Kubernetes SIG K8s Infra, 6 Mar 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes WG K8s Infra 2019-03-06

Description

https://bit.ly/wg-k8s-infra-notes

A

So hi everybody today is Wednesday March 6th I am Airness I feared you are at the kubernetes infra Kitson for a working group, you're all being publicly recorded, you're gonna be posted to YouTube, and you all get to be that way. You can watch yourselves follow the kubernetes code of conduct, which basically means you're all not going to be a bunch of jerks I pasted a link to the agenda in chat I'll. Do it again for those who just joined it? If you want to add your names to it, he'd be very helpful.

A

Ii kind of rolled up action items from last time, so I figured I, could roll us through that and then roll through the open discussion items after that before I get started. Is there? Anybody who is new here would like to introduce themselves.

B

Hi I'm Jeff Johnson I'm, just joining in here I've, been active in sync across her lifecycle, but I was just sort of in a neighborhood and those guys were headed to a cig meeting. I hadn't been here so I want to say hi.

C

A

Jeff going to meetings for fun. Yes, you truly are a member of the community.

A

Okay, let's talk about billing so for some action items.

A

Justin you were supposed to have something about storage analysis for billing. I, don't even know what the context is for that actually does that make any sense. I.

D

Tend to do it, but I don't think we have anything to analyze as of yet so I will do. We have something to analyze right because resident, we don't know anything. Yet we.

E

Have single digit dollars, probably trying.

D

To get the report I will then start, but as I didn't I was not aware. We actually had anything to analyze, but I am this is about taking the graph where we're spending money on our GCS buckets I. Think, okay,.

A

So if I can back up at a high level, is there anybody here who can tell me how much money we have spent since our last like? Is there a look that I've.

F

Misjudged irregular doing report to the meeting day I in a bottom of the meeting notes.

F

Right before the open discussions, okay.

A

Billing report March 6th gotcha.

A

Okay, we spent a grand total of $35, though I don't know what on that's.

D

And that's only for the first six days of March right. Yes, yes,.

A

D

Three hundred and something dollars: 325: okay, let's see we do a breakdown.

A

Yeah cuz I feel like we have.

F

A

F

And report also off to February.

E

Weights, good amount of tails, so here's here's a little bit more detail. $5.00 on DNS $30 on compute engine, which I assume is you fiddling around with test clusters, I think so that's.

D

Mouse is dancing yes, yes,.

E

D

There's it seems.

E

To me, there's a test cluster right now with OneNote.

E

No, but who knows what you were doing in the meantime.

E

I'm not paying attention what you doing.

A

Okay, alright, so.

A

It sounds like we're still not really at a point where we have the granular level of building. We would want to kind of move a little bit more quickly. What I'm hearing I.

E

I mean yeah, we we, we have the data there, I haven't looked at the billing export and data studio stuff to be able to produce what I just did without looking at the cloud console. But we have the data in the cloud console at least broken out by product, which is useful at the starting place.

E

We need somebody to make the time to or look at data studio and try to previously more useful, which I think is going to be challenging until we have more than literally two billable items where one is disposable. So I'm okay to let this sort of once we turn on the cluster for real or once we turn on the staging stuff, which I think we'll talk about in a little bit, then we'll have something more tangible to actually produce a report on yep.

A

Yeah, that's where I was gonna, get I feel like that's kind of the impediment. Oh boy, wouldn't it be great if we could just spin up a couple clusters and run some things? Well, we don't really know how much that's okay, so next thing in action item review is the image promoter.

A

Is this what you were talking about with regard to the staging stuff, Tim yep.

G

You wanna talk sure.

H

So yeah we were kind of blocked on this figuring out where to run the crowd job. We had some discussions with Erik feta I think that was mostly internal, but basically we've decided to just run it on the trusted proud cluster.

H

This is like apparently, there's like one trust. Cluster sorry called proud cluster and that's the one that like has secrets and stuff the reason we want to run it there. Well, we don't want to run in some other random cluster. Oh sorry, with the other jobs that are not in the trusted cluster, because then they are probably more susceptible to I, guess, malicious, PR and stuff, like that.

H

So my understanding is I've been already a presubmit check for any any jobs that try to use a trusted cluster like already in crowd somewhere, so that'll, hopefully prevent people from adding like random jobs there using the secret that we will add. That's the secret to push to Kate's GC our prod, so.

