Kubernetes SIG K8s Infra, 30 Oct 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes WG K8s Infra - 2019-10-30

Description

Recording of bi-weekly Kubernetes Infrastructure Working Group (k8s-infra-wg) meeting which happened October 30 2019

A

Coming now at the beginning, I want to remind ourselves about a code of conduct which we can summarize as be awesome to each other and at the beginning, I would like to ask one of you to take notes.

A

Let me check if there is maybe someone who can help us from never regular attendees.

A

So the we can also start is to put your names as a attendees in the document which I've send the link to our chat right now. Oh.

A

Hip Hucker will be some card to do notes. For me, a perfect sounds great okay. So, let's start with our recurring topics and I see a lot of new faces from the our onboarding session last week. Is there someone who didn't introduce himself and want to do it now? This is the time for that.

B

Mutation vision, where I write a lot of stuff and go so I'm eager to start working on something with the infrastructure, perfect.

A

It's good to see you Annie thank.

C

A

C

Else, hi Kimmy yep I am my name, is Adolfo I'm from Mexico City and I work in a cloud. Consulting firm I usually do some coordinates, work and go programming, and so this is animal left. Wait! That's why it's headed to China perfect, it's good to see it too. Here.

A

A

Okay, so let's, let's move further I think that we decided that we will be doing billing reviews every two meetings, so it was done last time. So we are skipping this and let's go further to our action items review from the last time.

A

Is there someone who can tell us something about the progress on moving to AAA?

A

D

I think I think.

A

You could actually I think I can and I can tell about the error back rows, because I created some initial version of this back rows and I've put it on github issue, and there are like a few questions which I also put a discussion later I'm, sending the link for the one second four hours like for for the github issue, and there are three things which I want to discuss. One thing is: if these resources are enough to the user, so let everybody can check if they think that this is this.

A

This this resource will be enough for the user. The other thing is what we are missing, I feel like or I. Don't have enough information about way of authorization where we can use our gmail accounts actually to authorize ourselves to use the cluster, because I, checked and I didn't have access, as my Google account, but I had access, as just as a cluster name inside inside the terminal of disappea.

A

So I think that the one thing with which we need to discuss is to.

A

How we will be able to introduce the authorization for the users.

D

A

It's a great point.

D

I so we've set up the cluster as a private cluster and we've disabled all public access to the master, which means that anybody who wants to use the cluster has to go through cloud shell, which means that everybody goes to cloud. Shell has to have some set of permissions to be able to get that far. That is an excellent point which.

A

I have in mind right now is to implement so oh I did see flow, but I feel like again. It means the customer will have to be a public already yeah.

D

We could do that or we could why we talk about UX here or we give everybody who's in one of these administrative groups, the ability to use cloud shell- and we just document that this is the way you access the cluster, and you know it's. It is cube cuddle, it's not actually different from anything else. It just means that people have to have a they have to pop up in a browser to do it. Yeah.

A

Then then, they're there I don't see that there would be enough granularity to tool, for example, disable the secrets, visibility for the secrets for some other people. Then the administrators.

D

Let's try that we have time set aside when night next week right next Tuesday.

D

Let's try this, let's see if you and I can figure out, maybe I'll try it in the meantime, if I get a few free minutes and if we can figure out how to give your your second account enough access to be able to pop open the cloud console and run cloud shell, which should log you in as you with your gmail address, which should give you the ability I mean that that is the off end part and then a Z part is the are back so hope we can make that for work.

D

I tried it this way, sir.

A

Sounds good for me and that only thing is that I checked, which user, which kubernetes, which use see me as which user and it wasn't mine, Google account. It was the name of the customer if you know the region etc. Okay,.

D

So we'll have to we'll figure that out there's a way to do this. I just don't know what it is.

E

D

The top of my head- let's, let's.

A

Move it our next okay,.

D

That sounds great that, but that's good progress, I hadn't seen the bug so I'll look at the issue a little later today and we talked yesterday or the day before I I think we've got a good base list and if we need anything beyond that, I think that would be special case, which is fine, yep.

D

A

Everybody please take.

D

A look at that- and you know, especially if you're really familiar with our back, take a look at it and think about what. If you were administering an app on videos, what other resources you might want to use.

