Kubernetes SIG Windows, 2 Apr 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Windows 20190402

Description

Kubernetes SIG Windows 20190402

A

Hello, everybody and welcome to another sip windows. Meetup, it's the second of April. You guys are lucky right: it's not the 1st of April, because I loved putting a lot of pranks on April Fool's Day. So uh you know we're safe here all right. So, let's dive into the agenda. I added a few things in there in terms of communications and things. I have happened in the last week, overall, mostly good things for for our sakes. So let's run through them. The first thing is Craig.

A

You might talk earlier about the discussion portal and educate everybody on what that is sure.

B

So we're in the period when there was an issue joining the community slack, the community realized that isn't the only method or certainly the right method for all types of stakeholders in the communities community to collaborate, information about kubernetes, so they launched a new discussion forum and the link is in the meeting notes link to our particular discussion area for Windows related items in the chat, but the essentially we we worked with the communications team to launch this Windows specific set of topics and I've seeded it with some questions about use cases for Windows containers and kubernetes and based on some of that discussion, also forked off a discussion around security.

B

Specific topics for women's container to the community, so I am definitely committed to sort of moderating and mediating communications in there, but I'd also appreciate it. If other folks active in the SIG's would participate, I think we can do a lot to help people use this new capability more easily. One thing to note about this: is it's got a pretty good, Google SEO characteristics as well, so anything you you post in there with links and stuff will have show up pretty well in searches.

B

A

Know one thing: I know that if I post in a topic, I'll get all my notifications on that I'm, not sure and obviously having dug into it. If I can get notifications on anything that gets posted in there, you.

B

Can watch specific topics or you can watch the whole site something but.

A

Yeah but that's when they get created you can. You can watch the whole site.

B

I'm, not a hundred percent sure that I think you have to have certain permissions. If you wanna watch the whole site, because.

A

That would be very valuable right that way, as things come in like that's, that's how Google groups are valuable. You know that new topic was posted. Can you alpha I'll, follow up with her hair yeah.

C

So, a month, looking at right now and the options that you can use for a particular category are watching first post normal, which one I tell you. If someone mentions your name or replies to you, but you can also set to watching where you'll be notified of every post.

C

A

Do you see that Patrick is it.

B

That's per topic so.

C

Also, instead of using words, they have a little circle button next to new topic, which I had no idea. That's what it was until I started, clicking stuff randomly that's fine.

A

A

All right, well, I, guess you guys can I can do that and start watching the topics. Excellent! Thank you. Thanks thanks Craig. So the second topic for today there's a three blog post that came out recently that all of them are super valuable in terms of of both educating customers and users on key features of kubernetes key features of kubernetes with Windows, specifically as well as the overly networking that worked on Microsoft is doing and driving for kubernetes on Windows. So Craig and Taylor wrote one of them.

A

Patrick Michael wrote the second one and David wrote the third one they're all linked in the in the meeting notes. So if you haven't had a chance to read through them, please spend a little bit of time to do that.

A

The next topic is George kind of has been driving these office hours for kubernetes. Think of them as an opportunity for users to come in and talk to subject matter experts in the kubernetes community kind of voice, their concerns get their voice heard and you know facilitated discussion. So we are, we are gonna, be participants in that on April 11th at ADM. I expect some some of the key members I have delivered functionality in 1:14 that they should attend.

A

You know you know James Steele, Craig, me Adelina, you know, and a lot of the of you guys have spent time on windows make sure you go attend that way. If we have a question, that's related to your expertise. It gives you guys an opportunity to get some face time with customers.

C

Quick question: I see you have a youtube link there. Yes, is that how you join or is there also a zoom meeting and the YouTube is just the rebroadcast I.

A

Think they use YouTube live for this, but as it gets closer, we'll get details from from George I. Just put the link there to showcase how these would look like, but okay, okay got it.

C

Yeah, well, it's not the actual meeting. Okay yeah.

A

That's not the actual I think that's the link for their for their channel, but not necessarily how this would look like the day that we need to attend once I know, I'll I'll make sure I I update everybody on how we'll be able to log in.

C

A

So so that April lemon so remind everybody next Tuesday as well, but that's coming up.

