Kubernetes SIG Testing, 26 Jul 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SIG-Testing Weekly Meeting for 20220726

Description

SIG-Testing Weekly Meeting for 20220726

A

A

B

Okay, cool hi, everybody uh am, I audible and I think on the right account now great. Okay, sorry! For the late start, I managed to turn off my computer right when I was trying to start this, so it was fun. um Okay, cool! uh Let me just make sure all right myself is in order and we can go ahead and get started.

B

Okay, cool um so yeah, it's a testing meeting for today uh looks like we have a good number of people and it's also about four pass. So um a lot of folks struggle in, uh but I think we can go ahead and get started um to start. Is there anybody who's new here and wants to introduce themselves to the group.

B

Cool uh saying nobody uh raise hands, uh let's go ahead and move on to open discussion. um I'm liam, I think you have it.

C

uh Yeah hi so uh previously in like uh last last meeting, so I've brought up this topic where we are wanting to introduce four of our ibm cloud resources. Add a few of our ibm cloud resources to bosco's.

C

uh We are clear on a on a few things that need to be done like where the resources to be added in the general, but the purpose of the issue was two main things which is uh secret using the secret manager, and second thing is: how do we is there a systematic approach to update the user data of the bosco's resources so on the issue the latest update we've mentioned: is that we're planning to use gcp secret manager from the suggestion from one of the community member?

C

So is there any suggestions, and how do we proceed with it? Like we have a few accounts where uh ib like ibm cloud upstream dedicated accounts like case caters, staging ibm cloud and such a conflict. Do you all think that one of the account can be used for the by giving access to the secret manager also yeah? I am open for suggestions.

D

Hi there yeah, so I was that person that gave you some pointers.

B

D

um So I can't answer the username piece uh I'll. Let someone else answer that one, but the secret itself. What you'll want to do? um Basically, the ibm employees should create their own google project populate the secret there, and hopefully, once you do that we can give you the email, the service account that reads: secrets for communities, testing for and then, as long as you give that permissions, we can pull it from there and populate the secret in kubernetes secrets.

C

Okay, so you mean this secret should be created in a google cloud account managed by us.

D

Yeah, uh that's right, yeah! If you've got any questions about that. Some of your colleagues from ibm that work with me and canadia have done the same thing. So I can tell you who they are and you can talk to them.

C

Oh yeah sure that would be helpful.

D

uh That user data piece- I don't know thanks I'll. Let someone else answer that one.

C

Oh yeah, thank you for the input.

B

Anybody have tips on the user data, um I admit, passing familiarity with moscow, so I'm not super familiar with the resource management itself.

B

Okay, um if nobody in this meeting has a particular bosch experience for this.

B

I try to think because, like the books that I, like specifically know, are like some familiar with bosco's, but not necessarily experts. But um I'm wondering if the kate's in for a group would be like a particularly uh good place to point towards.

C

uh Okay, so um I didn't reach out to them, but it's been going like to and fro from sick testing to caters in france. So.

C

So that somebody from you all could let us know like have anybody, does that I mean done this in the past. Like I know, aws also have added their resources quite long back. So um was the process different than because then, when I spoke to a couple of folks, they mentioned that they were directly in contact with the test in front call members, and they were just sharing data and they were updating it on the cluster directly. So maybe this is a systematic approach right now to do it, I'm not sure.

B

um I can definitely ask around at least to see what our current like process for vascus is um from the alcohol perspective, but I think largely we've been trying to get out of uh directly managing bosco's stuff because it's just like not the right area for us to delve into. um But that's.

E

B

Think that's a tall enough ai to like figure out who is a good contact for this.

C

B

On-Call is like particularly good at this, but there's definitely some people have done like use of the aws release.

C

Yeah yeah yeah sure that would be helpful like if you can just like once you get to know and update the information on the issue itself.

B

Cool um I'll report that in a bit.

C

Yeah I did talk to ciao like mama. They did talk to chow. First, he was the person who actually redirected me to sick testing, so he was not really sure and who's going to like take care of it right now.

B

C

Yeah, okay, yeah one last question I have like mohammed, uh you mentioned about the gcp account we handle it. So what is your take on uh using one of the like uh community owned projects, like I mentioned before, like we have like 8 staging improv a few projects, so is it not recommended that we have the.

E

Secret manager.

C

Service enabled on one of it so that it's just easy- and you know.

D

You could take that approach, um you're talking about the staging projects where these two images right.

C

Yeah, I'm not entirely sure like, but there's like three to four projects which are being handled by one of our team members for ibm cloud. So but yeah like I was just wondering. What's your take on it.

D

uh It's possible um you'll need to reach. You need to speak to cicada and ask them to make changes to your staging project, to basically enable secret manager and then give you the right permissions.

D

Okay, uh they might refuse that. But I can't speak on their behalf. So.

C

Okay, yeah yeah, yeah sure yeah, I'm.

D

Along to next week's meeting and see what they say.

C

Yeah to cater central meeting with this one yep.

D

C

Yeah yeah yeah sure thank you.

D

Which is why I said it's much easier for ibm employees to spin up their own project and just create the secret in there.

C

Okay, okay, yeah sure, because.

D

As far as the case infrared is concerned, they don't really care where you pull the secret from as long as the principle that's being used has to write permissions.

C

uh Okay, then, that then yeah having our own project make sure.

D

We'll give an email and we'll say, give us secret accessorial and that's it.

C

Okay, yeah sure.

C

So yeah, that's it for me. uh Thank you, everyone. I will take it. No, I will write them down and yeah. Hopefully come back in the next meeting.

B

Awesome all right um muhammad, I think you have the next agenda item. If you want to go.

