Kubernetes Storage SIG CSI Implementation Workgroup, 6 Mar 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Storage - CSI Implementation WorkGroup 2023-03-06

Description

Meeting of Kubernetes Storage Special-Interest-Group (SIG) Workgroup for Container-Storage-Interface (CSI) Implementation - 06 March 2023

Meeting Notes/Agenda: -

Find out more about the Storage SIG here: https://github.com/kubernetes/community/tree/master/sig-storage

A

Hello, everyone today is March 6th 2023. This is the kubernetes CSI implementation meeting, uh so I think today we just want to go over this one.

A

A

Low pass volume manager, reconstruction.

A

Is this almost done or the the pr are already done? What is that.

B

Okay, I updated BR for reconstruction, metrics, that's right for review on our site and I have a PR for the queen of enormous Matrix and I need somebody from zip node. While they start poking people tomorrow,.

A

Okay, uh can you put them at your PR here, so we know there are some.

B

Sure I think they're better there. Oh.

A

They're already there, okay.

B

Well, there were there: oh.

A

Yeah yeah I saw this one. This is yours right.

B

A

Okay, oh Sunny, actually the sunny opened. This is.

B

Yeah I got the comment from sunny and I fixed it today. Oh.

A

Okay, great great all right! What's that one hello, sunny hello.

A

And then, uh since you're here, uh what about the? What about the secure Linux? What is the status of that one.

B

uh Well, that's almost done. I just need to flip the feature. Gates.

A

Okay, I think we need a PR for that right.

B

Yeah yeah sure, okay.

A

Oh, uh can you uh can you submit a placeholder for the blog.

B

A

Let's see eighth, what is Wednesday yeah? Yes, they have been poking us.

B

Yeah yeah sure sorry about it.

A

Hey no problem, thank you and yeah. So this one, basically we're just waiting for scissors back PR the the release to be cut. So GMS has some comments, uh so I I submitted another PRT dress his comments. He already uh reviewed it and he's fine with that uh yeah. What do you want to pin, sir from that?

A

One yeah and also Ronald has been working on implementation, so he has a PR that the crds so I'll be reviewing that that's this one and um I also I have a submitted, a placeholder PR for the blog on this one prevent authorize the body mode conversion. uh This is a already done called complete, E3 test added just to need the talks, the blog, obviously so I'll clean the product to submit a placeholder blog for this.

A

And notice, fancy grid I think the I think the E3 test. The issue is still there. um I know. Louise is still looking to it. I also pinned humble for the for the placeholder PR for the for the blog. He said he will submit it. So hopefully he will do that before the deadline.

A

And yeah: that's why we're not targeting so, let's?

A

um Okay, what about this one rewrite one's pod.

C

So I think the code is done and the feature gate has already been flipped.

A

C

A

C

Okay, it's all merged I, pinged Chris um for the blog post, okay,.

A

Great okay, so it looks like we're good. There.

A

And this one I'm not sure about this yeah. Do you know it's the PV last phase transition time, I.

B

Don't know, oh.

A

I, remember: I, pinned him see, he said he's a little behind he's, not sure if he can get a code in and remember he said that right yeah, so he said the um yeah, since the code is not even there, so he's not going to work on blog for that.

A

Okay I think that's this one. It may not make it do we miss anything because everything's here, oh.

C

Mr was the um there was the default storage class thing, I guess that's not being promoted right. It was beta last release.

B

C

Yeah we did um find a bug in that because it wasn't handling the beta annotation um I, think someone did create a fix for it, so I think we're good. There.

A

D

uh I have I, don't have a PR yet, but we are doing it today. The further recovery stuff, the API change that we are making into PVC apis. Oh.

A

D

Ready for review yet but I, don't know if you have time but we'll see, but.

A

This one do we also need to get that in before the yeah. We need that before the emergency alignment, because that's like a API change right, okay,.

D

Yeah yeah, it's breadmaster right, so yeah I'll try to get it in today.

A

uh Is that, oh, is, is the okay Wednesday I saw that we were talking about the blog? Did, let's see what is the is that code freeze as well code freeze, March, 14th.

D

uh One day before then Tuesday, okay,.

A

Yeah, this is the code. Freeze date is March 14th. uh You know the five p.m. Pacific time.

A

Yeah so you'll have you have another week for this for the code. Freeze that I think.

