll. Get that overview sometime before next meeting right.

A

So Tim, can you give credentials to christoph and christoph the action item for christoph would be to come up with a concrete proposal using GCSE well sure.

C

I'm chris off: why don't you ping me separately on slack or something after this, and we can talk about what credentials and what address to add, and I can tell you a little bit about what we've currently been doing, although it should be pretty obvious, GCSE web yama was already checked in indicates that io repository so yeah.

J

That the second part is what I'm more interested honestly I could probably write up a proposal without the credentials just yet, but and get everybody to give a thumbs up before we actually run the run the thing but yeah the learning. What what you guys are doing today and any like intricacies. That would be that we should mark down as important all.

C

Right cool: let's talk afterwards I'll happy to brain dump on you, okay,.

F

Stump Cousteau, in that context, doing the day I think I saw been add his name to the attendees list, so I feel like that's something Ben was maybe supposed to one-page. Maybe we didn't get there this week, but that's something I'm happy to work with Ben on in terms of illustrating one of the clusters we have today. How are they set up? Why do we think that's a good idea or a bad idea to follow things like? Do we trust namespaces? Do we trust different secrets to different namespaces I?

F

Would think of the case, for example, where, if we have quote unquote separate teams for like DNS versus GCS, you should be credentials used to access those things be considered safe if they're in Secrets, but in different namespaces, and we are back to teams such that they can't do those namespaces. Or does this lead us to consider things like clustered or per team or an oyster concern, so.

C

I think those are the biggest concerns, so maybe we need a smaller group chat on you know slack or something is probably fine with you know. Band and errand is who you just said right: Aaron I,.

F

Yes, I think I will voluntold been into this as well.

C

So Ben and Erin and Christoph and I can talk about what we're currently doing and what we think works and what we think doesn't and it honestly it won't be a very long conversation to start with, because we're not doing that much and then we can let it run from there and I'm happy to let somebody else tell me what they think we should do. Yeah.

A

Can you just make sure you take notes that that's.

C

A

Good yeah, that's fine, then a similar request for GCS buckets I think neither and Justin are itching to get going on apt Deb at least, and there is a straw man proposal from Justin, and now there was writing up one to not. There I haven't seen yours yet, but the idea here is there is something that we currently use for a PDA and rpm repository. So we take that we model the similar thing and then start using it for coughs. Is that what you guys are talking about matter?.

B

Yeah pretty much I I still need to check that. There's consensus in cyclists across the lifecycle I face today: I'll post a link in slack to I'll, be on this doc white started. It's not that much being focused on cluster a guy! Oh yes, this week, but yeah I. Do you have something more complete once a talk to various people? Okay,.

A

So, at least from my side, what I want to do is I want to mirror the existing apt repository into a GCS bucket and see if it would, you know and try some testing and make sure you know some of the things that we are able we want to do. We are able to do. Yeah would be the first step and then do some automation with the the K release and see if we can push stuff to this new bucket. So that's the kind of experiment that I would like to do. Yeah.

B

I need to check everyone's on board with that lat. A bit right, I think some people might want to use Basil's way. I need to get some consensus.

C

On that so I little bit too Justin yesterday and the biggest thing that I see coming if we start moving things well, when we start moving the apt and rpm and that naturally leads into G CR and sort of general GCSE downloads which we have all of is mirroring like it doesn't make sense for us to host all the cops binaries in GCP. Since the vast majority of users are in Amazon, we would be spending a lot of money for no good reason.

C

So a we have to get some sort of coordination with folks at Amazon who are willing to fund the storage there and I guess they have been doing for a while. But it's not a permanent situation and the think about how mirrors and data integrity and those sorts of things are going to work. I guess, I've, a glee understand how mirrors work for apt repositories. I have no idea. If there's any concept of like integrity and mirroring with docker registries,.

F

Yeah I also just have a dumb high-level question and I apologize if this has been discussed before. But since we're talking about things like apps, is this anything that we're planning on doing prior to getting the 113 release out the door? So are any embankments for working on intended to be no all right.

A

No, no, we I don't want to put anything in the way of the 113 release for sure. Thank.

F

You that's all I wanted to hear right.

A

So the one more piece of information here is I. Am we set up a cien dev, slack channel and pinging people about how they're using stuff that we publish in China and they are using mirroring today for apt rpm as well as containers, there's a few people who have done it? A Lyon there's a few mirrors already so I want to learn from what they are doing and then try to apply it to us.

A

You know to get started. Okay,.