A

This came up briefly in the state testing meeting yesterday and so I apologize. If I'm missing contacts, there should be responding to email, threads I know you think me on a couple of that I didn't get to so. Essentially, the trusted crowd cluster is where all of the proud components run. That's the cluster, where we there's very little else that so we have a couple secrets there and so we're thinking, oh great, we'll just we'll put it there. Since that's where secrets already happen, but I was trying to understand like are there any technical reasons?

A

Are there any technical limitations that are preventing us from running the container image promoter on the same CN CF own cluster that were running the publishing bot? Does the publishing bot is an example of something that runs in the CN CF and uses some like crestock credentials to push some stuff out? There wait.

E

Who's running the publishing bot and where is that running? It's ready in your test, cluster yeah! So there's the there was the disconnect that I was missing this week, so I didn't believe I didn't realize the test cluster was actually doing anything real it being a test. Cluster and all I have.

D

A strategy which is to bring up a second test cluster and try to move the work loader. Then it will feel good about shutting down the first test. Cluster, okay right.

E

I would not want to run. I would advocate that we do not run more in the test cluster until we're ready to not call it the test cluster yeah, where.

A

Is the caveat that like this is intended to be temporary and destroyed? But maybe that's also a good idea, because it forces us to like make this really easy to redeploy at the click of a button.

D

We need to have it scripted, so that's why I was proposing to bring up clustering a second test cluster with the approval of this group and making sure like if we can move the workloads across easily and therefore we can like make tearing down these clusters and building them up very automated I.

E

I think we're gonna run into issues when we start doing anything that has volumes which Dunham says there he's raising his.

H

E

H

Sorry, okay, just.

C

To give some more context going back a couple of things, so we do have a secret using deep crypt and you know that actually publishes all kinds of state. You know from the staging repositories to actual repositories. So we are, we already have I mean.

C

If you have a problem here, then we already have a problem, and you know right now, I. So the three of us who have access to a secret, it's Stephan, myself and Nikita.

E

Okay, so I have no real experience with get crypto, but I'm not gonna. Have my questions about this right now. The the real question I have is procedural.

E

Do we want to try to shoehorn anything else into this test cluster, especially things that we depend on right now, or should we run with what we have until we're ready to say that this test cluster is not a test anymore, I, obviously lean towards the latter.

C

Yeah I'm fine either way, but I would leave it to you all to decide.

H

Well, I, personally, don't care if.

C

We have to make a decision right, I mean I'll.

H

Throw my my cup for what Tim just said: I mean yeah. It feels kind of weird, because this is clustered this job will be running like production jobs, so it just feels weird to say: yeah. It runs into test cluster or the development cluster just doesn't feel right to me. I would.

D

Say we could put more jobs in that test cluster? No, we should not put the image promoter in there, in particular, just because it is so important, sensitive and important. Well,.

E

It's not important yet because it's not actually doing anything for real yeah right like we want I want to get it up somewhere like this week, although this week is perfect I'm at Google. So maybe this week's a bad idea, but I want to get it up like this week or next week, so that we can say, hey group, look I made a get change here, proud kicked in and it moved the image from this repo to that repo and that all the plumbing okay.

A

So in the interest of moving forward sounds like this group is okay. If we run it in the same cluster, we run the rest of our test. Infrastructure I just had concerns that that was gonna. Let us like accumulate more google-specific debt because it's possible there and it's not possible in the CNC F, but I agree in the interest of expediency, making sure we get our test clusters straightened out. That's we'll move forward. That way can.

I

We just agree to do the product set up and come back to that after we've done the set up that.

E

Just proves that it works exactly I think we can move proud towards the front of the list of things that we try to move into the real cluster. And then we have to have the discussion about the secure prowl cluster versus the Nam, secure, proud cluster and what we're going to share and how we manage those secrets, which is good, because we need to have that conversation anyway.

A

Okay, that building it's in front of that to crowd and.

E

Probably give us a substantial work item that we can actually look at billing for right. Yes,.

A

Okay, there are a couple other items under image promoter like list of staging repos and groups who owned them Tim. So.

E

We have a short list right now for the purposes of testing once I mean at some point. It doesn't have to be serialized, but at some point we need to decide what is the policy by which we create new ones and and the policies by which we govern who gets access to push to those staging repos I think we can be pretty liberal in that they cost us very little and the risk is fairly low, especially if we're actually paying attention to billing.

E

So I think we should be fine to do that. We just should have some guidelines.