A

Gcb up, for you know, maybe I.

D

Did there's some debate about whether it's actually valuable enough like if it streamlines the UX enough right now? The thinking is maybe not like. It changes, one step which is submit a PR to pro, with, like two other steps, which is go and activate this GCB account and go make this linkage so substituting one for two, probably isn't the the right trade-off to make I was trying to streamline UX. It doesn't look like it's gonna get any more streamlined, so I'm gonna dig a little bit more or I'm.

D

Gonna have to ask Catherine Eric to dig a little more, but if that's as good as we can get that, maybe it'll just leave it the way it is okay with me.

A

Okay, so let's I want to switch kind of make it faster to make some time for questions etc. So the next topic is my promoter. More robust is there yes.

F

Hello, so I posted or sorry I created a wiki page that has the pretty much all the context. The two main items around this area, which is backups and already I, am NOT actively working on it right now, but I will work on it probably later this week, but until then I, hopefully I can offload more like context to other people who are interested in working on this area.

F

Like all the code is up, there, I even pushed up a work-in-progress branch for the arting, which is actually a little bit more involved, but hopefully I can help delegate or at least spread the knowledge around this area so that it's not just me do.

D

We have enough, do you have a Google group that that we could have people join? That would give them the ability to go off and play in the playgrounds that we set up.

F

Probably yes, okay.

D

There's so many I mean if we do I, don't know the name of the group, but maybe we should look at figure out what the name of that group is and if there are one or two or maybe three people who want to jump in on these topics, we could give them access to the the test projects and I.

A

D

Are playing definitely.

A

That one question for me is because I saw your document and but I didn't check if it's public, or only like some people have access to these. It was just a wiki page on github, so okay, so I will send all so this link to the other guys to just check it. And yes,.

D

So if there's one or two people who want to help on this particular area, the the promoter, auditing and dr side of things, you make yourselves known to Linus and we'll figure out how to give you enough access to try things. Yep.

A

Exactly sdp roads we not even man, guys we meant people not only guys next topic, terraform Bosco's, mmm who can tell us something about it.

A

I have no updated contacts on this yeah me too I don't know there is no different themes, I conceived in sin, so let's move forward and you there will be Dean's. We can go back to this topic. The only thing in our like action item list is the end-to-end test and I see that also there was teams who need to be there to tell us something about it. So, let's move forward and wait for games about it.

A

The next thing in our agenda is the actual open discussion and I want to start with the questions from the community from the newcomers from after our last last week, onboarding session, so the next. So the first question is from oshkosh. Sorry, if I didn't pronounce it correctly.

A

As far as I know, a working group in fresh should be responsible for the infrastructure that has been immigrated to CNCs. What is the current state? Are there? Any interest at have already been emigrated. This is the first question. First part of this question.

D

So the first ones are the ones that are almost across the finish line. So we've got this new cluster up. We've got certain manager up we're working to make sure that we have the ability to access control it and once that work which part is doing, but other people are free to participate in once that is done, then we can open the gate to migrating the half dozen or so other projects to run in that cluster and for each of those projects.

D

We need a team of people who are going to sign up to own it and pay attention to it and think about how it runs. Hopefully, most of these are low requirement roles like they're. They don't take alerts very often, but they need somebody who says this is my problem, so it's really getting it across the finish line right now. The other part of it is the GCR migration which Linus is here representing that's one of the largest tasks that we have identified.

D

Getting it again, a classic 80/20 thing getting it across the finish line is the hardest part. Once it's across the finish line, we do that migration and then hopefully it's not very high impact beyond that, then, and then we start the process of and what else. So now we have targets like Bosco's, which is a project rental service that lets tests, get projects clean them and use them for running CI, the overall CI systems, the prowl stuff, all the other little bits.

D

We have a long list of other projects that we've chosen not to tackle until we get these first couple ones out. So I keep saying it, but the 80/20 problem is is real here and so getting these projects across the finish line will enable so much other stuff. Okay,.

A

Great and there's other part of this question: um has there been any infra undersea ncf from the beginning of the time? And if, yes, who is responsible.