C

A

B

I'm just waiting for my computer light, but I, probably written roughly what that would look like this in AWS at least that's what I'm most familiar with right.

B

Yeah main issues tend to be around consistency in the process of replication and, if you're unlucky enough to be starring in machine during that phase, all hell's breaks loose on many memory systems or had to not sleep in solution to that right.

A

So, and the other twist to this is Justin- wanted to do the DNS smart resolver stuff as well, and he's willing to do the heavy lifting there. I, don't know what that it looked like. But you know you might have a better idea of that and.

C

I spoke with him a little bit yesterday about this. It seems to me to be a somewhat ambitious, I'm, not sure I'm, not a hundred percent sure that it is worth the energy, but it might be, but I asked him to really think about. First, first is correctness like how do I ensure that you know when somebody references a file, whether it's an s3 file or GCS file or whatever LA clouds storages or whatever our friendly Chinese mirrors, are that they get the file that they intended to get I?

C

Have only the vaguest notion of how that works in established things like apt, which require which require custom clients I, don't know how we would do it with general, like HTTP downloads, yeah,.

A

So you know leave it up to him to explore that area, but then we would at least set up the infrastructure for the buckets and then we let them think about the smart, DNS stuff. Okay,.

B

Oh and just nothing, I'm told we're talking to two people at puppet labs to talk about how they're doing their stuff as well and they've done. A lot of multi arch multi, destroy release stuff for their packages.

A

Okay, so yeah so yeah, so basic. Ask here: timbers we need a GCS bucket that we can try stuff.

C

Is the sorry is the goal to store things as tests just to try out different techniques, or is it to actually store stuff in a permanent place for now just to try it yeah.

B

I think we should wait and and if we can maybe reuse the AWS stuff that we use for CI right now right now for testing and dosage. So let.

A

Me explain a little bit more right, so what I want to do is I want to mirror the stuff and I want to be able to use cube ATM to stand up a cluster using just the stuff in the mirror, without using any of our infrastructure. So we so I know that this is the set of things that we need eventually for our community. Okay,.

C

I'm happy to create a bucket and I. Don't know that much about how GCS permissions work, but I can look into them and should we who's gonna be the contact for that? Is it you dims now they do. You want to be the contact for this. So, okay, no they're, not okay.

C

Can you are you on UK time? Are you in US UK.

B

C

So it's already Friday night for you. Maybe we can talk on Monday yeah. That's that okay ping me on slack or something Monday, and we will figure out how we can create a bucket and make sure that you have ax cope. Thanks, awesome.

A

Then a volunteer to run a doodle. If anybody has suggestions on when they might be available, so you can have a limited doodle poll rather than a full doodle poll, with all alternatives. Yeah.

K

I prefer I prefer having a limited doodle poll. So please send your suggestions to the media. Note so DM me and my plan is to kick it off on Monday, it's Friday night from me as well. Yeah.

C

Sorry, you want, you want those notes in the stock or where oh yeah, this duck is fine. I don't need yet another dog. You just want people to add their best times. Mm-Hmm.

K

Okay, oh just DME, whichever is whichever is better for you right.

A

If you don't hear from anyone till just make up your own, it's okay.

D

So you'll have some limited options, really limited options. Yeah I mean you know the people here right. So it's right now.

A

It's UK, Europe and West goes over a period of time. I try to get other people from Asia, also but then it'll still yeah, yeah I.

K

Noticed that he Parker or HIPAA Harry's as.

F

K

F

A good time for him, yeah he's in New Zealand.

F

C

F

Great for these sorts of things, by the way, all.

C

Right and I apologize in advance I may be one of the harder ones to schedule right.

A

So the other question I had was okay. We already talked about it. Sick testing will hold the keys for the rest of the infrastructure. He already needs that, so we leave it to them. We don't have to worry about that. One less thing to do I mean.

F

When what one like AWS again will make me don't know days, I stay one AWS cheerio is, that is suggesting, doesn't know anything about billing for the AWS accounts. Ciencia are the only entities who do and I just wanna understand at some point how we're going to make sure he's responsible for generating reports, and you know tying the link between like why we're spending this money responding. It all agree.

C

Before we go too far down the cluster, Road I was thinking the same thing. We don't.

A

Have monitoring.

C

We don't have alerting, we don't have any sort of pagers and we don't have reports.

K

I'm a person who set up that bill and for Google counts, so I can work and it and actually Aaron. If you have this similar request for you for error for Amazon I can also do that for suggestion, as well. Just as an off topic, yeah.