G

Just confirm or.

H

Summarize so are we moving forward with making the project run in the tester trusted cluster, or are we saying that.

A

H

A

Thank you for raising that in all of the places yes and there's another item here about Tim setting up a GCR repo know.

C

Before we go there so Linus, what do you need from the people on this call?.

C

So by end of next week, that's the you know date that we are shooting for right. So yeah.

H

I think that's reasonable. I mean Tim already gave me the secrets to the the registries for the three stars that he set up, that he created so I just need to insert them into the I guess the trust cluster later when the PR is merged. I just need to make some changes. I'm already working with feta on getting the details right for this, so I, don't think I need anything else from this group.

E

Can you give me a quick readout on the various issues that we filed against promoter, specifically the pushing three registries? Are we cool with that now.

H

Pushing three registries: yes, so that is also in the works. There's an open PR for getting that to work without actually making more business logic changes to the promoter itself.

H

That's like you know, creating a script to like say: oh yeah, I just run it that, like dynamically, create some new manifests just swapping out the destination registries on the fly in a script. So that's.

E

Sort of further for the recording context target repo, the prod repo is actually regional. So we have one in u.s. one in Europe, one in Asia and we're.

F

E

To all three, rather than.

F

E

It the way we currently do it, which is we promote to 1, and then we copy to all the others via a separate mechanism. I think we can just.

H

Yeah I mean the so the implemented the implementation details on that are I, guess still kind of an open question, because the reason why I say that is because is it John Johnson or somebody named John, something at Google. He brought up G crane for copying just images like GTR, and they can do that now. So there's like multiple ways to do this, so I.

J

Think that that tool is to back up, does it does the older missionary action items we have here? Is we need a backup of the production registry? Yes,.

H

That's Reggie right but, like you know, because their regional, like VCRs, they should be all identical.

J

Right so I think that I think that should be part of the promoter. If you think about it, if you're pushing to one, it should be replicated to the two missing ones, right.

H

I mean I'm just throwing it out there as a yeah.

E

I mean that's more or less. What we do now is Zac Laughlin wrote a script that does it and I'm guessing it. They probably end up. Looking a lot alike. I think I agree with heavier. It makes sense to me to have the promoter be the thing that pushes to the prod, repos and motor has no access to the backup repo and that's done through a separate mechanism, so that we can make sure that even if the promoter goes haywire, it can't nuke the backup they can have right. Only access, okay,.

H

So I will capture that thought here in the notes and I also add, like a link to the relevant issues.

H

Is that fine with this group? Yes.

E

I, just wanna make sure we don't lose track of it, so that, when we're ready to do a demonstration that it actually works right.

H

Right now, that's been on my mind, I just and.

E

I would love to just for setting a target this this meeting in two weeks to be able to have that demo. Okay,.

H

A

That's in search the pool also for what it's worth. Thank you for doing the legal footwork necessary to get the repo transferred into the kubernetes leagues Artie, that was fun. I love lawyers on recording, okay, let's move on Arta artifactory or artifact serving justin. You wanna talk about that.

D

Yes, this is about the work. I guess that Brenda and I have been working on I. Think two weeks ago, I mentioned sort of a preview or small stone.

D

That was a simpler first step than the full three of service, which is essentially putting up GCS buckets very similar to the image promoter, developing something similar for to copy from a staging bucket to a prod bucket and just putting a GCL be in front of the prod bucket, so that we can sort of start to get data and understand latency reach ability, costs, those sort of things.

D

I think I'd circulated a doc two weeks ago and I I'm not entirely sure what the process is, but I put that as a PR against the cap as a implementation details for milestone zero. If people are generally agreed with that, I would like to proceed and start like making progress on this I. Don't know. Brendon I haven't heard from you about how you feel about it in particular, and how others feel yeah I did I didn't. Although.

E

So we have these scripts to make GC our staging repos. You can probably copy it and just change a few of the details. If you actually look at the commit history of those scripts, they have some lifecycle management stuff which doesn't really work for GC r, but it does work for GCS. So you can actually apply some lifecycle stuff to the stage and repost say you know after 90 days the whatever is there is going to get deleted, those sorts of things and it's good idea to start with that.

E

And then people complain that we we always.

D

Have it up yeah cool yeah, then we can.

B

Start serving our effects and a lot of a more interesting building report. Yes, yay just.

A

Out of curiosity was that 90 days number based on anything or pulled out of the Hat okay, something.