D

The short answer is no but kind of mostly not really some things like the website, which we run on net liffe iso kubernetes, that io runs on metal affine, that is CN, CF, owned and paid for and, frankly, I don't actually know who gets notified. If it goes down, I know I have monitoring of it, so I will get paged if it goes down, I don't know. Who else does that? It's not formalized very well. Okay, thank.

A

You Tim mmm the next question I. Let's do that. I will just start with a question in which are in the document. Then I. We will spend like a five minutes for the question which are not there yet, because we have some some more topics to discuss. Sorry.

D

Can I add one more just just for the for the sake of people who are interested in what else is going on in the infrastructure? We also have a Google G suite account, which is community as CN CF, owned and paid for, and that is run by mostly steering people. The steering folks have access administrator access to our G suite account, and there was one more thing that I thought was interesting. Now all our github stuff, which we have a github admins team, volunteer team.

D

That runs which people can also sign up, for they do things like making sure that repos are taken care of and being put in the right places and that the automation and tools are responsive and those sorts of things.

A

Perfect another question Arthur. This is question from Neal's and other designs available of how things are tied together there. This helps in a quick understanding of things, I.

A

Don't think that do we have that kind of designs and I think that one of the main outputs which I want to achieve after we will split our efforts into subgroups would be to actually create the single source of truth with the output of state of the world with the whole infrastructure.

A

So then I think it will be easier for us to do to have this document with kind of design of this infrastructure, because it it grown as team set on our our onboarding meeting, it's grown like naturally, so there was like no plan from the beginning and everything was like a partially added after sometime.

A

Another question- and this question is from also from news: is there like a delegation model present for privileges I'm asking this? For? If monitoring standby is one of the main concerns, we should enable people to perform specific actions or see specific log into info to identify in identified fix an issue.

D

Yes, one of the I think one of the big issues that we have right now is because we haven't had a diversity of owners of things. It's been the same two or three people who have had access to everything or who've been managing everything. It's been sort of informal. We have through the commune effort here, we've been really pretty good and rigorous about setting up Google Groups, which are governing all access.

D

So the end state should be anybody who volunteers to do some effort and is you know, vetted and accepted just add their name to a llamo file and everything else happens automatically and the mo file isn't get up.

A

Perfectly the last question from muse is what kind of knowledge should be consumed? First to speed up our contribution to the work group and I? Think I can answer this question because I for the onboarding session I prepared the document which, where I spent some kind of amount of time where I think that are all links which will be helpful for everybody who wants to start as quickly as possible. There is around like a twenty links and what I did when I started almost a year ago here was to watch all of our.

A

Buick Lucerne from the past I know this is right right now, it's all about 22, so so it can take some time, but it helped me a lot to understand what we were doing and what we'll call the progress of this. These are. These links to this playlist is also in this document and I figured.

A

This is the best place to start and if, if you think that anybody here thinks that there is something which is missing there, let's just put it there and I think that this will be a single source of truth, maybe not a single source of truth, but that good place with all of the links which can be helpful for contributors.

A

Another question which is from joy and as a new contributor to this project, while doing any work, I might need some help, questions to be answered. What is the engagement model look like in such cases? I? Don't think we have something planned. So what I would suggest is to use our slack channel as the first place and if it's something were which have in mind, you can structure it or you can.

A

You want to write. It's quite more informations is to create an github issue and then pink some people on slack to discuss it. If there is something which you don't know, or it's really hard to discuss on a selection, I'm, open, I'm slack and you have my email address in these documents- feel free to write to me. I can help you to point the people who could help you if I will have no lecture if I want I will just ask some people how we can help you or how you can solve the problem. Please.

A

D

With that and if I can add to that, the slack channel is actually the right place because it has the most people who are available at most hours of the day. You know Bart is often on Europe time. Dimms is on East Coast, u.s. time I'm on West Coast u.s. time. So we've got a fair coverage of current time zones and hopefully, as we grow more people more contributors, we will have even better coverage and we'll be able to get help on the fly, while I'm not paying attention to slack every minute of the day.

D

It does buzz. My phone, if somebody mentions me so like feel free to jump on slack if somebody who's working on something and is stuck and has a question, I'm always available to try to answer questions.