F

Maybe just to have the visibility I think like the Google folks who've been running tests. Infra though we don't have it set up for billing super well. Today, I'm sure we have a lot of insight there. We maybe have less insight on how to best structure things to make billing really easy on a per project or per effort basis.

A

Okay, the other one, just looking through the action items from last week, hippy hacker submitted something to you. Tim is that was he.

C

Submitted me to pr's one that was sort of porting up, Brendan, stuff and cleaning it up a little bit. I had think I had one or two comments on that.

C

The other one is this like org-mode thing that I don't know about and I think it's worth discussing, the the pr looked like a proposal to use yet another markup language to which is not llamo and to write to use that to manage our documentation or something in this in the repo I'm sort of disinclined to learn another markup language personally, I think text or markdown will work just fine here, I'm looking for other opinions as their value in this I've, never even heard of org-mode. Before so, is there value in using it.

F

Nathan, his brain dump, I, don't know if he's a hardcore, Emacs use their court road as an Emacs thing, so I, if it's. If this is about proposing, we all use Emacs I, am a firm, no I. All the way.

J

F

May have just been notes, I, don't know, I mean.

C

That was the PR, though, like it was just checking it in so it didn't say: I was inclined to just say no thanks and let's like reorg, Docs and stuff into text and markdown agree. Okay,.

L

And community has a lot of markdown I think we should stick to that right.

A

So then another you say you should post your proposal during the week. Don't wait for the next meeting. It's.

B

Only just a bit out again not clean outside yeah.

A

Just throw it in note from today, so we can go. Look then been the single project, Ben and Erin I. Think they're gonna document. After a slack.

L

Yeah we're gonna follow up on that. I didn't quite get to a like presentable document on that. Okay.

A

Sounds good, that's all I had on the agenda. Anybody else. I've got a couple.

C

Of things, sorry, first of all anybody who's here should go, should make sure you go to the docs page and mark yourself as present, if you want it to be part of the record, I have a couple of open to do's on the DNS side. I would like to maybe make the DNS flip soon.

C

I appreciate everybody who sent me notes and pr's about closing out some of the to do's I have decorated a whole bunch of the records with metadata about who owns them, which SIG's in which people I have a few left that I thought. Maybe it would be worthwhile to just throw out see if anybody knows what they're for if we can delete them.

C

Goober, nater, guru, Nader Kate, said IO, essentially redirects the case that IO now it seems to me like whatever that was, is not in use anymore. So goober.

L

Nader is still a thing: I, don't know why the redirect is not set up. Terminator is a you know. The log viewer on App Engine currently at some point, we'll replace it, but right now it's used pretty heavily, but.

C

The DNS name, goober needed Kate, said IO. Does nothing. Oh I.

E

G

Know I have in.

E

G

I think I intended to make that go to the App Engine app and then I may not have completed that for some reason, or maybe I was like, so that might so. We should make that go to the App Engine app or we should at least make it redirect. I think the fact that it's going to just Kate spod IO is a mistake. Okay,.

C

Yeah Jeff: can you on that one sure, okay, test, AWS test, CN, CF AWS and test E E and test GCP all dot Kate's that IO are all NS record delegations I, don't know what they're for I don't know who owns them and I don't know if we still need them. I.

F

Don't know anything about those this.

G

Is related to cops I want to say, I want to I I know at least I think I set up some of those, but I don't entirely remember. None of the names.

C

Resolved like there's no there's nothing at test AWS gates at I/o, I. Think.

G

Something like I think tests end up setting up like there's a different project that you know this delegates to a different project which may be.

H

The Bill Gates to Amazon actually.

G

Ok, so test WS delegates to Amazon, but like the test, GCE I think delegates to a different Google project which tests have access to okay.

B

G

B

I suspect it's cops using it to test load, balancer registration and things quite possibly so there won't be anything go to Apex, but underneath the mean stuff.

B

L

Right, can we make a note and a sign Justin yeah.

C

I'll ping Justin on the test, AWS there's test. There's: oh there's, Justin uh-huh. Do you know what that's doing Justin I 21 pick out the test.

M

Aws gates at I/o without CN CF, is the older. That was the one that was used by GCP tests running in sorry, testing on an AWS paid for by Google a diversity nfk today or is the one paid for by is the CNC f1 paid for by day dress, so I can get rid of the test. Dws I will.

C

Double-Check but he's certainly assign that to me and I will okay and then the test CNCs AWS, so you're saying that's still in use that is very much southern use. Okay, can I put your name on it or ship at somebody else's name on it, I.