A

All right, the next: let's talk a little about Cuba diem, Patrick.

C

Well, I I, don't have a ton to stay here but I see Callias on the call.

C

Do you want to introduce yourself or.

D

D

And I think I work for Dinesh and he's agreed that I can take up the lead on this. So basically I just need to see. What's already been done here and then the goal is to be able. Is it just as if the Windows master just Windows worker nuts there's.

A

No windows master, it's just workers, okay,.

D

Yeah I know like Windows master, maybe something in the future that we're looking into, but not now yep.

A

So you names, you said Kalia or Kalia, Kalia, Kalia, very nice, so there's there's as part of this work. That's gonna need to be a partnership between the windows team and the C cluster life cycle team. So can you just ping me like after this and I'll I'll put you in contact with someone from the C class, the lifecycle team? That is also tasked to kind of help in this endeavor. So I guess the first step would be.

A

You know, take stock of what's out there, what exists and what doesn't exist and, if possible, we need to create a plan on adding this support and we'll need a cap. So we can help you with you know they can process fairly. Well-Documented Knights couldn't be the second release. We're gonna be following it, but our goal is to kind of get the cab out there as soon as possible.

A

I don't know of the dates for 1.15, but it will be coming up fairly fast in terms of the cab approval process and going through the motions of getting that accepted. So can start the implementation. Okay,.

C

And so I took a brief look at this before and the main main hurdles that I think I think we need to work on are right. Now, Qube ADM gets a cubelet config that has a lot of Linux specific options set, and so there needs to be. You know some sort of filtering or an equivalent Windows, config, created and I think the closer lifecycle folks will have some guidance on what the right way to do. That is because I think they actually have a goal of storing the configuration in kubernetes itself, and so maybe when.

B

C

The configuration it needs to just generate so doing that versus an adapter would be a discussion for them and then the other thing is that it uses a lot of Linux specific pads, and so when it goes and creates the files. The going libraries will automatically create those paths on Windows. But you end up with you know like a slash at c: / kubernetes, slash, cubelet, config, or something like that, and some of those paths may need to change.

C

D

You agree that this, like the config file, is a major pain point for people. Yeah yeah.

C

But the config file is what they're recommending as the best practice for cubelet configs, rather than using parameters as we are today. So so it's a step in the right direction. Yeah yeah.

A

Let's, let's, let's start the process of documenting everything that we plan to do here and that way we can eventually put it in a cab. You can start a Google Doc if that that might be a little bit easier for us to all document and thread in iterate and look at the kind of timelines for the previous release. It looks like, and the cab enhancements proposal freeze was end of January before so I assume that it will probably be third week of April for this for this release.

A

So so it gives us about a couple of weeks to get this well understood, scoped, as well as putting a cap. Thank you. So much for taking the league on this is awesome.

A

Alright, then, deep, you wanted to provide storage, update.

E

So I think a couple of weeks back James and you jus and I as well as Nick from Microsoft. We started discussing like what should be the future of you know what are some of the things we could do on the storage side for Windows and I wrote up a doc I think we briefly went over it during the last meeting. But basically the idea was to collect most of the thoughts there, get it reviewed by you to enging and then present it a six storage to kind of get the overall opinion from them.

E

So we did manage to go over it during the last six oil meeting and it seemed like the destroyed folks, mainly Saud and others we're like really supportive of like fake, like exploring the storage proxy proxy option that I laid out there to enable CSI. The idea being you know, take it. Can we have some sort of a proxy privilege binary that does some of the privileged operations to get things across, specifically the mounts and things like that that the other CSI drivers can make use of so so they were like there weren't.

E

Any major concerns or objections around it, so that's something I'm exploring as far of 115. The other thing I proposed was also like, potentially looking at introducing.

E

But they're not maintained in a kubernetes SIG's repo, so that obviously meant that bad met like quite a bit more resistance. Cuz. You know the bar for entry. Plugins right now is very high, so I think the solution there was. You know, explore the CSI option if there are any major blockers and that cannot be delivered, then go to cigarete and ask for an exception around SMB. But we were thinking. Maybe I. Scuzzy is something we can introduce some of the Windows PowerShell scripts into where they use ice cuz.