E

D

A

I noticed that all of our test results are apparently called against the same 90 day policy, and that feels like it's not super helpful. When we're trying to go back and compare test artifacts from now to say two quarters ago, they all disappear so so.

E

Actually, the the GCS policy language is pretty cool, so you can actually say like after 90 days, move it to the cheap storage and then after 180 days or after six months, move it too or delete it at that point right. So we have. We have all sorts of options here, I just we should look at it and think about it. Unfortunately, we can't do it for GCR yet, but there's hopefully we'll be able to do that. Eventually, I mean.

D

And these are Bonnie's, not not test results right, so it is yes.

A

In mine was a totally random question, yeah.

E

I specifically think we should apply lifecycle policy in one direction to the staging repos, so they don't end up wasting money. Anything that's not promoted from staging to prod within half a year, probably won't be, and the prod should probably have life cycle in the other direction to do, delete inhibition and those sorts of things to make sure that nobody can do get in. You know less than a certain amount of time, something like that. So we should think about the policies along, say: okay, okay,.

A

So just it sounds like we'll have that up and running by not.

D

Sniffing as well, I would like to achieve that and then I can also try to get some analysis of buckets spend busy a busy goal. Yes,.

A

Understandable, okay, moving forward Tim and hippy I am auditing that we need to be I totally.

E

Fell off my radar, dude I'm. Sorry.

E

That's what do I owe you I, owe you something right. I owe you I forget remind me, I think.

K

We're just looking for some pair of time to go through and figure out where to how to read those permissions for auditing in general, I, think and specifically being able to dump the I n roll's so that we can dump I. Don't on going when there's a change. We do an IM dump and update the probably the Kate's that I, oh okay,.

E

Does Friday work for you, or maybe we can do tomorrow's my worst day for meetings, I hate intruding on your Saturday's, okay, keeping.

K

Up at 4 to 8 a.m. but because I get up at 4 a.m. every day, so getting up at 4 a.m. on Saturday, it's funny and my family doesn't get up till later son. Let's do it on tape.

E

Right, alright cool, so let's do Friday morning, we'll fiddle with the I, am and essentially create. A group for, like auditors, make sure that that group has enough permission to be able to dump I am and then you can run with the script. To do what you think is interesting. I.

A

Like it, thanks sounds good, okay, next, so there's an item here about firebase, but I'm wondering if this is know, Ben has some stuff about metal fly that he wanted to discuss, and somebody remind me why firebase came up in the first place.

C

The cluster API folks were trying to use firebase, and then they realize that David Watson had a showed up, and we were talking about it here, trying to request CN CF to provide funds for firebase. But then we realized that neckla Phi is fine and the issue was closed in case I. Oh okay,.

F

A

F

Often identify B because we're all they have done at the fire I found it account. Sorry, it's it's easier from Holstrom points to using.

I

Firebase for documenting the cluster API, specifically right.

A

That was there for us, yeah yeah I got it um so I know you have a proposal here for us to discuss, spend is there something we should run through now sure.

I

It's not I mean the doc is a bit more in-depth, but the proposal is pretty straightforward. Okay,.

A

I think my main question here is cz or I, hear you saying like yes, let's see and see, if already has something going on with now Phi. What's unclear to me is whether we're asking the CNC F to support this directly or somehow the GCP funds are being used for this or like what story is it? It doesn't cost anything more okay, it.

F

A

F

Something for community I, don't know the exact bill and details about the cnc if agreement with magnify, but we as the community we can use notify. Sts Wow fibrous requires an extra funding. Okay,.

A

Is there anything infrastructure GroupWise? This group needs to be aware of.

I

Well, it seems like this is kind of the clearinghouse for the community agreeing to host things for people, so it is not an expense, but there you know, there's still some semblance of that and to go with. This will most likely want to set up the sites with someone of our subdomains like something dot Cates that IO does.

E

It make sense to create a subdirectory repo with just some documentation about, so you want to host a doc site. Here's how you do it! Here's the group's you need to join here's who's in charge of it right.

I

So that's the that's the thing that also needs to be covered. That I didn't finish. It was that we really should have some kind of like net lafha administration team in the sense that we have the github team or the DNS team is seeing this net liffe. I has teams, but for DNS ownership reasons we pretty much just need to use. Eighteen anyhow, so we'll have to have a team that the the docs team on that laughs I will need to fulfill actually creating the sites.

