Kubernetes Storage SIG, 7 Apr 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Storage Meeting 2022-04-07

Description

Kubernetes Storage Special-Interest-Group (SIG) Meeting - 7 April 2022

Meeting Notes/Agenda: https://docs.google.com/document/d/1-8KEG8AjAgKznS9NFm3qWqkGyCHmvU6HVl0sk5hwoAE/edit#heading=h.1x6n8uz3g204

Find out more about the Storage SIG here: https://github.com/kubernetes/community/tree/master/sig-storage

Moderator: Saad Ali (Google)

A

Okay, today is april 7 2022. This is the meeting of the kubernetes storage special interest group. As a reminder, this meeting is public recorded and posted on youtube, um so uh the agenda here is linked in the meeting, invite feel free to add to it as we go uh on the agenda today, we're going to go over the 124 uh planning items uh to note where we are in the 124 planning cycle. uh The code freeze has already happened.

A

uh That happened on the 30th of may about a week or so ago, and the upcoming deadlines are really uh around uh kind of stabilizing and finishing up. The post code code freeze work um specifically uh the next deadline. Well, I was supposed to be cutting an rc release, but that's been delayed until uh monday, the 11th, so that's coming up soon, uh then test freeze is uh actually uh passed us now. It was yesterday uh and then uh docs must be completed and reviewed by the 12th uh feature.

A

Blogs must also be completed by the 12th, and then the release will happen on the 19th.

A

And uh if you are uh have a 124 feature uh that you're doing a blog post for please take a look at the spreadsheet, make sure make sure your blog post is tracked here uh and uh and then the uh uh folks who are helping with the blog post will be able to reach out to you and make sure that all the uh requirements are completed on time. For that, uh so that's uh pretty much it for the timeline.

A

We're gonna go ahead and switch over to the planning spreadsheet and get uh get an update on where uh the different features stand.

A

Okay, so first we have csi online offline resizing volume. Expansion uh is a month on the line. I didn't see him earlier or does anyone else have an uh status update for this item?.

B

I think this one is a complete, except the blog, I'm not sure. What's the status of a blog, but code is complete, doc pr is also merged. I think.

A

Cool, thank you shank uh and then next item we have is uh recovering from resize failures.

B

uh This one we decided not to much more forward because I think, there's more work so staying off. Obviously,.

A

Sounds good and uh then we have uh actually I'm gonna go ahead and mark the first one as completed.

A

Next, we have issues related to assuming mount points. Volumes are mount points. Jing. Are you online.

A

Anyone have an update on this one.

A

Okay, we'll skip over that. One next item is determine mount points without relying on proc mount uh anyone able to give an update on this manu yawn.

C

There are pr some reviews, but they will be in component, is 125.

A

uh Say that last part again uh prs.

C

uh Yeah, we missed the deadline, so they will be part of 125. got it.

A

All right uh next item is storage capacity tracking for pod scheduling.

A

So it looks like last status here main pr was merged, conformance pr test. Pr will wait a couple of weeks and doc. Pr is open. uh Anything new here.

C

Yeah there is a draft of the blog, so is today uh sorry say that again there is a draft of a block article.

A

A

And uh all the code is complete, uh including the test uh prs, uh I'm not sure about the tests.

B

I think the conformance test- pr- that's also merged just a couple days ago,.

B

So I think they're still out of tree external provisioner, uh there's still some work to do on there and also uh patrick, is going to submit pr to use the updated csi stack, 1.6 and the one that you just cut said.

D

A

So we'll keep that as started, and hopefully you can wrap that up soon. uh Next is csi ephemeral volumes existing api. uh This is being delayed to 125, so we'll just copy that over next is the volume group api uh updated kept to address comments. Any new updates here.

B

uh So yeah, so I think right now the the cap does not have anything about static provisioning, so I'm actually looking into that, I want to add that into design.

D

Cool. Thank you.

A

And then we're gonna uh next item is csi out of tree move, iscsi driver fit and finish. I don't know if we have an update from humble on this one.

A

Go ahead and mark that as no update.

A

uh And then, similarly, we have the samba sifs uh csi driver uh last status here cloud build issues partially fixed. Anyone have an update on that.

A

We'll go ahead and mark that as no update for now. Next is pvc volume snapshot, namespace transfer uh masaki any updates on this yeah.

E

uh Staffer and I studied this question on transfer feature for 1.25 release and started, creating a new cab draft.

