Kubernetes SIG K8s Infra, 31 Aug 2018

Previous Meeting

⏯

youtube image

►

From YouTube: Kubernetes WG K8s Infra 20180831

Description

k8s-infra-team bootstrap meeting - Aug 31, 2018

A

Anyway, Brendon yes noted, we should see if we can do that. What I heard around the GCR stuff was that they can give us a new name that points to an arbitrary other name, but that it was more difficult to take a name move it, maybe maybe as a one-off. They can do it. The other advantage of actually I mean.

B

You could you could do the opposite right. I mean it would result in a brief outage, but you could move everything, delete the old thing and then redirect the old thing to the new thing. Yes,.

A

Right I think that's what Ben was mostly saying: yeah. We can do something like that with GCS, it's just racy yeah. Well, it's not racy. It's it's a definite, visible outage like we can do it. We can schedule it for midnight or something, but it's there's gonna be a few minutes or or where it doesn't exist. Right.

C

That I meant this. The sync part is because we also have things that are continuously publishing to it. Oh yeah.

A

We'll have to shut the door on that or something so. This is why it's not at the top of the list. The other thing, that's nice about doing the sort of facade pattern that they gave us with GCR is that it auto region eliza's. So if we have these scripts that distribute things to various regions, if we, if we care about it for the for this GCS stuff, we might care about it for releases.

A

We might not care about it for test stuff, which means that you know users in Asia, get the Asia Mirror, etc, which actually resulted in a big drop in the graph of GCRs costs, because suddenly we were serving from local mirrors instead of us.

A

Okay, so logistically, how do we want to? How do we want to refer to this work like? We should have an umbrella name for the effort, the team. We probably need a Google Group so that I can add it to I, am and stuff for the clusters.

D

Surely one node so Timur can also cover the administrative work of the GCP stuff, just to be a backup person for you, some parkland or Goodman as well. That's.

A

Right yeah I mean we can I have never done this with a GCP project. It wasn't full of Googlers, so we should figure out. Do we want to just invite one big Google group that we control access to there or do we want to invite individually? We've.

C

Always done a combination have a few people that are invited individually as a fallback and then also invite a group, and most people are via the group. But someone who is like an admin is direct. Why.

D

Currently so we currently have two individuals, Rachael chemistry, so it's team myself and Taylor from C&C of Taylor's just managing like the budget question, so she is not related to the technical discussions. We have team in myself and we can add, add the entire team of individuals that we have here at disco. All the people who are going to be involved into the process seems reasonable from there.

B

I'd recommend using groups as much as possible just because otherwise, like you end up with an ever-growing list of admins, that's very difficult to read. I agree.

A

I think, just as policy, we should endeavor to have a list of people who have effectively like project level ownership over all projects, but that keep that list small and then everybody else be added to projects with the smallest access control that we can figure out, acknowledging that not every product has a fine-grained ackles. But many do now.

B

Another possibility.

A

B

Know again, but like we use JIT, we is just-in-time access for most most production access. So that's that's even better because then it's not standing access, I.

A

Have not set that up I.

A

B

Actually, that might not be possible I actually.

A

B

Be possibly Google I'm, not sure yeah.

A

I know we have some capabilities around that I've never used it, but I can take a look at that too. So as a group which, should we establish well, let's talk about admin, access right now, there's a small list of people who have org admin, which means you can create new projects. That list probably can't be very large. How are we, how do we want to establish? Who can be in that list and who's willing to be in that list, because it will mean being able to do things for other people if I create projects.

D

I'm on the list so I'm happy to do it, but we definitely need not not a single person who I would.

A

D

A

Need a bus factor of three to four yeah.

D

And preferably someone from the Pacific time zone as most of you, I, don't they'd, be there I.

B

E

F

Can throw my name in there as well if he needs another non Googler like I and I? Think as what we're eventually going to need some governance around this like who gets involved? Who gets those permissions? What hoops do you need to jump through? Eventually, we're gonna need to establish that, whether it's a safe working group or something else, but you know we can start- we can start with a small team now and then establish the governments later when we know what we're covering.

A

I second, that agree with that. We we do need to have your steering needs to have the conversation about how they want to model this yeah.

E

That that's fine, but another thing that I was talking just before you guys joined was. We are missing a lot of people. We are missing. You know people from hippy Oh who volunteered on Twitter, for example, people from Red Hat who traditionally helped out with a lot of the infra work. So we are missing people too. So if we pick our names right now, I'm a little bit worried that we, you know, we don't have.