M

Need to put a name.

C

M

You can put my name on it: I don't know what what what it means that my name on it but put my name on it sure it.

C

Means that the next person who comes along and looks at this file and says what's going on here, will contact. You sounds good or should I put like cjw s and just like ping, Yi Shi. ah No, that's for that's! That's more! For cops! Okay! Okay! Is there a or should I just put your name, I? Don't think we have a group, so my name will work? Okay.

C

How about so are we? Are we using the name test GCP for other stuff test, folks, I.

G

Just found an email thread when I set this up back in March 2017, um it looks like it was related, it was I, think cops stuff. I can only send you this thread and we can follow up there. Maybe Tim, okay, that.

C

Would be great yeah and then the last one was test e e dot k said IO. Are we using that in tests.

C

Crickets crickets so because of the the vagaries of Google PII I can't figure out who owns it like I, have no access to the information like I have no history for who we delegated that to and I don't I can't tell where it's running like if it's running.

C

Does anybody have any context on test e de Kate said I? Oh.

L

No, it's just that. We probably want to look because there's many surprising things that have just run quietly and been depended on. Somehow. Yes,.

C

Is it possible, can I get can I tag? One of you guys like like Ben, since your pictures on my screen right now later.

H

C

Get grep through the various repos to see if that's string exists somewhere sure dangerous. What.

L

Is the keep? What is the actual test.

C

E e, and presumably its it with dot Kate's that IO as the suffix and it's a we have a whole zone delegated so like all I have is an NS record. That says somebody else is administering the rest of this domain, so presumably there's a GC key project somewhere that has a zone registered for test ete decades at I/o, and maybe tests are adding and removing records from that zone. I don't know, and instead I get at the GCP, not about 53 I.

C

Don't have that here. Hoo and I see.

L

So, just looking at our handy code, source I think stems there is nothing for that. Okay,.

C

And actually it is delegated to Google domains, not to Google Cloud, so I, don't like somebody somewhere, Hey I have no idea what it is and test. Gcp is also delegated to something that Google domains so like I have zero information about where that is yeah.

G

So so test GCP I believe well, I'll, send you the email project but I think it's.

M

Alright I have maybe have an email.

G

M

Have an email from Eric that mentions test IDI eat up kids today, oh so Eric, why don't you and I token we can see if we can see if it's news which Eric Eric later is. It is fitting here.

C

M

M

All right, why haven't you moved from Eric, so I will I will forward it good your CC on Tim I will forward it to you again anyway. Okay,.

C

Yeah I feel, like I paint some of these at their beginning of this whole process and then maybe lost track of them. These are some of the last two news left in the files, so I just wanted to follow up sorry, just as I'm finishing off these notes, so testing CIWS is just in. Can you give me like a one sentence, description of what we're doing with this? That is used for at least four cops testing cups? You.

M

M

Other people are able to use it if they would like to okay. Okay,.

C

And that is in active use and test AWS I'm, just going to nuke and I will give you the option. If you want to change it from test CN CF AWS back to test AWS, you can have that name now, but that's up to you I, don't care that much I had one more fix me. I wanted to look at Oh, goober, Nader, uh yeah, Jeff, you're gonna follow up with that right. Yeah.

B

I'll follow up on that one.

C

All right figure out what you wanted to do or make it go away and then and then I think all my two dues are done from the zone configs and we can proceed with the switchover planning. We want to still set up the I'm just looking at my notes for DNS want to run a diff against the two zones and make sure that we understand why they're different.

C

We need to push an image to our GCR and for the octo DNS and then just write a few more documentation. Oh it's the canary stuff, that's what we're gonna do. Hippie was gonna start looking at that right and I didn't see that part of it I.

C

Don't think he got that far this cycle, it was the it was the canary stuff in the script to update the canary that that's what was missing next, so if he doesn't get to it, I'll get to it eventually, but I think all the other roadblocks are cleared cool cool, I.

F

Have one other thing: if you're out? Okay, so back on the Charter I, don't know that we ever discussed? You should be two chairs for this working group. My proposal would be dim and yourself Tim. If.

B

Oversubscribed.

F

I am I'm happy to take your place.

C

I do sort of feel overseas. Cries me. I do feel a little bit over committed right now, if you can have not that this is a ton of work, but I'd rather focus on getting myself out of the loop. That's fine getting technical stuff done and handing it off to people who care more. Okay,.

F

Yeah I can H a proxy so dims and myself any objections from the rest of the group. Any interest for the rest of the group last.