A

And another question: this is from Alessandro doing it special token access to work with the infra or all the work flow is managed by a github pro, and this answer to this question I think that we partially answered before discussing about the AAA, which is a new cluster for our infrastructure. We are working on that and part of all these roles and resources which will be available for users.

A

You can find inside the github issue which I've put on a chart here, and but this is this- is the access to the new infrastructure for the current infrastructure, the only people who can access it, our some Googlers like at and others, and which.

C

Is the problem.

A

We're trying to fix you guys to clear user, and the last question from the list is the question about the subgroups where, where DNS management like new gates that IO subdomains, even auditing the site and other artifacts fits on mmm I, don't know. Actually we can I think that we have the the document which we are working about. The subgroups about this idea of the subgroups is still it's just fresh, so you can suggest the places. If you think up there, there is there is something missing.

A

You can feel free to just suggest a new subgroup or or start a discussion there there or on a github github, because I also created an issue for discussion about that, and let me send a link for both of these one. Second.

G

How the genus is managed? It's currently, basically in a llamo file inside the Kate, said IO repository and then get synced by octo DNS package, basically, but that's sort of manual. So we have different stages. We have a stage staging stage, basically I, which then gets automatically tested, and then it needs to be reviewed and finally approved to auto deploy sort of so we're still in the process of figuring out.

G

What's the exact things that need to be tested, how to make that completely automated and then DNA is basically just a kid UPS thing which Tim knows more about because he moved in yeah, but.

A

I think that the question was mostly related about this suburb. I. Do you know the subgroup or maybe not everybody know about it, because there's so many people who can help? We thought that the best idea to to get everybody to start hopping is to divide our job into subgroups with the mentors and the people.

A

You don't amenities, and the question I think was where these particular three things fits two subgroups and the answer is I, don't know, but we definitely can discuss it and I think that the asynchronous discussion about it is is really really great on github, so definitely suggest something there. So.

D

I'm I'm happy to sign up to mentor comment or the DNS subgroup and I think Michael just gave really great State on where we are there's work to be done in the medium term. Once we have the cluster really turned up, we want to fully automate the what we currently do manually and then over the long term. The I think what the DNS effort is merely agree to understand why we have DNS records and VD approver for when things change and.

A

That's a really great great way of another topic, which actually is that topic about discussion about the subgroups team suggested few subgroups. But this is not the the like end list and, as I said before, we have like in the next two weeks for talking about it and actually I want before the next session. I want to have a list of these subgroups with mentors to start actually creating these subgroups with people who can join these subgroups at the next session. Is there somebody who can have some suggestions about it?

A

Some I mean maybe thoughts if it's a good idea or bad idea, or why it's like that. This is the time to discuss it. I.

B

H

It's a great idea: oh.

B

A synchronous work, it's purely.

D

Sorry, there's somebody else: there.

I

This is I think we were talking about how to do subgroups and storing the information as far as how we work with our repo one of the things I've seen us do in the other Rusty's donor smiles. So you have the people who are kind of like the approvers, and so those are the people who have the deep knowledge to say yes for sure for sure and then putting the people who are red stepping up to be entered as the I believe.

I

It's two reviewers so being sure that those people are automatically assigned as reviewers when tickets are created, Forks, they're, PRS or creator stuff from the shoulder. It might be a way for us to reuse, existing kate's community infrastructure policy in the nation. Let's break.

A

A

Other thoughts about it.

A

So if there is no other like notes and thoughts, let's move this discussion to the github issue, which I've placed putting on our chat here and also we can talk about it on the slack and we can move forward to the next topic, which is: is it possible to expose some of the post post logs from Jason.

J

Yes, just to provide a little bit more context, I've been working with James on taking the EDD conformance testing that he's been doing in the GCP provider for cluster API and extending it also to the AWS provider, and one of the things that we're noticing is some inconsistencies with runs, and it appears to be related to the accounts not being fully clean, likely expect them to from the boscoe's ruin janitor, but currently trying to troubleshoot.