E

The idiom only today the main thing that's going to enable is external provision or scenarios where you can use something like say, Trident from that app or from some other storage vendor and be able to provision dynamically provisioned Peavey's, not just that. Go for the Linux volume services, but also Windows.

A

Learn I, thank you and, and the document is linked in their meeting notes. So if anybody wants to have a chance to read through that and provide some feedback, please go ahead and do that all right. It looks like Jing the couple of items that he wanted to discuss around MTV and secrets.

F

Yes, so I think sometimes also disable those secrets tests, because those are like kind of using meanings, sake permissions to test and it does not applicable for Windows. So, but you know, those tests are like a part of conformance test. I think we need to have some tests for those either way we need to like modify the tests and to fit in like Windows environments or another way. It's kind of like there is a some program trying to translate from Linux permission to Windows.

F

They are not exact match, but they kind of transfer like from Linux to Windows just want to make sure like we. We want to address those tests.

C

Suit so which specific tests are you looking at, because we do have secrets tests that are working with volume mounts that are running today on test grid.

F

E 2 e cos e 2 e common. There are some like anteater test.

A

Is apart of the knowdon't, went.

A

F

Not known remember, there is PR the poor put Linux tag into those tests so that those has one to run well.

C

In since of the goal, was it wasn't all of the tests, it was only the ones that were testing UNIX, specific permissions.

F

So you mean the goal of those tests.

G

Can you tell me the exact names of those tests, yeah.

F

It's / e e / comment / empty and that go.

G

Can you write it in chatter, some somewhere I.

F

G

Look at it later, but for the most part so setting fire permissions will be ignored by windows cubelet. So unless is just checking for the default file permissions, those cannot pass on on Windows and they should the test. The tests should have the Linux only tag primarily other tests, which are checking the default 644 permissions or Windows Server 5/5.

G

They already pass on Windows Phone, Oh, nature's nice, ni and GC windows and.

F

Ok, I I will like check and send you the link about so I think once they say both I just want to make sure we have enough tests for those. You.

G

Can ping me on slack sure.

H

I think one of genes questions here is whether those whether we want equivalent test coverage for Windows for those tests that we disabled or we are just going to keep our way.

G

So there are primarily three types of tests for actually which we've disabled regarding storage. One of them is regarding file permissions, which we do not support, running as user or root, which we did not support. Learners group, which we do not support and running on storage, medium memory, so anything on in these categories.

G

We are skipping them so.

F

For Windows the million as memory we just not supported at all, not.

A

Today, yeah.

G

Only the default medium, you can specify a medium memory, but it will be totally big not on Windows.

F

So it's still like right now: I still go through to create Stampeder, it won't give you arrow it just might it's not something yeah.

G

Exactly it will create a natural MTD row file directory and mount that into the container, not an actual memory, storage file system and.

A

We call it very clearly both in the cabin in our Docs that that's not supported.

A

You know, there's a quite a few things that we don't support and we had a discussion with Ben last week as well over a couple of tickets, or should we start blocking these things, I'm kind of torn between that, because in some items who might be able to fix them in the future so doing work right now to block them?

A

It may or may not be worth it so can take it case-by-case.

F

F

Just for test I will ping like a snack but those tests again, and so the item is just like I pre mentioned before the stop has rena is working for like this cannot GCPD this. But there is an issue saying SMB does not support supposed so I'm wondering on our documents. Should we clarify like what is support? What is not supported, because right now is just saying some house is not sorted. I think I.

G

Think we support this and be right with.

A

G

A

Support us and be using the Anasazi using the we.

C

Have out of tree flex volume plugins available and.

A

We'll have a link to that volume. I get it right now, so I can send it to everybody, but there is a link on on.

F

Ok, so it's just issue created by Andy Jong about SMB does not suppose a past, so I kind of asked he gave a reason about lacking value. Is singling does not work, ym be remote, but so.

A

There is a few subpath situations that we don't support so.

A

So I have the dog in front of me says: volumes apartments are not supported; only the entire volume can be mounted on a Windows, and we also clearly call it as a pod volume. Mountain for secrets is not supported. I.