A

All hands so I think what we, what we really need to set up is like. We can't have this be a huge huge list with or in Coke.

A

What we should do is consider a small group, like maybe this group, as the sort of core transition team who has access to all the transitional projects and, as we set up each property- and we say like DNS, is now established, who wants to help be a DNS admin, we'll get the DNS admin group permission and be able to create new DNS records and we'll have to write a you know, a doc or something that says what is allowed and what are the policies around that and that will be very sort of verticalized and small.

D

A

D

We shouldn't agree with that equality. Yeah, we shouldn't have the unlimited list of people who have access to everything. My assumption that we currently have did a good group of people who are great on bootstrapping and all these people on the current call. So we definitely may have announced individuals from other teams and other companies who will help us with the efforts, because we can skip awesome volunteers and definitely their help will be absolutely welcome. But I'm not sure that we should have a really big list of people who can have an access to everything.

D

The same as I did with totally.

E

I agree with you on that: it's just that. We need to make sure that we have enough people who will respond to the things that need to be in a fixed or approved or set up or configured. That needs to be done by hand right, but then the other thing here is we need some Googlers who know work that we can't be just people who are from the outside as well so I see that be a missing Robert Bailey from from the call yeah.

B

He he chatted on the thread that said that he felt like he wasn't needed. So, okay,.

E

Good, okay, yeah, so I'm happy to you, know, I rolling, but who we have here on the call and then figuring out. You know lit steering committees, figure out some of the stuff and then go on. Let's pick a name, and then is the name: okay that suggested there there's one from Aaron one from Chris: okay, Karl.

G

Are the names on the chat? That's fine, yeah.

A

I agree: does somebody want to go off and create a Google Group? ah Can.

E

Do it? Okay, so it's a steam, so it's not a say, got a working book. So maybe.

A

A

Coincidentally, there are ten people listed, at least in the attendees. If there's anybody on the call who's, not in the attendee list, please make sure you're added at the bottom of the linked document, but there's ten of us. We consider that maybe the inaugural leadership group of this effort and as more people get added, we will figure out sort of which efforts they're, actually interested in helping administer non-exclusive yeah.

C

So I just wanna, throw out there on that. We've been planning on this for a while, hoping that the credits would be finished and out Amin and I. At least this quarter for sure have like a have time allocated specifically to moving all of this from the Google side and I think we will continuing as forward as long as we need to do this as well. Awesome.

A

I'm happy to core, as somebody who has the keys to sort of all the properties today, I'm happy to coordinate how those things happen. I want to be careful that we don't spin up too many efforts in parallel.

A

There's a lot of explorations and I need to figure out of just stuff that I've never done with GCP, which sounds weird, but there it is.

E

So then the next question I had is: when do we go public with the Google Group and is it an open public, open, Google.

A

Group I think Elden I think the discussion should be open. If we need to create a private group, we can but I hope that we don't need to yeah. We should be posting passwords there anyway, correct.

E

We need a slack channel which is protected sure.

A

You can so are we taking action items somebody create the group, somebody ping Paris to create a slack I. Can.

D

I can do everything here on the administrative side. My situation here is to create to Google Groups lonnis one is public. That will be our default one, but in some case, when we have to have some private conversations, we will still have their private group. We can also use.

A

The private group for I am sure I, so I agree that we will need to use groups for I am I would like to say we should not be having private conversations unless we can really justify it. So like let's create private when we need it. I.

C

Would add, we probably will for at least some aspects at some point, particularly around the kubernetes security testing? At least I would.

B

Also say like imagine: if I compromised right like assumably, we don't want that on the public list. I will.

H

Happily, kick off of the private group, anything that sounds shouldn't, be there. I already do that for steering.

A

Okay, alright, then, that's that I'm fine with that! That's fine, let's assume the Kate's infra as a as a prefix and maybe go squat on a bunch of reasonable Google Groups should.

F

We should we do this, like it's just another thought before we go and push the button and set things up, should we do this in public Google Groups, or should we do this on the kto Google Groups, like the G, sweet, yeah.

A

That's a question that steering has been wrestling with: we didn't want to make the kubernetes at I/o. G sweet, be a really dynamic thing. We didn't want it to become a status thing or, like. Oh I, have access to the G sweet groups, but it actually sort of makes sense and there's a lot of things. You can do there that you can't do on public Google Groups Brendan. What do you think since you're on steering and I'm, not anywhere Aaron.