J

These issues requires you know, synchronously working with some with the test and Bron call and I want to start a discussion to see if it would be possible to publish those logs somewhere that are more easily accessible for folks that are trying to figure out. You know and troubleshoot why some particular test runs may have failed, related problems like these. Yes,.

K

So if we move the CI cluster to the community, which would be some awesome work to help with then we'll have the logs right now, those logs are because it runs has to run alongside the CI workloads they're in the CI cluster. So we have like stackdriver logging for this, but I. Don't think, there's a super great way to like take that and like like republish it or something.

J

All right, yeah I wasn't sure if it was, you know, technical limitations like those or if there was specific policy that we were worried about exposing you know potentially sensitive data or anything like that. I.

K

Don't think that's a huge concern so like if you can find a way to take like a you know: GE odd, logs and ship them somewhere else that is accessible to the infra can run I. Think would be fine with that I.

J

Think I think we can probably be fine waiting for the Oscars to be employed to a community-owned cluster. For that I.

J

Don't think we have a timeline for that yet, but I don't think it's going to be so far out in the future that it's going to be a true impediment to us very.

D

Generous of you, Jason I, worried that without clear ownership that the timeline might be much longer than any of us really want do we have first of all so I'm asking I, guess I'm directing it at Ben, but anybody who knows the answer do we think that the boscoe's target is the next likely target for communitisation, I.

K

Mean so the projects that it operates a fairly easily Bosco's itself, like I, said it needs to run I mean so the way that we control access to this is just that it runs as a service inside the CI closer and there's just like a a rest endpoint that the see our hoods can talk to so I think the way that it is designed and operated currently we'll want to have the CI cluster move. Okay, that that's.

D

K

Bit involved, but.

D

The worker projects are the thing we've been talking about alright well,.

K

I think Jason was talking about the logs from the service that does clean up the. We could maybe run the service that does cleanup separately from the rest. If we changed.

L

K

We to play a little bit like we could deploy the cleanup service to a different cluster I. Don't think that would actually be a blocker. So.

J

I think it's a little bit more than that too, because we've been trying to troubleshoot other related issues like at first we weren't doing heartbeats, so we weren't updating the resource, so the the Reaper was coming through and you know, marking the accounts for cleanup earlier than we had expected and so being able to get more insight into all of the stages of Bosco's, including the janitor would be ideal to you know, figure out these issues without having to you know bother so many people.

K

Yeah I, don't think I, don't I'm, not sure if that one's feasible, I don't think moving. The whole thing is the best next target, because I think the target we really wanted. If we're moving, the boscoe's deployment is to move prowl, it kind of goes with prowl.

A

There's a comment from Tomas: can we use it pops up and have a random consumer with a service account somewhere else? I swear I've done this before we case pod logs I.

K

Mean if you can write up how we would go about doing this I'd happy to look at it, but I we've not done anything like this before yeah.

A

I think that's a great idea to create an action item for Tomas to do some research about it and like given us information. Also.

K

I think we generically want to have the see I like accessible, and we should probably focus towards how we how we make progress on that.

I

Do we have a are we gonna separate out, Bosco's and and prowl, or do we have like a design document for the process that we're going to take, so we can start giving that up and seeing.

K

So I, wouldn't when did you start? It I'm, not sure where it is, but there's there not really. It's really separable I mean inseparable from like the proud services, but it's not really separable from the workloads that cluster it's kind of whole point. It's a service for the workloads. Bosco's is a service that Reds things like GCP projects.

K

So the CI workloads talk to this to borrow projects for testing, so they kind of need to run it be kind of needs to run where the workloads are at, or else someone needs to build some like authentication and do it or something which I think is not complexity.

K

We're looking for right now, so to move that we should stand up a second clean, prowl somewhere and start moving periodic workloads that are not tied to repos directly over and kind of like get that infrastructure warmed up, and then we can talk a little more complicated moving things that run against PRS and repos and.

A

There Kenny step a little bit back. There was there's a question and from our new members, what is both costing a few words? Can we see I.

K

Think I addressed that it's it rinse it rinse GCP projects AWS projects and ensures that they're kept cleaned up after things are done with them. So that way we can spin up into in test clusters and like when we're done running the tests. We can ensure that all the resources are deleted and ready for the next run at.