A

D

Cool. Thank you.

A

Okay, let me go ahead and move to the next item, which is csi volume, health, additional metrics and or events uh last status was pr, is merged, but reverted submitted again and review in progress. Were these able to make it.

B

Yes, I did make it and there's a dog pr that is being reviewed.

B

I think that's anything remaining.

A

uh So next up is the programmatic response piece of this.

B

Right, I uh pin the nick still wait while waiting for him to respond.

A

Okay, thank you. Shane.

A

Next item is volume populator data source uh ben.

F

Yeah, the uh code is done, the tests are done, the docs are done thanks to other people who helped with this. So it's it's officially beta. The remaining item is the blog. um So are you sure about that deadline? Because it's earlier than I thought for the blog.

B

Vlogs ready for review on april 12th.

F

All right, okay! Well, that means I have to hurry up and uh write the new blog um because because I'm going to be on vacation next week, so I got to get it out this week. I guess but yeah. That's that's the last remaining item for the move to beta.

A

Cool, oh that's, pretty exciting. Thanks been for work on this uh next up is object, storage, api, cozy.

B

So the cap is still being reviewed right. So there's a back and forth preview and update going on.

A

Sounds good next, we have change block tracking.

B

Yeah, so I think fan uh has organized a few meetings to discuss the design. So it's ongoing design is ongoing.

A

Sounds good and then next item is uh runtime assisted mounting.

G

Yeah, this is in progress uh continuing to make updates to the cap.

A

And uh I imagine we're gonna move this to 125.

A

Would that be design or alpha for 125.

G

uh So I would say like maybe we can shoot for an alpha.

A

Oh, thank you. Deep next item is csi proxy for windows, transition to privilege, containers.

G

So I think uh mauricio mentioned that uh there might be an issue with the like resources to uh complete some of this work um for this quarter. So it may have to move to 125.

E

A

Okay: next item is node expansion secret. uh Anyone have an update on this.

B

Right so uh we actually request the exception, but the release team rejected that they think it's a high risk yeah when we applied for it. We have not got api review yet we finally got an api review actually got a approval from clayton on monday, so it's studio late. We asked again after the approval.

B

They still do not want to allow it because they say there are still some blocking issues uh in 1924 that blocking release so they're afraid of uh adding anything that could introduce some regression.

B

Okay, so this is uh yeah, so this will be 1.25. So we'll try to get this from merged yeah. It looks.

H

Like nice, early.

B

A

Sounds good. Thank you. Shane uh next item is sc. Linux relabeling using mount options, eon.

D

Delay, oh well, it's the same. It will be delayed to 125.. Okay sounds good. Thank you. Next, two items.

A

Are complete? uh Next, we have csi core uh migrate, csi migration, core bugs and issues um any issues or any uh updates here.

A

Looks like there were some bug fixes. uh Did they end up getting merged.

A

Okay, we'll mark that as no update.

A

uh Next up is vsphere csi migration.

A

So it looks like uh not on by default, uh deprecate vsphere 67u3 uh pr submitted any new updates. There.

B

So that pr got merged yeah, so that's that's it so we're still discussing uh when we should remove the support for six seven. That's pending.

H

A

And next up we have azure. Anyone have updates on that.

B

Yeah, that one is that, why is it done.

D

I say that again.

B

That that is complete that one uh code is merged. I believe dog is also merged. I just double check. I think it wasn't hard.

A

And that's the case for both the azure ones,.

B

A

Okay, I'm gonna go ahead and mark those as complete.

A

Gc is already complete. uh Next up is open stack. Anyone have updates on the open.

B

Yeah that wise, that one is complete, the um code and dog are all complete.

A

Okay and then we have sef rbd.

B

So that one did not make it um so homo submitted pr, but the p ani provided menu tests. uh So we need the e3 tests that are also running the entry modeling tests. So he is going to work on that for 1.25.

B

A

uh And then this ffs is it the same story? I.

B

Think this is delayed. This one was already yeah.

A

A

uh Next up is port works. Anyone for portworx have an update.

B

So yeah, so this one seems to there are some miscommunications, uh the the author uh tira. uh She didn't submit a pr to turn on the feature gate to beta. uh Somehow she missed that, so she was submitting some tests, but I think you know the the other feature gate is still alpha is not beta.

B

So we're going to try again uh 25.

A

Okay, uh next is always honor reclaim policy.

A

It looks like main pr is merged and test in progress.