I

After that, Leung can manage basically all configuration from a file list, or did you do the source repo, but that initial setup will need to be fulfilled by someone and we'll need docs for this who's.

C

Taking care of this right now, Ben.

I

Basically, there are a couple of sick Doc's members that do this and then I've also I'm, not sure. If I have the right permission said yet, but I've been the team and I've volunteered to help with that right.

C

The question here is: do we need to interject and insert ourselves or let let.

I

Thing um I'm not sure I need I needs formalization right now. You pretty much have to go like know the right people in cig, Docs and talk to them, and so far the the two sites that they've set up besides the main site have been experiments. So we need to like make this a real repeatable thing. Okay,.

E

Are you, are you going for that or Yvonne to round the troops up to voluntold Paul and tell them bit of.

I

Both I don't know exactly what the policy should be. I have some ideas and I'm happy to help with all of it. I can definitely document like how it gets set up in a bit of that sin here. Right.

C

So if we can at least do placeholders in the kids are Europe o saying this is the process we are following right now. Here is the people that you need to go talk to? We can part other people to the same resource right, yeah,.

I

And Zachary Sarah from sick docks has been doing this as well and I've been in discussion with them about this, and we've also gone clarified, and now he or as well the the CNC F is funding. This account going forwards and you basically paid by how many team members you want to be able to have access to sites we pay for unlimited. Currently. So, even if this team were to grows because we want did, doesn't change the price and we don't use any other features that cost anything so there's to me sounds.

A

Like a nullify sub project under sig, Docs, possibly understood contributor experience, I, don't think this group needs to be actively involved going forward. But if there's anything, we need to do to unblock that.

I

Sounds great to me: I've just been trying to make sure I get it circulated everyone. It.

E

May be, their only touch point is in allocating DNS names. Alright, yeah.

A

That's what it sounds like like.

D

We should say thank you, this isn't over yeah.

E

Sure, that's actually a great point having a dock in our repo that says this.

A

Is not the dock.

E

You're, looking for all.

A

Right again in the guise of like this is a working group. So technically we don't own code, other SIG's own code. You should own so.

I

My suggestion was that we add a new template to kubernetes org for requesting a site in the same sense.

F

I

You request other, like github integration, okay,.

A

That may work I feel like we can discuss that offline. Look.

A

Tos Automation Justin I.

D

Have not done anything on this, but I will do something on this well.

E

We have Jeff Jeff, didn't spun it up for GCSE web this week, so we're now serving GCSE web over SSL and the the bump in the road for the main site is to move it from a service Selby to an ingress which isn't really that complicated, but take a little bit of effort and will require a new IP address which requires a cascade of changes. We have to move it. It's not in CNCs infrastructure, though, is it what?

E

Oh? Yes, sorry, it's not in it's not in our production cluster yet, but in the new new cluster, but it's in the the classic cluster.

E

So no I dropped this on my Rio I'm, not sure what actually was involved. Yeah I, don't think you need to do anything I think when we go to move from the classic to the next generation. This will just be part of the cluster set up and I think to James for helping Jeff get it all set up. I moved.

K

A lot of notes run this in the open discussion and the redirection service, including the merged PR, from death.

A

Okay, sorry so I'm not I'm, not sure if I follow it like, we basically have this running in the Google cluster hooray. Are we planning to move it over or we're just will.

E

As soon as there's a place to move into okay, I don't have the agenda but I'd like to make sure we touch on what's left to do on the production cluster work. Yes, so that's.

A

The last item: okay on the action items anyway, so we've migrated the the publishing bot over but yeah what what is left.

D

To do and an isolation and I think make it more repeatable. So that's why I for the repeatable site, I suggested bringing up another cluster and shutting down the first cluster yep.

E

D

With that seems like easiest weight and.

E

D

What we've been doing.

E

For all the staging stuff is just destroy the project and start over and recreate the whole world from scratch, and make sure that the scripts sore so yeah being able to just burn down the cluster and create a new one from script and make sure that it comes up with all of the appropriate infrastructure. That's needed, then cool, and that, at this point, probably includes certain manager that doesn't use I mean we'll see about shortly involves not.

F

E

I'm saying that as the script accumulates like certain managers, not an app it's infrastructure right.

D

And I think confidence I think he ordered the are back the are back audited. We.