D

Least, that's the theory.

K

Yeah, unfortunately, essentially no cloud provides an API that is just like what are all of the resources I have. So it's a little tricky to make sure that you addition.

D

Of all this goes back to the other conversation about me. Oh maybe Bosco should be. We like, as a community on project. Maybe Bosco's should be evolved to more dynamically, create and destroy projects whole projects, as opposed to trying to clean them up, but that's a separate project that is through sync testing which, by the way, if anybody on this call wants to get involved in I could certainly use eyeballs well,.

J

I think that solves particular issues that are related to the management of GCP accounts. Other cloud providers don't have as friendly of uh kind of delete all the resources under this project, tech concept.

K

Yeah, so we we have some stuff, though Jason has been working with for a dubious accounts or regions as well, though we use mainly for cops testing previously, but it it.

M

Needs some love, I'd also say it's also handy to know if the job is leaking resources. Ideally that would fill the job today. It has filled the boss cos clean up so.

K

We can't always enforce this, but most most jobs actually do attempt to run and clean up and will fail. If the cleanup fails, will they fail if the if they cannot find something?

K

Well, so the in I mean they're coming at it from the perspective of they're trying to ensure that they locate and delete everything that that were aware, we should be locating and deleting, as I said, there is not a single unified like is there anything there's more like? Is there one of this type um and at least I only know, but I also only really know about this from the GCP site.

K

I haven't touched the aid of this site as much and I'm not actually sure how I think it's working similarly, but I'm, not positive yeah.

J

We've done a lot of work to make sure that we're cleaning things up that we create, however, I think some of the resources that we're running into are ones that, were we weren't doing so well about previously, and it that you know it's very. You know right now we're at the point where we need to start investigating kind of the janitor lives to see you know kind of.

J

What's what it's attempting to clean up, what it's missing, cleaning up and that sort of thing so that we can get the accounts back in a better state and once we get there I think we'll be in a better clean state where we're cleaning up the things that were attempted to create, but because for cluster API at least and and I expect similar for cops, because we are attempting to actually spin up kind of infrastructure on demand without it being kind of like a preset thing.

J

There's always going to be potential for from resources. So how.

K

Useful would it be to have access to the projects under test, as opposed to those logs I think that's a that one's more immediately actionable. Yes,.

J

That would definitely help from the aspect of being able to actually go into the account Cinci kind of what is you know what what the current state of things are, but having the having the logs would help with troubleshooting. As far as why the cleanup isn't happening or being.

C

J

To specifically associate which account like we can do a little bit on which account ran with which job, but we don't necessarily know, at least from the metrics that are exposed publicly, which accounts are actually assigned to jobs versus not assigned to callebs. So you.

K

J

Which account should be clean versus not right now.

K

So I'm going to say, there's things we do. We should take this to stick testing and we can also look at like exposing those metrics. If that's what you need, we should look at if we can just expose the logs from the current infrastructure and a better way and then, as far as this group, we should look towards. Can we move to using projects that are under the CN CF, and can we move towards moving the CI so that you can generally debug the CI?

K

J

I can say that the AWS accounts we are using are under the CNC F right now there was a bunch of kind of stuff we had to go through to get to that. That said, I don't know about the state of the GCE or gke accounts under Bosco's. They.

K

Are not currently- and there is an open issue under this workgroup about how to go about that I believe in dims was most recently looking into this.

D

In the meantime, are there things we can do that are hacky like? Can we bulk export logs up to a GCS bucket with world read or something right.

K

Like so that I would say it's probably more of a like. We should go talk about this under sig testing, because it because on this it workgroups and we'll just needs like maybe the storage endpoint or something we're not like the that will have to be something done with the current infrastructure. Okay,.

M

There's also an easy thing we can do, which is like the way these were previously cleaned up was that we would clean up periodically any resources that had existed for longer than some threshold of time. That job is public. You can see a logs for it, it's in desperate and it like logs or it's very verbose in what it logs. So you can see anything that is leaked and if it determines it should be removed, it will try to delete it and if it fails, it will log long error messages.

A

Okay, so do we have any action items related to this topic, or we are happy with saying that when we will move move it to the community cluster, we'll look at it further I think.