C

We missed the test deadline. uh There are, there were some issues with the implementation, so we decided to revert the feature gate back to alpha and the br has been just merged, so it's alpha and we will try again next time.

C

A

You on, for that day,.

A

Okay: next item is control volume, mode conversion between source and target pvc.

A

uh Pr in progress was the last status update here. Did this get merged.

B

Yeah it's well. There are multiple pr's you're ongoing, um so there are some work on going on external snap charter and also external provision. So we are still moving forward, but still in progress.

B

And there's a dog pr, that's been reviewed uh block is pending, there's a placeholder for that.

A

Thank you. Shane uh next up is secret protection.

A

Anything new here- I guess this one is based on the next item and the next item is uh in use. Protection.

E

Okay, still updating kip, brookery, okay.

A

We'll go ahead and move this to 125.

A

Okay: next item is ungraceful node shutdown.

A

uh Last status update was pr and review placeholder blogged out any new updates. There.

B

Yeah so uh codepr is merged.

B

Dog pr is being reviewed, blog is also being reviewed.

A

Awesome. Thank you. Shane.

A

Okay, finally, we have volume expansion for stateful sets.

B

Well, it looks like shalini is not here today. I don't know I haven't heard from her okay, so she's not already still working on the cap.

A

All right, no update uh likely moved to.

A

So, okay, so uh yeah again reminder the feature. uh Blog deadline is coming up uh april, 12th, which is pretty soon so, if you're working on a blog, please get that done as soon as you can.

A

With that we'll go ahead and move over to prs to discuss and first up we have consider only csi drivers that support node stage as device mountable.

A

uh Matt, are you on the line.

H

Yeah, hello, hello, hello, yeah, so I already got reviews for both these I'm just here to uh hassle people a little bit more. uh These are related to menus. Mount point check pr in the sense that the motivation is the same. We want to speed up mounting and unmounting for efs, because we have a customer, that's complaining about it, but I also have numbers somewhere in the pr uh to demonstrate that this actually helps so for this one.

H

uh The title kind of is nonsense, but it's basically saying for cf csi drivers that do not with node stage we are treating them internally as device mountable.

H

And that's been fine, except there is this part of the code that is using that device multiple check to decide whether um mount operations can run in parallel or not, because if you imagine like evs, you can only mount the device once somewhere right. So it makes sense not to paralyze that, but for efs it doesn't make sense. You should be able to mount it in parallel.

H

So this is what that pure. This pier is achieving. Basically, so if anyone's interested in that you can run and again, this only affects csi drivers that do not support node stage and only in a scenario where you're trying to mount the same csi volume.

H

H

From multiple pods, on the same note,.

H

So in that narrow, in that narrow use case, there is a huge improvement. So I have that somewhere varied under like 10 comments uh but yeah. I already have a reviews on this. I'm just surfacing this higher and hassling people to take a look if they have time.

H

So that's on that. That's that, if anyone has questions say no or message me I'll, be responsive.

A

Yeah cool, thank you matt for surfacing that and uh helping improve the the code here um and folks on the call. Please help review uh matt if you don't get traction, uh feel free to ping us on slack or uh come back to this meeting and poke folks again.

A

Any discussion on this uh pr from anyone on the call.

G

I did have one quick question, so this should also help blocked csi plugins too, that support, say, read only many scenarios right.

H

uh What does blocking mean.

G

I meant csi plugins that are backed by a block volume like say, gcpd or ebs.

H

I I don't think so, because those would go through map volume right. I didn't. I didn't even look at map volume, but it's possible. That is the same issue.

G

By block, I didn't mean like raw block mode, but like just a regular file system mounted. Oh.

H

I don't, I don't think so I don't know, I don't know because.

G

Like he supports a multi-attach, read only too right, or does it not.

H

G

Okay, I was just curious if all of them benefit or if, if it's, if it's somewhere related to just uh something that does not do staging I'll I'll, probably take a look at the pr yeah.

H

It's I I think it's only if it doesn't support staging like I might be thinking too low level, but it's like just if the csi driver does not want staging. Then we want to pretend it doesn't or you want to treat it as it doesn't have a mount device call, which I think is how it should be. But yeah yeah I'll, take a look and then I'll answer for sure I'll.

B

H

Answer for sure.

A

Okay, any other questions on this pr.

A

Cool, so please take a look when you get a chance and second, we have avoid mount point check when cleaning mount points uh matt again to you so.