E

Need a similar, our incident noted for our back that we such a the part that I'm that I want to play with that I haven't played with two parts: one is the billing breakdown per namespace, which we have tools for, and the other is the are back to Google Groups, which we have support for, but I haven't played with personally.

E

Fancy right so that we can give our back access to different namespaces two different sub teams and be confident that they can't step on each other. Reasonably I feel.

A

Like that discussion was still maybe blocked behind, should we be using G suite instead of public Google Groups for that stuff, I'm.

E

Honestly hold no opinion on that I as part of the original setup of that it was. The idea was to not make that critical path on anything. It was really just for governance work. If steering wants to turn around on that I. Don't care, but I, don't think it actually matters here, because at the end of the day, I, what we're developing is a set of permissions that are granted to a group I, don't care what the name of the group is right, but I think multiple groups with the same set of permissions.

E

D

Is that what is there can you can.

E

You share the reason for why.

D

A G speed versus public Google, Earth I.

A

Cannot off the top of my head and unfortunately, the main proponent, I believe, first off? Who was making the case that it's just like easier and nicer from an administration perspective in general? But if you jeez we'd, never thought.

K

About that, if you're, if we use the public Google Groups for this, if you, if you need to get a message or somebody's unavailable, you have this way to email that group, or we have a way um kind of publicly see that it in the same way that we're doing our audits for our Vatican it'd also be nice to see who who are in these groups and I. Don't know if that's easier to do the AG, suite or Google Group. That's I,.

E

Don't think that's any different. The thing that I know off the top of my head, that's easier in G or possible in G suite is, you can have groups, be part of groups which you cannot do through the public groups. Api hippy I, totally agree with you on transparency. I would love to have the source of truth for membership in the groups via file and github, which a bot would sink into Google Groups I've never played with the Google Groups API either. So I have no idea how complicated what I'm asking for there.

A

But there isn't for public Google groups as far as I know,.

E

A

E

A

Christoph's you're in comment, as of January 15th was I'd like to consider it for moving any ways to use our G suite the auditing of permissions, administrator recovery, etc are way stronger there as opposed to public groups. It appears as though using groups in G suite costs us nothing extra, that's wrong.

E

A

Just like I think I need somebody here who is a G suite expert to make that case, though, and Christoph just just stepped away from the community for a couple weeks. So I'm not.

F

Sure would say they.

A

I like to get the get ops model, but I think you should explore whether or not the api's exists to allow you to do that with public Google Groups and if we find they don't I think we have another item open about using G suite anyway for SIG's and working groups to have a place for their Doc's to live, so they don't disappear when random people delete their personal, G, Drive, folders and stuff. Oh and.

E

I'm down for all that, I'm not gonna block on it, though I think we need a volunteer just up and drive that stuff, because I think it's a significant effort honestly, like it's a whole new API, to learn too to do get sinking from. So maybe it's not huge, but it's not like I'm gonna. Do it this afternoon, Justin trying not to volunteer I'm trying to volunteer I, see him over.

F

There, like literally quivering he.

E

Wants to do it, he wants it. I think we need. We need a volunteer until then I think we should just proceed with the public groups and make do with those as best we can so I'd like to I.

E

Don't know if two weeks from this is gonna be enough time to have the cluster up I'd really, once we get this staging stuff up, I'd like to stand on the gas on the cluster and make sure that we've got it actually working, it seems like they're, really the next big milestone, so I'm, not gonna, say two weeks from today, but maybe four weeks from today we I'd like to have the cluster up. Does that seem fair Justin, the the real buster yeah.

F

E

I'm willing to put aside on a day or two to sit and I am permission, so should be mindful that we might make mistakes and we shouldn't say always completely production-ready. We move anything over.

F

So the movies will.

E

Move the easy stuff: a move GCSE web, when we have you know the small stateless stuff and if once we're confident in that, then we can start moving. The bigger stuff is nonsense. Yes,.

A

Please don't try and move anything in like the next three weeks. If you could make things I, don't want GCSE web, so I'm like disappearing right in the middle of release and everybody wondering where all their test results would I forgot.

E

A

Just another random thought is like I I personally, don't know if we settle you're saying the cluster I, don't know if we settled on like the cluster for everything, especially since we were just, for example, talking about like a trusted proud cluster versus Prowse, build cluster and.

E

So an interesting concern of trust domains here, I'd like to be able to I want to assume for now that we can get a cluster in a trusted enough place that sort of within the family. We trust our own projects, which is all trusted code to not destroy each other I, do not trust arbitrary PRS from random people who managed to get somebody to say okay to test to not try to break out of their container.