B

Well, I kind of feel like given that we're talking about potentially even hiring employees like it kind of starts feeling like. Maybe it should be part of the juice sweet I mean this feels like plumbing I, guess, I feel like there's no harm and and I don't think anybody's gonna have any status associated with it, but I Erin might have no.

H

I I, don't know, is kubernetes thought I. Oh the sweet already funded as part of this endeavor, or is that a completely separate thing? The.

A

Sweet is funded separately, but groups don't cost money accounts do but groups don't so we create as many groups as we want and add people to those groups, and it shouldn't cost anything and I think that I mean it seems like a reasonable way to administer it. The the Gotcha is, there's a very small number of people who have access to that gee, sweet and now are putting another group of people in the way of being able to do progress. Yeah.

B

But can't you can't you it set somebody else, as the admin of the group I mean, don't have to be part of the GS. We.

A

To be an admin of the group sure, but somebody has to like if we need a new group, if we're spinning off a new effort than somebody like you know, you I think you're one of those those holders- or you know, there's a small group of three right. They have to go off and do it. I would.

H

Argue probably stick to public Google Groups for now yeah in the interest of deep bottlenecking, and if it turns out as we look to more formalize this or realize we do need some tighter access controls that are not available as a result of the public groups, then we can consider doing it for the communities that I have google groups. But I agree strongly with you about the whole status thing.

H

I'd really, rather avoid that, if at all possible- and if we can't like, if we're not willing to plunk down money for pretty much anybody to join the kubernetes thought, I have Google Groups, then I don't think. We should well.

B

Just it well, it doesn't cost it, it doesn't cost money and I, don't think we should give out like.

A

I

Know addresses we definitely.

A

B

Out, like hey, it's not I/o accounts, that's agreed, you're.

A

Not going to have Aaron at kubernetes at I/o right, but we might have Kate's in fried communities. Well,.

E

At least we should have one.

E

Just kidding so the other one is so we will set up the infrastructure stuff, the slack Jam Google Groups, and then we can post this to public on Monday about Tuesday, okay, anything in the Google Doc that you don't want to be public I, don't think so yeah. So.

A

You were you're taking all those a eyes I'm taking them. Okay, Google.

D

Group it soldier I. Do you consider Lincoln in his own.

A

Yeah for the last item there, let's just grab anything that starts with Kate's infra. That seems reasonably useful and we'll go from there and I guess: I agree with her and if we start with public we can always move at private later. Although the transition is hard because you can't add a group to a group through the public groups, but you can through private groups whatever we'll deal with it. When you get there in terms of official nests, we will need to have the conversation with steering.

A

Has there been any conversation there? Yet? No.

H

There has not been we've had some chatter on the private of the private mailing list, since we could discuss this while elizy embargoed publicly, we had a little bit of a chat before you showed up and I. Think next steering committee meeting I'll make sure its front and center as a thing to digest. Address and I have a next item to make sure we're clarifying the whole working group thing.

E

Anyway, okay, so what so in venue we go to the steering committee, do you need like a write-up that we should go with Betsy I.

A

Think we should let Aaron be the the bridge for now and get a recommendation from steering committee as to what structure they would like to use for this. Since this is a little bit different than anything in the past, and once they have that structure, then we can draft the Charter or the mission or whatever is appropriate for the structure that use I'm.

H

Sort of looking at the, but as a rough swag at the scope of this group, then the how and come up with things I would probably try to what's the word rationalize against the same sort of policies that we have for the github administration team, because I think that was a pretty good example of what's the level of formalism that we require for policies and processes and, however, that shakes out we'll see but I think we're like Clarendon and I are both are in strong agreement like we don't want that to necessarily get in the way of real, actual productive work happening yeah as long as we commit and I think Christoph did a good job of putting that point out there.

H

That's like, as long as we all agree that there does need to be some form of formalized governance once we figure out what it is we are governing and that this all may be temporary and we be iterated upon that's great. That's fine, yeah.

A

And the only thing I'd want to avoid is that three months from now, we still haven't set up something and some new person decides on a volunteer and we don't have a way to decide whether they're allowed to or not or whether they can give them access or not or what access we can give them and all the great exam like.

H

That would be a great example of something I think will Y will want for you to define like how are you gonna vet new people? Yes,.

A

Except I, don't want to be the I, don't think I'm. The only voice in that I mean I feel like we understand it, but we have to write it down. Yes, yeah.