A

um uh Are there anything else that we are talking here.

D

A

um So I think last time.

A

uh Okay, so I added this one last time so for this, uh so we talked about how to address cves, um so in KK they, basically they do have the small, regular monthly hatch release and if there's some CVS they have this uh uh lead a fixed lead who will be coordinating and deciding whether they need to release earlier uh outside of the the normal release Cadence.

A

So um one thing that I'm, not sure is uh so they talk about. This is like they have to do this communication in some private channel, uh so Michelle young I know you guys are in some security mailing list. Do you guys get those emails early? No, okay,.

C

We're not part of a mailing list.

A

Okay, so that's probably like a special one, so probably um yeah. Maybe we.

C

Only we only get pinged if they think there's like an issue in some six storage component. Okay,.

D

C

Like we're not part of some regular security mailing list, okay.

A

Yeah, they seems to make this one only for those people who are like working on the release itself or like there's some other people.

C

Okay, so I was I was also talking with um Ben Ben Elder. On this.

A

C

Yeah, like I, think all of this process is gone for the first class of cves, like there's a cve in the project itself. Okay, when I was talking to Ben I think he was saying- or at least he was telling me that it doesn't look like there's a regular process to like update all the dependencies and do dependency scans.

C

A

They don't have that. Oh okay yeah. They.

C

Only they only um like if there's a golang CDE and it's impacting you know it's actually impacting like some binaries. Then they will include it but I think it didn't. I didn't get the sense that they actually do reg they run and.

A

I'm gonna stand.

C

A

Anything like that, okay, so then the basically just they probably their security team, probably just uh knows when CV shows up right, they just like regular. It's not really necessarily uh how do they, but how how to even know when the CV CV shows up and how do they get notified if they don't understand things like.

C

I think or the main I think the main thing is that they are concerned about is mostly goaling vulnerability, because I I don't think they really um I, don't think they really monitor, say like base image vulnerabilities, which is where a lot of the the CBE scanning things do, and so whatever I guess somebody is monitoring, golang vulnerabilities or maybe the goaling project.

C

You know specifically reaches out to kubernetes. If there's like some vulnerability that they think.

D

C

Yeah but um yeah but I think I don't see like, but I think it's still also, you know sort of a case-by-case basis. You.

D

C

We, you know, I, don't see kubernetes just periodically updating all of the good dependencies and things like that. Okay,.

A

Okay, okay, um so okay! So if that's the case, then we don't need to change anything we're doing based on the.

C

Yeah I mean so I was I, mean I was talking to band, but this.

D

C

All very beneficial right, yeah, his opinion was basically like you know. Releasing these container images is uh best effort.

A

C

So if you know I don't know if we can really offer, like you know any guarantees to the community for these Community images.

D

C

And really with all the like supply chain uh concerns like everyone should not be actually using Community images.

A

I thought normally the at least we will be using the community when we don't build ourselves and other folks doing differently. You guys do it differently.

C

We we build it ourselves because.

A

C

Have a policy we, we have a policy that any container image that we give to customers needs to be built on our own. You know authorized hardware and machines. Oh.

A

C

I see- and so you know, Community images you, you have no idea how it was built right.

A

Right, that's true: okay, yeah! Is that what you always have to eat? Do you also build your own? You don't use Community images at all. Yes,.

B

We built our own for the same reasons. We know the story. We know that they didn't put anything from the internet during the build and so on.

D

Okay, in fact, we have a issue where, like projects that not rendering dependencies like vcrc, is a driver or.

B

D

Have to make patches to those sources to render it, and then we build it.

D

A

C

um I had added the whole vendor directly to the AWS driver. For that reason, and then I think recently they removed it and so yeah.

D

Yeah, it's a yeah.

A

Yeah: okay, uh interesting! Okay! So when you look into this I.

C

Mean you can also add now: AWS drivers have the same problem too: okay, because they removed the vendor directory.

A

Oh, they removed.

C

It yeah, like I, had I had added it in and then they've removed it because there.

A

A

That's the way to go, I remember in the past. Just always you have vendor and then at one point thought we, you know we were told to remove it at one point saying that's better, but now yeah I see what you're saying it's actually the this you got this uh it it's not as stable right, don't know what you're pulling it's. That's true! Okay, all right.