K

We have the existing action item around the GCP projects and I think we have an action and I, but maybe not necessarily for this work group to look at like exposing the logs betters, given that that's actually not currently our infra and.

K

Like I I, don't think we have an action item yet furred, like you move, that's yeah I think that's a little bit further down the line.

A

Okay, so mmm let's I think that the next topic we already discussed, which is like these Arabic rows, so I'm not going to mention it anymore, and we have like almost more than 15 minutes about other discussions. So if you have any questions which were not asked yet or want to suggest something to discuss something, this is the perfect opportunity to do so know. Anything.

D

Is fair game so there's a lot of new people here and I will be the first to admit that I was a little unprepared for the swell of people who volunteered to help out so I'd say we're, maybe underprepared for having actionable things. But if people have questions or thoughts or suggestions like, please feel free.

N

Question quickly, so do you have any page where you contain already stored acronyms that he mentioned in these discussions right, like the bus, closed and similar things.

D

Most of the things we're talking about here have issues open on github kubernetes Kate's. Today, oh and if they don't.

N

They should I mean any page that contains this, the definition of what is Bosco's. Oh, oh.

D

The definitions- that's a great question, then distinct testing have anything like that, since you guys make up the most words.

K

There's a lot of things in testing for they're, not the best okay. Let me see if I can so like, for example, in the route readme here we kind of have a very, very brief listing of all the things. There's also some discussion here.

D

And to be fair, I don't even know what all of the systems that all of sync testing uses are, like I only learned about Bosco so a couple weeks ago. So nobody should feel bad if they don't know all of them, because even I don't.

K

Thank you, yeah, it's a big project and we've we've won from standing up a lot of things and for things like this, we weren't able to find something. That's existing thing. Do we need it.

A

Thank you, lady. That was a great question.

L

Hi most not a suggestion, since many of us all the newcomers.

L

Here, we are going to basically we're going through all the documentation and we are going to be subdividing subgroups, I'm working where am I I really selected sites for the future, as we are learning how their sick works, how they all the infrared acumen it and put it in documents, and maybe at the end, put it all together and maybe producer and kind of some, not official, but at least sentient by there, but they forgive documentation how how everything's architecture right now, how are they cluster run indicators website all day for work on the ECR on the future registry.

L

I mean like this also for the for the sake of our know, of our learning process in the in the group, but also for the future. So we have everything documented I, think.

D

There will be one I, also think, there's opportunity here if somebody charts a course through all this, to do some really interesting community talks like a cute con talk on this process, but actually be really interesting and I also want to add to.

A

That that one of the goals which I have right now is to create that kind of document session as a single source of truth after the initial like the work of the subgroups. So if we will know, for example, what was done, which needs to be done, I think that it will be much easier to then to create like it will combine the whole efforts in one place and then to look at least what what is the design of that everything.

B

D

This is a community process, so anybody is free to identify a gap and get started on something nobody needs permission. I will.

K

Add reef leave that as far as the testing infrastructure stuff, if you look into the previous cig testing, deep dives and coupons, we've gone over pretty much all of it at one point or other, usually actually, each cycle. Someone goes through most of what we're currently running.

K

And those are recorded on YouTube.

A

Any other suggestions or questions yes,.

G

Oh and I we're discussing a bit about policies. So currently it's mainly getting a suggestion and then trying to get time from dim. Sir came to finally do decision, which is firstly not document it and, secondly, really draining on basically the time from Tim and Seth. So we were thinking about running down or starting to write down the different policies.

G

Even if it's just a suggestion like how would it work from a community perspective, such as when is a DNS change, actually going to be in case today, for example, what Tunis is actually going to be in there and then going from that? Which clusters are we trying to run? Do we have a highly secure cluster to have a utility cluster that is more open and more open to run non project, white utilities or something like that? And then what runs in which cluster like that?

G

We have a policy defined where, instead of going to a specific version, we can say. Ok, we have a group of people and they can always reference a specific dock and as far as I know, we don't have anything so I wanted to get that started and especially because it might be interesting to get input from like the community at large and I added a few questions.