H

I had a friend in: do you have anything to add they're like my goal would be to have a decision on this by the next meeting or as.

B

H

The next meeting yeah.

B

I think so, though um it doesn't seem, I mean.

D

E

B

Committee has an infinite ability to bike shed, but we can try to drive figure out which bike shed to paint yeah. That's right! That's right! That's right! Exactly yeah.

H

B

A new bike shed that's a new type of bike, shed.

A

This is a shed for three wheeled bikes, yeah.

H

Yeah I think actually that might be our no it's not quite a lame-duck session. Is it I, don't know, I have to look at the dates.

A

Close yeah, okay, so looking back at the dock name and effort list of priorities will need to come up with the naming and structure convention for GCP projects. I'll. Take the action to go in a little bit and just to see sort of with the first few items on our list. What the right level of access control would be with respect to Google Groups I haven't actually played with groups, and I am very much so I can play with that. A little bit interesting challenge, I just found.

A

Is it detects that I'm coming from Google, and so it offers me Google things which I'm going to try to figure out how to defeat so that I can access this project as a non-blue.

A

The other thing is billing: accounts I will take a look I'll. Take the action item to take a look at what reports we can set up with billing accounts and if we can get the right granularity that we want with a single account or if we need to actually create derivative accounts.

A

B

I'm also so happy to once Tim get something set up: I'm happy to drive the DNS work forward.

A

Can't you like create it if you're, if you're, writing that program Brendan. If you have the other direction, then I it's done. Okay, so I can point it out existing DNS have it dumped the ammo and then we can sort of look at it scrub it decide if it's what we want and and then like use this as a proof of concept, I like we can get either you or the group added to the the first project and we can import it and see if it all came out the way we want it to okay.

B

Yeah I just realized I, don't have the printout for the dump. I have the yeah mole to cloud, but they don't have the cloud to llamó part. So I'll go I'll hack that together, okay.

A

C

Sorry, do we have a good place for storing these things, I mean so like, for example, the testing we just kind of have a directory intestine for removing all the conflict. But what about like the DNS config and that's.

A

A great question: should we create a new order? Should we create a repo that has a bunch of sub directories, probably not a repo? What.

J

I know / kiss dot IO for this. That's what I was gonna say: yeah you didn't place.

C

We already have the website there. I was also going to suggest possibly related to org repo, it's kind of a similar thing where we're doing administration via yeah Mille, maybe maybe one for the infront one for the work.

H

You mind sticking with Katie satire for now until the steering committee figures out what it wants to do, I think it said: IO makes sense, hey.

J

All right, one other ten dental question I had just wanna make sure we do have to fact required on these projects or this or it would be a really good idea. I think it's something you can require with GCP I was looking up so I think as long as we like and enable that on whatever or this against EF or whatever I.

A

Think it's already enabled on these organ I remember the hassle. Brian went through to turn on a year and a half ago. Okay, so we're gonna use github, kubernetes Kate's at I/o or yeah. That's that's! The right wing, github, kubernetes Kate, said I/o will make some directories under there. So Brendan. If you want a home for your yeah mole importer, that could be a home for it unless you want to stick it in a separate repo and just use it from there like.

A

Okay, fair question is the github kubernetes Kate's at I/o repo for the code and the tools, or is only for the configs.

C

A

Only yeah I agree.

C

A

Agree as soon as I had said, you can stick the code here. We're.

C

In a huge effort to fix that and test in front and it's taking way too much time, we should avoid doing that. Brendan.

A

Stick your animal convertor anywhere you like. If you want to create an organ der kubernetes, we can probably justify that if you want to stick it under Brendan D Burns, it's.

B

All there it's already under my personal repo, so I'll just leave it there until somebody complains. Alright, it's fine with me.

A

Okay and you, you put a link in that in here somewhere, right, yeah,.

E

There's a link at the top and there's a link in the comments too cool.

A

I will Brendon you ping me when you feel like you've got the importer ready and I'll take a look and and see if I can run it against the our existing repos l about to go on vacation, but.

A

It's the end of summer, like no surprise you're. There.

H

A

And lost the Brendan, the.

E

Brendan is muted who's off next week and when can we have the day sorry I was.

B

I was literally I'm literally like packing. The top of my car sets on you and my phone in my pocket, struggling with heavy things. Okay,.

A

So I don't think there wasn't anything else for me all right was there no I, you know what in fact, if you're out I'll, maybe I'll, if I can find some free time, I'll take a look at your tool in the meantime. Maybe are you a the import direction or something feel.