E

That will require I, think set clusters, and probably we want policy around how often those things get burned down right right.

A

I get that I think I was just trying to drive towards our. We have we made the decision that we're gonna have like one cluster for all the services or because I don't like another idea like each service, maybe gets its own clusters.

E

I'd like to say, we should start with one cluster, or maybe we start with three clusters and actually using dresses, global capabilities to to reduce latency, but that's a secondary or secondary effect. You know, I think we've been working pretty hard on the idea.

D

That we would, we would not have one cluster per workload. Yes and.

E

C

D

Have acknowledged that there are places where that falls apart like proud yeah, we.

C

Should start with the shape cluster and then move things out if it doesn't work on great, that's another way to look at it. Probably.

E

Once we have the cluster up with one or two things actually working in it, we should just have a item-by-item consideration of you know. Can anybody come up with a good reason why this should not run into shared cluster.

D

You know that prowl prowl entrusted prowl might ready to different clusters right off the bat to break.

A

Just another thought off the top of my head: I feel like we don't start talking about repeatability until M is greater than n is greater than or equal to three like. If this is our second cluster I want to make sure we're not falling prey to the second system. Effect I feel a little bit more confident if we burned this next cluster down and created it from scratch again to know yeah for really reals weak options, but I'm with you, I'd.

K

Like to meet all of them and earn and tear down, so we have more eyes on that process.

E

Together, yeah well. This is why this is why it's super important that we script and publish all these things so that anybody can recreate it against any target. Yes and I have an action item that I offer backlog to script. Some of the DNS setup stuff, which I didn't do.

E

C

E

Giving me this thing I: do it DDS? No, not the initial zone, setup I, don't think.

K

Well, we're look like it's looked at again. Can we ensure that we can replace and create an arbitrary zone for setting up things from scratch so that anyone with an account can always, instead of the expert.

E

Yes, it's that's on my backlog to to circle back to and and polish off, it's not super high on the backlog, because it's it works right now.

D

E

Million other things that don't so.

D

And it's always harder because you have to set the NS records on another domain which will never well I guess it could be scripted well.

E

If we wanted to real, like we can do tests by setting up his own for any domain, we want I can set up Justin s be calm if I want to I won't get any traffic, but I can set it up. But if I redirect it to you, okay.

A

You think today's about dev domain, these days, yeah.

E

Dev seems to be the new cool kid huh I didn't I I've resisted the urge to go off and register one.

A

Okay I tried to try. It was pretty hard to the agenda because I wasn't sure. If there was stuff me lurking or anything especially weren't, going to get to I feel like you covered everything in open discussion. Does anybody have anything they specifically want to talk about for the next 15 minutes.

A

Okay, what one thought or suggestion for me is like thank you, so so much hippie for taking notes here and trying to keep up with multiple streams of consciousness, but I'm gonna just go. Take a quick look at our project board.

A

I feel like we're talking about items that are way way more granular than what we have on the project board and I would be a lot more sane if I had to run this meeting again, if, like each of the things we talked about, were issues on our project board, so I don't know if we have the wrong level of granularity or what, but it's just like it's so much easier to track action items if their github issues that can be moved around.

A

So if all of this stuff gets taken care of asynchronously like I, can we can see that it's just landed in the closed column? That sort of thing I am NOT volunteering to be your project manager right now having that going on elsewhere, um just the suggestion, yeah.

K

I just ran out of time. I was trying to collect all the thoughts here and then go through the board, and then the meeting started so next time, I'm hoping that this process will flow through to the board before the meeting.

K

A

But just so like all of Linus's work to get the container image promote proper running I would view that as a single card, and we can just sort of track the progress and, what's going on, there looks like the board is set up, so any org member can write to it or make changes so yeah hippy. If you are saying you're volunteering for this, you are my bestie.

E

You got it unsolicited peer feedback, man.

A

Anybody have anything else.

E

Cool all right in in two weeks, then we will have our promoter demo come hell or high water, and hopefully, in four weeks, we'll have a cluster that we can show is running that we're proud to put our stamp of approval on. Oh, it's good. Thank you. It was.

J

E

See you only two weeks thanks! Oh thanks, if the l-look feeling slack on Friday morning, I, guess or Thursday afternoon, yep Friday morning or here at pump, all right thanks man.