C

A

C

Think history, basically my conversation with Ben um who is not representing you know like the.

A

Community project.

C

Like his opinion, was that, like Community images, are best effort, so.

D

C

See how to say that someone wants to submit a PR to to you know, update the dependencies to.

A

C

Their scanners and that's fine, but um we don't need to go out of our way to actively scan and update stuff. Okay,.

A

B

Okay, but this release the side class at some point. Yes,.

C

If someone, if someone you know, makes a a change to patch it, then we should make some effort to release a version for them. So.

B

Do we have a policy for that or it's a dog.

C

B

Okay works for me, yeah.

A

I could also just uh you know, uh chat with some release team, because I know they do a lot of things like they feel. There's a beautiful materials. Things like that right, so just um I I was just wondering: did they do anything extra? But uh if not that's fine I was interested thinking. Do we need to every time we release?

A

Let me cut the release. Do we need to actually scan the images? I think that might be still good? What do you guys think you think we just don't do this at all. Then we release the same summer submit a PR. We need to uh update it again. What about just like when we release something with your skin.

B

Do we have any image, that's based on something that could have series I, think history.

A

Yeah but I do see those like I keep getting those I just keep getting getting those right, so we do sometimes uh getting the people submit. Prs gray in our ripples to update those yeah.

C

But like you added, we added, we I, think Andy added the the trivia scanner in uh liveness probe and maybe no driver, registrar.

A

I feel snapshot snapshotter.

C

Snapchat I have seen like PR is blocked because that's.

A

Yeah yeah I do see that on the from the snapshot. Actually, the problem is that for that one is even some very low ones: low CVS. It also block it so yeah.

C

A little bit so I think, like I, mean I I wouldn't be opposed to running a security scanner, but also I, don't know I guess we should I mean I, think we should just treat it as best effort like we will update them if possible um during our normal release, Cadence but I guess we don't need to like go out of our way to like do releases every time, something yeah.

A

Yeah, that's that's what I mean I was just a I was thinking you know even like the this NDC is good, but it's also sometimes you know I just block you for probably.

C

Yeah and actually specifically for that I noticed um I. Think GitHub has some new beta feature to do to run a cve scanner, and maybe we should look at using that, because I think um I think that one does not block PR's I, think that one just like periodically scans and then I, don't know somehow it alerts somehow I'm not sure how I.

A

I think I, look at I think I. Look at that because that's enabled on one of my other projects, but it's not detecting as many things as the 3D scan. Somehow but I do see the you know the the one that Andy has it's just too too uh restrictive. Definitely yeah I'm fine, for you know disabling that, maybe just to like scan it. Let me cut a release right or yeah the thing we could do.

C

Yeah I I think also, theoretically, um because we also have dependabot uh running yeah.

A

Theoretically,.

C

We should not be really getting cve pop-ups right.

A

Right yeah, so if we.

C

A

Yeah, it's just automatically updating stuff yeah is that enabled on every set of car repo, maybe not threat, maybe.

C

D

However, I think it's.

A

Definitely an external provisioner, but uh um I don't know if it's for every repo but I think yeah with that. Definitely it's going to you know, help a lot.

A

Okay, so it's best effort. Okay conclusion is best effort Okay. So so you don't you don't want to make people around that before every release.

C

Okay, I guess I! Guess that's a look at switching to this new GitHub.

A

Feature- and we could but I'm I I- think I have that on my other project. I just don't see that it's catching as much as well.

C

I guess the other thing is, you know it's unclear how much of what trivia is catching is actually a problem right.

A

But he's basically just to catch every it basically just catch everything right.

A

um So if you're not sure it catches everything if there is a CV, it doesn't matter whether it really has an impact on you or not so um yeah it covers it should not miss things. I mean at least I have seen seems to be pretty thorough, the the GitHub one. Maybe we could try that I mean from what I've seen in the past does not seem to be capturing that much, but we can definitely try. Maybe that will be improving as well.

A

A

I just say ocean best effort for CV update yeah can I introduce myself.

A

Okay and then uh you said enable the GitHub CV detection we could I mean it doesn't hurt at least right, so it's going to show something um but uh definitely doesn't hurt. We could do that.

A

A

A

Well, let me see I'm just double check and see if there's anything else, we didn't look at you last time.

A

So uh I think then that's it for today, then. Thank you. Thank you.