F

Don't think those are accurate, are you saying for the last rites for GCPD its.

C

How did you do that? Because the subpath mounting being it requires the ability to mount individual files and that doesn't work with docker.

A

G

You can have folders of Bath's as well. Okay, so so.

C

The linux sub path automatically includes both files and directories. So I guess what you're saying is the document should say so: paths only work for full directories, not files.

A

We could we could enhance that, but would probably need to well. Is there anybody else? I can actually verify that before I go update. This I.

F

Will plan to add our GCPD suppose tests so those.

A

That will be sufficient. Let me let us know you Jimmy and Patrick, and we'll update the dogs as well, and you have that.

F

And talking like discovered some really two months propagation is saying: Mon propagation hosts is only support, but actually in the code around it is Mon propagation, private. It's not yes,.

A

I think we actually filed to PR said it's out of that of that issue. You filed on that so I think I believe their own Patrick's plate ran out to review and we will get those in okay, so yeah you're correct, so that I don't know the code. I guess doesn't like yes,.

I

I, so this appears fix the dark side. It's still I guess an open question: if we you know, improves, can take ya. Host a container would actually work, and should we allow that for 115.

C

My my understanding is that it it will not work because of the way the file system driver works on Windows. It can't propagate back to the host.

I

E

C

That that works, yeah.

I

So it's that is currently not so.

A

So I the biggest thing here is: it doesn't work yes or no likely will work, but you don't have the code for it. So someone may have to go in.

I

C

Can you open an issue and assign it to me and then and then I'll get it handed off person.

I

E

Also, interestingly, as part of the CSI investigation, I was trying to propagate lounge sockets from containers to host, and that seemed to be working to guys.

H

E

Right, a directory path with the socket in there with the name socket in there well.

C

The creating a socket is just effectively creating a file at that point. Right.

E

And when the container create like listens on that file, a process from the host can dial to that socket and be yeah.

E

A

Thanks team, so so Patrick on that ticket that Jasper earlier for the host mount propagation, who might be able to use a first ticket that you created on that. So we'll update the docs today and then once you actually fix it will revert the dogs and push the fix in so beelin.

A

H

Will be nice to have coverage for everything that we say we supported, even though they may not be complements test, so I can send up several test suite for GCE. If you guys add any test that you think this currently supported I'll be happy to like. Do a sample just need to.

A

A

Come down come down to resources, but.

C

I think the same.

A

E

C

So yeah, so if you can find an existing test case that we're just skipping, then I think that's the way we should fix it, because we should be able to run the same test case in both places. Yeah.

H

I feel, like we've, been focusing on conformance. That's why some of the test cases we're not there, but since we are moving forward and whether we're like problems, we run into what features. We actually discover that we support. We might as well just add the test. True, that's a sweet yeah.

C

Yeah yeah I agree. Yes, so for that I'd say: let's just start filing issues that window for cig windows and say you know uncomment and fix these tests and then we'll do it for all that everything on test grid at once, I think that should be the best way to do it.

A

All right I only have about a minute left, so let's try to wrap it up quickly. Patrick when I talk about continuity, yeah.

C

I'll circulate a doc in the meeting notes for for next week. I'm still finishing up some investigations there, but the short summary is that we're going to need to update multiple caps related to run time class, and so I need to write up two use cases for this and I'll do that before next week. The builds that we actually need don't exist yet, but I think most of the code is there.

C

So when I circulate that doc, I'll have at least some partial steps of how to get how to get container D for this, but one of the work items over the course of 15 is going to be, depending on the main container D repo to get those windows builds published that are missing today and so I think that one things we'll need to do is either.

C

If we don't depend on the upstream build there, then maybe we pick another repo and say you know for the course of alpha we're gonna build from Patrick land container D, or something like that. But I'll get those details out there so and and I'll be getting that to sig windows and sig node for for discussion next week.

A

A

All right, it has a really pressing concern or an issue that they want to discuss or all right excellent. Thank you all for attending. We'll see you guys next week and please add to your calendars, the the committee discussion time for four. They pronounced right. Let's have a good day.