D

Yeah, um so the next one is about migrating to artifact registry from google content registry. um This particular issue is related to image pushing right there. I've got some other issues open for serving images from there, so this particular issue is when changes are committed into um repositories. The image builder runs um pushes images to a staging repository in a project, so something I want to do is make sure we start pushing images to artifact registry within those projects right and the image builder is something that's owned by testing from call.

D

So I need to talk to some people and see how that works. One question that I have is some repositories have like the card build the ammo where they have the images key in there. So we know what the keys, what images are going to, but most of the repositories that I looked, uh don't really have. The images key seems to be inserted by the go binary that seems to be running in the image builder. So is this the right place to ask that or do I need to go and find someone else.

E

um I'm not, can you restate the question like oh yeah,.

D

E

D

Some questions about the image builder right: um there is a little code that runs there that generates or completes the card building. Ammo that's present in repositories. um I need to change that so that it pushes images to artifact registry instead. So the.

E

The cloud build, the the go tool is just doing substitutions into the cloud build yaml. It doesn't have anything to do with the actual, pushing.

D

Yeah: okay, that's interesting because some repositories, when I look at the images key, is not populated, so yeah.

E

There may not be they're, probably not pushing using cloud build to push. um For example, if I want to push a multi-arch image it uh and like construct a manifest list, then I'm probably using something like docker build x or docker manifest and programmatically pushing it from a step.

E

um Okay, instead of leaving it to cl when the cloud build uh images key can only push from like you build an image into like local docker storage using some tool and then it it can push it.

E

But um that means that you're building with docker, which we're not always doing sometimes we're using co and uh local storage, doesn't do uh manifest list multi-arch stuff.

C

E

um So I would say, probably going forward like that won't be used super often, uh if I'm remembering the future right. uh I, but also, I I'm not sure, if we're coming at this, the right direction.

E

I think if we want to migrate to artifact registry, the like critical place to do so is in the registries that actually have lots of like operations happening so that, like the production ones, staging registries as a not absolute but as a general rule are just a place that we allow the like build to push to and then they're only consumed by the promotion tool.

D

Okay, I'm working.

E

D

Both ends right um yeah, but I.

E

Think that is but yeah, but I I think that um it will be more disruptive to replace all of the staging registries and for less gain. uh I think that it's probably worth focusing the effort on. Can we can we get the? Can we get promotion into artifact registry and it the like? It should be pretty negligible on most of the staging registries. If we stage to gcr still.

D

uh Okay, okay, that's fine! I mean the other piece has already announced that it's doable uh all the work is in fly. I just need to get the right approvals for it. uh The reason I'm looking at that is gcr is going to disappear at some point um and what we're talking about has to be looked at at some point in the future.

E

uh My understanding was, they had no intention to like shut down the project or, if they did, that would be pretty heavy notice, they're, just not going to add any additional features.

E

uh It's frozen so um we'll like we'll want to move to artifact for other things, because uh it's also an opportunity for us to move to like specific regions instead of multi-regional and okay, because uh at some point we might want features. um I know a few people in the project have had long-standing requests for things like immutable uh tags um and we're kind of like implementing that ourselves on top with the promoter.

E

um So like that sort of thing, but again for staging, I don't think we care, because we're just consuming those by digest.

B

E

um I do think it makes sense long term to standardize on it, uh but I feel like it's a lot more pressing to work through how we get it into um the production promotion and other than like getting agreement on that and actually standing it up. I think that, like logistically, that's also far less disruptive, there's a lot of staging registries to track down and tell projects to switch to pushing to some different location, and if they do have people consuming from those registries, then they have to switch.

C

D

Well, that context is helpful uh in my initial scoping it. It is a lot of work like substantially more than what we need to do to get ocf proxy for running um but yeah. It's it's nice to know that context. I'll. Keep that in mind. Yeah.

E

And I would certainly still it won't be helpful here and- and I think this is a good thing to do, but given that I've also seen working on some of these other parts, I would um I would consider like shelving this one, because I think it's probably gonna be a lot more work than it's than the payoff. For the moment.

B

D

All right, thanks for that.

B

Okay, um please also update the notes, if anything in there it looks inaccurate, I'm uh trying my best on that um cool. I think that's all the stuff that was uh listed on the agenda for now. Does anybody have any um like ad hoc agenda items that they want to discuss right now on purchasing topics.

E

Hi uh I have a like quick fyi for folks um there's, a kep from sig release about changing the kubernetes kubernetes main repo uh default branch from master to main. uh There was some communication going out about doing that very soon. I think we're gonna delay it to the next release because it needs more input but um I'll be uh trying to circle back and drop that to the sig in slack when there's a uh pr to that kept where we can discuss more, it actually didn't get marked implementable, yet it's still marked provisional.

E

um So we're asking them to follow up on that and folks from this sig probably can help provide some more input on how to make that transition smooth from the like infrastructure side of things. um I know I at least have some thoughts about the ci config on the scale of that project, but I suspect other people in the sick will too we're listed as a participating sig, but it didn't filter here yet so the other bit of feedback is to circulate all those things so um lending a hand here we're one of the sigs.

E

We should be taking a look at that when that um kept comes back up. Probably you know, within this week.

E

um Let me find a link to that or it would. There was a notice to the uh dev mailing list, which you should be a member of.

E

E

E

I've added a link uh in the notes.

B

Hey sven anything else on that or.

B

E

That that's it for that one well,.

B

um Any other uh agenda discussion.

B

All right, um I think in that case we can close this out uh thanks everybody for attending um I've got an action on me um and it sounds like there's some uh good follow-ups for some of the issues mentioned. So thanks for everybody see you all later.

E

B