H

This one is more obviously related to manuscript, because this is trying to speed up the mount point check by reducing it to one syscall, because we're seeing that when you have a lot of amounts, meaning thousands of amounts and you're creating and deleting a lot of pods at once then getting a consistent read of the amount table, even if you retry 10 times in a row, is actually uh fairly unlikely, and I have numbers for that somewhere at the bottom of that pier, where, uh if I try to unmount 100 pods each with 100 volumes each at roughly the same time, I hit the consistent read error like a thousand times and in terms of how that affects performance.

H

Every failure means you have to enter exponential back off and retry the operation.

H

uh So in practice, in terms of like the time loss, it's like it takes like a couple minutes to unmount all those hundred volumes for all those hundred pods.

H

But what this pr is doing. So that's the preamble. What this pr is doing is we're not even trying to optimize the mount point check.

H

I am suggesting that we don't need it at all before we do an unmount and I made a little bit of mess of it, but I am 99.999 sure that you mount meaning the binary that.

H

Is that we're, assuming is on linux, which is very safe to assume, I think, uh will return the string not mounted if something is not mounted meaning like it does it already does a mount check for you when you call it on the target, so we don't, we don't really have to be doing the check first and then calling on mount and then doing the check right after again, which is what we're doing right now in practice.

H

uh So that's what it's doing. It's basically checking for the string not mounted, and I had to rework the pr so originally it was like relying on a flag to, um but then I found like the flag didn't behave like how I wanted. So this is much simpler. It's just saying uh check the string.

H

If it says not mounted, then it's not mounted and we don't have to do anything else. That's that's all it is, and in my again this speeds up things a lot in my testing.

H

It takes it from on average minutes to amount volumes to seconds like three seconds. um My testing is not super rigorous, but it's very easy to reproduce the results.

H

So I would like to get this merged and.

F

So so it relies on parsing text output from a unix command that yeah and if, if the unix command ever changed its text output, this would break yes right. So I think.

H

I know I know so I I I anticipate that so I'm gonna I have a little script prepared, so we're I think, based on reading the code for it, which is in c, and I don't know how to read c. I don't know how to write c but like the not mounted thing has been in it since, like 1993. If the copyright is right, so it's like it is more of a stretch of an assumption than like, assuming that on the host, there's gonna be slash.

H

Proc, slash mounts it's like one step further we're now, assuming that the output of this utility is going to say not mounted.

F

But not not. Everyone uses the same u-mount binary like some people use busybox, which has its own u-mount binary, which who knows what message it? Outputs and.

D

One can imagine.

F

Other drop-in replacements for it as well. I don't I don't know if you can guarantee that they're all gonna have the same user interface with regard to text output.

H

I don't know I was also I was thinking we could check for that, also because cuba already when it starts up it. ha As far as I think I know it does, has some checks for like host properties. If you do get volume host and you can get stuff like that, then we can call it on some nonsense. This is a very you know. This is a very crazy idea, but, like you can call it on some nonsense path and check. Does it say not mounted?

H

If so, then we know this binary is right. So.

F

It so is there no other way to address the original problem, which is that the amount check is slow.

H

That's the manu uh syscall pr, but that relies on a new kernel and.

H

Sorry, it's very loud here and.

H

I think, like just in principle, if you mount like, even if you mount, we can't assume that it's uh outputting the same thing and must be checking them out table for us. So I'm thinking.

F

There's got to be a way that we can do whatever you mount is doing. If it can do it quickly like in principle, we should be able to do the same thing quickly.

F

That's a good point. I I just. I can't imagine that there's not a a different way to solve this in code, but it doesn't involve parsing text output, but I mean I I don't.

F

I don't know what the egg's real problem is or why why it would bog down under certain circumstances, but.

F

H

Just do what um does like yeah, I can't.

F

Do obvious optimization.

H

Yeah, that's true, so I think so I from what I remember it does do a stat on the target as a first check, but that's that doesn't work if or it's not guaranteed to work. If, like that's a bind mount and then there's.

B

H

Says something like read: I'm tab and I didn't actually look at the implementation of read mtap, but if that is somehow uh better than our wait.

F

Is this related to the other issue, the long-standing one we have, which is issues assuming that that amount points are uh or um I forget what the name of the work item is sod. You might remember it, but uh but we have long-standing problems with our heuristic, that that tries to figure out. If something is a mountain point or not, and we have known performance issues with uh the way that it reads the the proc mount info file and the solution was found. I thought we were going to use is.