K

F

M

A

C

Timms we didn't mean to fall and tell you. Are you, okay with that yeah sorry.

E

D

I, just kind of assumed.

F

Like you've been running all of the meetings and scheduling all the.

K

F

Poking all the people like yeah.

A

I'm, just calling you what you.

F

A

You know you know let it go for, like three four months, make sure that we have passed the initial hump. Then yes, I'm sure we can find other people once.

C

We get through the conversion process. This should really be a low-impact group. We may not even need a standing working group.

A

F

A

F

A

What else just calling people who haven't spoken yet mantra? Did you have anything to report back.

H

Yeah actually I'm working on that image, name and depositories, probably just finding a place to you, know, put my ripple proposal superlative submit something to propose names for different repositories.

H

A

You will post a doc yeah. Okay, don't wait for the next meeting, just post it on the slap Channel when you're, ready or.

M

You see one yeah.

H

I'm just wondering whether so.

H

A

Google Doc works, yeah.

A

Justin, did you have anything else you want to talk about? We we talked about a GCS bucket for now and oh and Jim was mentioning that we do have AWS credits, a SS buckets yeah.

M

I think so, I think these long poles are I suggest it's a bad idea to run the same accounts, the exact same accounts.

M

There are like sub accounts of billing accounts, but we should figure out the structure that we want. I I think we probably want to totally separate AWS account for for the sort of locks down accounts, but I think we could create a totally separate of us account. That is a locked down account. That is a sub billing account of this current CN CF 8 of us account, which I think would be fine, there's no like a call granting, and then we just need a name. Dns name I, think I'm gonna, look at it.

M

Smart redirect some sort of redirect service you.

C

Missed the part Justin where we we talked a little bit about that I'm happy to let you explore it, you know, is it the most important thing to get the DNS redirect or like? Is it viable to just say like there are two mirrors and you have to pick which one you want to use the.

M

Other thing about these all right: it's not a ie, it's not actually DNS, redirect anymore I, don't think of DNS redirect will work, because both GCS and s3 required the bucket name to match the DNS name, the original DNS name, not even the cname okay.

M

So we do need a 3r to read because it only sends the original host it doesn't send them word only send this I, don't remember. We might be able to get around that Justin with cap on maybe yeah we got yes, we can. We could do that. I was like a 302 service, the other thing, the other advantage of a 302 of services it would be, could have SSL.

M

So we would not have to figure out the full root of trust like we wouldn't have to get hashes all the way down into everything and it'll be much easier for other people to adopt, because presumably everyone is adopt and is currently relying on SSL with one or two notable, except since I guess.

C

I'm not sure I have a mental model of the proposal. At this point.

M

We create bins, dockets, dot, al, it's a 302 redirect it serves over HTTP, it maybe doesn't 302 redirect some critical files like a sha-1 or a sha-256 file. Worth and.

M

Anyone relying on it like cops, should set up a sort of full-back list and it should try bin stockade studio and then see names for the buckets so AWS stuff inside case today, on GCPD hold on a second did.

C

Somebody just change the doc I just lost access to the doc.

C

Notes and I now have only read it read only access to.

K

C

Did somebody just take off take over our doc or.

I

Maybe we're in the middle of a it can't internal problem had been cool here. It could be means Friday, it's a great day for a release to go wrong. Sorry,.

C

Just an immediate but I'm sure what you're saying and we.

B

Fresh things to face that yeah.

K

I opened it it's from my second account and I can open it. It's real world, so team deems is an owner and everybody who has Elaine can edit it so should ok.

C

I seem to be back to be alerted. Sorry, ok, I lost all my notes. Damn it I can I can explicitly add.

K

All the people from this group to to the owners of this to the editors easier. Ok, if something will happen with the wide permissions of yeah.

C

I guess we're at time anyway, just you've.

M

Got this proposal right also bins is a deliberately bad name. I chose the worst thing I could think of in the hope. It's a better name. That's it they're good new. We cannot see names so yep, that's good. We should definitely have that.

C

Okay, so you sent this proposal, everybody is quite apt for for, like the canonical location, everybody who cares about this, you go read the proposal.

M

The under 302 redirect basically means we don't have to like do everything all at once. We sort of have most of the benefits with it with and we can set up TLS, but tools can sort of gradually move to making the the bucket economical, okay,.

C

I gotta get out of here: okay,.

A

C

Right thanks: everybody thanks. Everyone.

A

Talk to you in a few weeks time, hopefully at any time all right thanks for.

F

A

Poll and respond, please.

E