G

So basically the main things would be DNS changes allowed, which are the different clusters, a higher security cluster, for something like the promoter or something where not, everybody needs access and most likely no one should have access, because it's such a sensitive topic that yeah that the risk of exposing that might be too high and that we have a utility cluster that allows a lot more wiggle room in terms of who has access its might just be scoped via our back into different namespaces and then to each cluster. What runs in there?

G

What does a Sikh or a project need to to provide to basically run something in there and then on that specific thing as well like what are the resources that are available for a sig and up to what limit like? Is it a hundred dollars?

G

Because we don't care, we don't want to like have the burden of checking if, like the dollar spent, is really that important or is it like what specific hurdle is there and what can be used to do things basically and a few other topics in general like getting policies written down so.

D

I think those are great, there are say at least three categories of policy that you talked about and they all need individual documentation, but I think that's fantastic. I definitely want to get myself out of the loop as much as I can so that people can do things and make decisions without me having to block him. The security question I think we don't have to cross quite yet because for now the promoters still running in prowl so or rather for now it is in prowl and prowl is in Google space until prowl moves over.

D

We don't really have to cross that DNS is a fairly obvious one and I forgot the third one that I had to called out. But yes, there are Oh sings, I, think that's a great one that we have never written down. Right like we want this infrastructure to be available to SIG's and I. Don't really want to micromanage what SIG's and some projects are doing with their resources, so yeah getting policies right now we would be awesome. I appreciate your efforts. There also.

G

To that specific thing, so one thing that might be the first step, especially because we're already in the in the vicinity of discussing is the promoter because of something new. So a policy written down might reflect the current thoughts and we can like the policy, can influence what the promoter does and what filter. So what is the policy and that such thing that kept on coming up anyway? What's the policy on mirroring things into communities such as Cardenas, which is currently just being pulled in externally?

G

Do we want to have like a two-tier system or something where everything that is sort of essential to Cuban Irish and the overall teddies community will get its own built repository that firstly MERIS code for each release, for example under the github releases, or something so it's just a bundled up code repository and then as a GC, be built into a container or an asset so that we have the code for each release under control of Cuban Aries?

G

That would be one solution and the other one is keep on going like. We do we're just basically just reference, extol images and then hope for the best and with the first suggestion of we actually taken control more the question is, or the policy is or should we discuss? What is the hurdle of getting a staging repo and getting something into a staging Reaper? Is this something that is used? Is it something that's essential like or deem as versus I? Don't know like a small running tool or something.

D

So there's a ton there that we're not going to have time to cover right now, but those are all great topics and you know we talked about it a little bit this week. While you were here, I have thoughts but I don't want to I want to find the right balance of draconian and pragmatic I.

E

Know, yeah sorry go ahead. Do we.

A

Have some like a documented that these questions, because there was so many questions, I I'm sure I, my suggestions, I lost part of them. Can we put it somewhere like on and get happy sure or some some.

E

A

Meant to but be sure that the next time we will be discussing this and not losing some things.

E

D

That's right: Michael. Can you file, like I, think you've listed about a dozen potential github issues there yeah.

G

Suggestions so I was trying to get because writing a policy without actually doing the this. The the workflow is always sort of weird, so I was trying to get some of the workflows down first and then distill it policy from that so happy to do that and open a general like midday issue as well. So what are the things that will help I think I.

G

Thank you on the part and it's not yet sure what are we doing like with the state repos? um That was the wrong one by the way.

G

That was the correct one perfect.

A

We have like a formula, so let's um I could finish my discussion and I.

H

Just have one thing to share: I recently got my first beard merged, so thank you. It was smooth I just want to say, hey.

D

I would just say again thank you to everybody who's showing up for the first time, who's showing interest. This is what's gonna, make this succeed or not is is people showing up and helping so I appreciate and I apologize for the chaotic nature of it? We're trying to make this better.

A

For me and as I said, feel free to ask questions on slack and being me myself personally, if you want I would try to my best to help if anything- and there is no like a bad questions. Everybody's welcome so I think that is a good time to finish our this meeting and I'm very grateful for you, happy Hucker for doing hangouts and I'm again really have really glad to see all of you here and see you in two weeks.

N

Thank you guys.