F

Is that the one that that requires the new kernel or something.

C

Yeah, that's the one that requires new kernel.

I

um If I could just add um a point, so I mean going to your point been that we could start doing what umount does, I'm not sure that's the right direction to go, and it's like, if we're concerned, about systems that might have a different u-mount implementation, then like us, trying to make a u-mount that reliably works across the apparent variety of systems. Like also.

F

I

F

Meant to to copy the part that gets up to the not not amount. You know error like whatever detection it's using to determine that it's not a mount that part. You could, in theory, safely copy yeah and.

B

The actual work of doing them, I agree.

F

Is it's very complicated in their helper binaries and it gets nasty you don't want to.

I

Try to replicate.

F

I

Yeah so like I'm, I'm actually thinking that I mean, especially if I uh understand um the context maps and like this is on eks, where presumably you have um more control over the node than like a a general kubernetes thing. I I'm wondering if we want to go more like in the direction of the deprecated experimental mounter path and give the cloud provider a way to hook and just do the right thing.

I

You know in their specific case, rather than try and come up with the solution that works on, you know all possible kubernetes deployments everywhere.

C

I think it's not cloud provider related. I think it's a distro that runs on a vm in that cloud.

I

Right, which is often like because I mean, like you, know, thinking of um gke right, we run everything on cause which has its own. um You know, which, which is a specific distro that we have can can control over. I mean I'll admit to being a bit biased, because we're actually discovering a problem with the uh experimental um mounter where uh gk customers have come to depend on the fact that the experiment, the um containerized uh mounter, runs in a context that has cube um dns.

I

So you can use cube, cube dns to specify a um nfs uh server which does not work in general, um and you know like again. This is a situation where, like. If a you know, this is kind of like a cloud provider specific thing. um Well, it sounds like a deployer deployer-specific thing.

I

ah Yes, I mean I, I guess my contacts have sort of the same same thing: yeah.

F

I think deploy is just more engineering because anyone can deploy and control their configuration.

F

I'm sorry anyone who can deploy kubernetes can, in principle, control the configuration and do special hacks like what you're talking about yeah yeah.

I

Exactly and, and so like, I'm just just thinking if these, if, if this problem of needing to tweak mount to do the right thing for something that is like perhaps specific to a deployment, is best solved by by having a deployment specific hook rather than you know, trying to come up with a general. You know basically, entry solution.

F

uh It doesn't sound like a terrible idea, it sounds safer and- and uh there is going to be a general solution in tree for kernels that are new enough right. It's just that on older and I think it's really old kernels only you have to fall back to the existing slow implementation.

F

Like anything from the last I don't know, six eight years should have the system call that the new approach relies on. I thought, if I'm, if my memory is serving me.

I

Right but I mean.

F

I I guess apparently.

I

We can't depend on well, it's like. I guess that we don't have a minimum kernel version requirement or something, but.

F

But you can run time check if the system call you need, is there and use it and if not fall back, that can all be built into just the regular workflow.

I

That's true, I mean I guess it might depend how much we think this sort of thing might happen in the future.

F

I don't know my preference is to fix the actual performance issue which it sounds like we kind of know how to do put that in tree um and then, if that's still not good enough for certain deployers, then pursue the the hacky kind of you know, uh deploy your hook to do something special, but yeah yeah. The concept of parsing, the output of a umo binary in kubernetes core seems.

I

Horrifyingly, unreliable yeah yeah. No, absolutely I I completely agree, but you know if, if you had a deployer hook, then that that be you know all of yeah, then it becomes the.

E

Employer's throw stuff.

A

uh Matt your thoughts on all of this.

H

uh Yeah, no, I agree it's kind of nasty, and originally I was thinking that we could rely on a flag, but then I misunderstood the meaning of the flag in any way. That flag also does not exist. In all implementations of view, mount so.

H

I don't know, I think, I'm I'm not satisfied with the kernel approach because I think it you need to be 5.6, which is two years old. So, oh, it's not that old.

F

I might be mistaking this particular enhancement with this some different bug fix related to performance. um I didn't think it was that.

H

New I'm thinking of the oh there's, something that relies on open, app 2 and then, if I, google open app 2 that was in 5.6. So it's.

F

H

And I think, at least for us.

F

H

Is fairly new yeah we're stuck supporting like 4.x kernel, for I don't know.

F

But you can, you can run.

H

Time detect.

F

What you! What you're dealing with and.