B

Free it'll be really easy. The load from cloud is already there. It's just the dump, its literally you're gonna, be like you need to add a flag and a little bit of code to dump to llamo, but, like the actual grabbing it from the cloud is already present. Alright,.

A

So I can take a look at that I'm out like one day next week. Just for the long weekend, like there's Monday off I. Think I'm taking Tuesday also I have to ask my wife if I'm taking the day off so we meet two weeks from.

E

Now and then we will do everything else on slack next week. Okay,.

A

So two weeks from now with the goal is to have the DNS 30, the DNS two old, complete and at least a proposal around billing and project structure. Right and.

H

The steering committee will have talks about how we want this to be formally represented and hopefully have some kind of discussion for you and.

E

Feel free to slowly share the dock with other people who might.

A

Be interested absolutely and anybody who comes up with more ideas of things that are need to be cover here or wants to flesh out more details of how to make these transitions like Ren and Jeff. You probably have thoughts around how to make the flop of the testing infrastructure this either link to a dock or start throwing notes in here somewhere yeah.

C

Yeah I think we need to write a dock, but yeah.

A

And as I'm thinking about the ordering that we talked about here, we can do DNS manually, but eventually we'll want to have this tool and the tool probably wants to run to keep cluster so we'll pretty quickly end up in the second category, which is fine, actually I. Think that's the right way to go, because that that unblocks, you know 15 different efforts that want to run in the Q cluster right.

E

Sean Emmett did you, have anything you've been pretty quiet.

K

E

So I was basically.

K

Here like to see, if there's something that might be needed from the scalability side, because there's a bunch of different stuff that, besides just just the tests themselves, says like some infrastructures there as well, but I'm, happy to help with something else as well life.

K

A

Biggest thing you could, you will be just start enumerate in the details of like if we were just take on the scale testing stuff you know tomorrow. What would we need to write.

K

Sure yeah, yes, I, think that makes them say. I do have that stuff to the document. Then, okay,.

E

Yeah I mean things, don't have to wait, we you know just because we have a lower.

A

Priority right, quick, just to put it very concretely like I, knew the GCR stuff would be a big deal to get there in director up and to get. You know, hundreds of pull requests against all the different repos changed. So I started that months ago, and it's still not done it's still, there's still some that haven't, merge those PRS or have regressed in some way or another, so we'll have to do another pass.

A

So if the scale testing and the CI testing requires sort of pre factoring of repos, that's good to get those things in flight now, yeah.

K

I agree with that guess: I'm.

I

At how about you yeah so as Ben mentioned and and I already have some time allocated for doing this, so yeah, we'll probably start with adding a new Doctor Who, how we plan to do think. It's.

E

On spec and whose birthday is it next week Tim, it is my birthday. Next week, okay, happy birthday, you ever think.

B

A

Should all say, please, don't you.

H

E

So Brendon have a safe journey. Anything else, I.

B

Think we're good. Thank you. Okay,.

D

My final question: my final housekeeping question is about the Google Group I just figured out that everybody has to request me as an owner to join the Google Group I suppose we have to. We have to change that, like everybody can join the group right at.

E

Least, add me, as a owner to.

D

Yes, that was the second question, who is the second secondary owner? Not.

A

Making dims the owner sounds great, you heard, can you just? Can you just direct, add the ten of us for now or do we all need to go and click on a link.

D

Yeah yeah I will I will send them now. I will send invites to you, but I need some of the mail addresses for those people whom I don't know all.

A

Right, everybody on the call go. Add your email after the your name in the attendee list,.

D

Yes, and and like slick IDs because I don't know this like ID for EM. What and and and shim.

D

If I correctly pronounce my name as we have eight people in inside Channel, but we have ten participants here actually.

A

Can everybody add also what time zone you're in.

D

H

Sure some of you have gotten this on Twitter or whatever the other awesome social media live streaming. Things are, but I just wanted to really. Thank you so much for all of the pushing and effort that has gone forward to get us this far I know there are some outside who think. Oh great, the switch has been flipped and it's all done- and this is the group of people who recognize that yeah we're talking on the order of months worth of work.

H

So I just wanted to thank you all for getting us this far and for getting ready for continuing the journey. Huge.

A

Plus one thank you for volunteering. This is what makes this stuff work thanks a.

G

Lot, everyone, okay, run bye. Thank you very much.