H

F

Thing and fall back to the old thing and then gradually everyone will just get the benefit as they upgrade their kernels. Yes,.

H

But the problem is we're very impatient, I think on our side, so I I know I don't know. I I hear you guys. I and I know the I know the I don't know the container os whatever that the hook you're talking about matt, and I frankly I don't.

H

I don't want to invest that much effort into that. For, for what seems to me, like you know, like the the solution, for us is insight. You know we could within eks. Obviously I'm not I shouldn't you know say we want to do this, but like we could just fork it and say: okay, you know everyone's on amazon, linux 2.. We know the um binary we control the configuration I really want to.

H

You know find some kind of middle ground, so um yeah I'll dig into how so, as you said, ben I can dig into how the util linux implementation actually does amount table check. Maybe we can copy that and I do- and I just still kind of do- want to pursue the crazy check where like if we know a particular um binary is going to return, not mounted.

H

I feel like that's not so bad to rely on that, but you just have to know by and the only way to know that is by actually checking so.

F

Or having some some flag that the deployer flips on says, I I assert that I'm.

H

Using the right binary, that's enough, yeah! That's that that wouldn't be so bad, either a flag right, because if I'm, if you see my numbers, I think it's fairly justifiable.

H

I know we're very hesitant about adding flags and stuff, but like the difference, is like minutes right for for unmounting versus seconds. So I wonder if that would justify yet another flag, but yeah I don't know this is a good discussion. I have a bunch of options, uh but just frankly, I'm I'm under pressure to get something in, and I don't think I'm gonna want to invest in the sort of mount hook solution which requires a lot of engineering work that I'm not probably might not be smart enough to do. Compared to this.

I

H

I

Having the um the mount hook, solution is also basically just a flag.

H

C

And the mountain hook is not available for csi drivers or how would you use it from inside the csi driver.

I

It's not a problem.

C

I

Csi drivers, because you can do whatever you want for uh amount like it's: okay to parse the u-mount output.

C

Yeah but we are most cs: drivers use the same mount library as kubernetes.

I

Sure, but I mean if, if this is a big problem for them, they can just fix that right, I mean it's like it. It it like is isn't this a particular problem for the um nfs mount.

H

This, I don't want to muddy the wires too much, but we are mostly concerned about subpass which don't involve the csi driver, so it's cubelet doing the unmount of the of the sub path.

H

So we don't really care too much if it touches the library, that's also relied on by csi, because from our perspective, uh if there's 100, subpass and there's only one efs volume, we're more concerned about optimizing the subpath than what the efs volume csi driver is doing and yeah.

H

Okay, uh I don't know, let's I can hold the pr if we're super, you know not comfortable with the not mounted approach and I'm going to dig into the mount hook and I'm going to dig into possibly a configuration option. Also, I'm also going to dig into what u-mount is doing. That's uh special. I don't know if it's holding a lock or whatever, but you know I'll have to figure that out.

C

I think it just calls kernel and it gets invite argument error, which is which means that it's not mounted, but I'm not sure if you can use it in comparing. That is because you want to call the amount helpers.

H

C

H

Reading it did something like read mtab even before it called the helper.

C

H

C

Least, not in xfs.

H

C

Maybe nfss something special that that's where.

B

C

Mount helper, you need to call the mount helpers, that's the problem, so you need to call bin mount to call the mount helpers and then you need to parse its output.

C

If you know that the first system you are are mounting, it's like a pine, mound or like doesn't need an helper, then you can call an amount directly in kernel, but you must know that that it's by mount or something like that.

H

For sub paths, we do know that right so yeah is that another path? What if it's just call?

H

C

It's just done.

H

uh Along to school.

H

Okay, so that's a fourth! If I'm counting correctly, I need to pursue but yeah. Let me let me look into that as well.

C

It'll be hard to do it in the in the mount library you need to have like some. Some special call that you know it's by mount like amount by mount or something like that.

H

So I yeah, no, I think, there's like just you can't distinguish like there's no way to distinguish, but it's just you have to rely on assumption that, because it's a sub path, it must be a mind mount which is kind of maybe it might be dangerous right. So.

C

Like the main volume should be mounted at that point, so you should be pretty sure, that's safe, but.

B

C

Course, if users unmount it first in the for the directory, then this path will be the only last remaining mount. Then you need to call the mount helper.

C

Yeah, I I don't see a nice solution to be honest,.

H

Okay, I'm gonna quote you on that. I'm gonna give that to my manager. There's no nice solution. So don't rush me um yeah, but that's the truth.

A

uh Matt carrie, you have your hand up.

I

Oh, I think I haven't figured out how to put my hand down sorry.

A

Anyone else have a comment on this.

A

All right, uh thank you, matt for bringing this up and uh the the discussion. um Any anyone else have a comment on this before we move on to the next item.

A

I assume this speed up mount point cleanup uh when there's thousands of mount points. Is this related or unrelated yeah.

H

A

This was meant to be a sub point of that sorry got it. Okay, no.

D

A

And we have no design reviews today, a couple of miscellaneous comments: first, up shane.

B

Yeah, so uh cuban eu is coming up next month, uh so a few of us will be there uh yeah and I will be giving an update on six storage.

B

So I think last time at the kubecon north america we had this uh meet and greet it's part of the contributor summit.

B

Do we want to do the same thing uh yesterday in the data protection group there were a few people asking if there is a meet up, so I think we could grab a table there at the contributor summit and we could just meet so it's more like casual. It's not. We don't have a formal agenda like we used to have to go site. I think this time we still we don't really have a quorum.

B

So I think there are probably more people going there this time than last time, um but still a lot of people are not going there. So uh so think that maybe we could. uh We could just chat there at that uh contributor summit and then there's also this meet and greet, but I think meet and greet is more for uh you want to meet some new people who are interested in journey or sid right.

B

So um if there are other people who who are already part of the sick want to want to chat, I think we could also do that before the meet and greet.

B

Just just want to see if there anyone interested you can sign up for the contributor summit.

A

Cool anyone have comments or concerns or.

A

Okay, we'll go ahead and move on to the last item, then uh ben yeah. So um many.

F

A

Probably aware.

F

Of the executive order in the united states around software security to basically harden any software that the government purchases.

F

And people at my company at least are running around with their hair on fire. About this I didn't know if, if the rest of you all are in similar situations, my question is about the kubernetes community in general.

F

um Is there any effort to enhance kubernetes security or harden it in accordance with the executive order that you are aware of, because presumably kubernetes is used by the us government and if, if it doesn't meet the requirements laid out, there probably will be problems. So I was just curious what if anything, was being done or if there were activities being tracked.

F

That anyone knows about.

B

So I know that in the last cubecam there are a lot of talks around security, so I think it's related to this uh executive order uh and also kubernetes uh release team. They in 1.22 release. They also added this a bill of materials. uh You know that shows the source code binaries and published images.

B

I think that might be responding to you know two responses. I do not remember the details. I I remember uh when I was at cubecon. I attended some sessions and they were talking about this executive order. uh So uh so I I'm pretty sure in kubernetes there are, there are work going on. uh Maybe the best way to track this would be.

B

There is a security seat, maybe.

F

Oh yes, yes, security,.

C

F

They they would certainly know more um right.

B

Yeah, so I'm pretty sure uh kubernetes has this one uh you know have has worked going on, like I said, even in sick release. There are a few things that that is related to this. um But if you want to know that you know all everything that we're doing then probably the best way is to go to seek security and check there.

F

Yeah, thank you for that recommendation. Shing that should have been.

B

E

F

That it wasn't um there's.

B

Also yeah there's also, I think there are several co-located events related to security as well uh at the last cubecom. So it's like half of that, like half of the sessions, has something to do with security.

F

Okay, yeah, I mean one of the weirder requirements was around like unit test coverage and, like um I didn't know, if kubernetes had particularly high unit test coverage or if it was even measured, I mean I didn't know. If.

B

You could make it right mentioned in the executive order. What do you mean by that? I'm not yeah.

F

My understanding of the of the requirement is that the executive order specifies 80 unit test coverage for projects, and I don't know how mandatory that is or how realistic that is. But it seemed high and I was like oh 80.

F

I don't even know if kubernetes hits that bar um but yeah. I can follow up with the security guys because they would probably be uh more likely to know the details.

B

F

F

Yeah, that's all. I just wanted to sort of find out what was going on and it sounds like a need to follow up with that. Other group.

A

Well sounds good and uh if you discover anything, feel free to bring it back to the sig and let folks know just fyi, okay, uh all right, I think that's pretty much it for the agenda today. Anyone else have any other items they want to discuss. If not, we are right at time today.

A

All right, thank you. So much for your time, we'll see you in two weeks, thanks.

B

F