Kubernetes SIG Windows, 13 Aug 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes SIG Windows 20190813

Description

Kubernetes SIG Windows 20190813

A

All right well welcome everyone. This is the Sig Windows meeting for the 13th of August 2019. So I've got the agenda up here but feel free to add other items. If there's other questions or things you want to cover on there or drop things in the chat on Zoom, so you're asked this is a official community meeting. Please be sure that you're adhere to the kubernetes contributor code of conduct.

A

All right so on the agenda for today looks like we've got some discussion around how we finish setting up the end to end testing with group managed service accounts, there's a couple options to work through there, I added something around basically starting to scrub and burn down the issues we have on 116.

A

So I can go through that discussion after that, but when I want to make sure was that we got this backlog basically down to zero, so that I've just got one column that the release team contract for what we're playing emerge in 16 versus not and it looks like we've- got a number of people back from holiday, so I'm hoping hope everyone had had some had some good time off. I see some faces. I haven't seen in a couple weeks, so I guess with that. But I guess go ahead and kick off.

A

The domain controller had discussion. Jeremy.

B

I'm sure so, I put in a PR yesterday to merge the extension I made for aks that sets up a it'll set up a separate pool of one server and run it through creating a domain promoting a domain controller and creating the group managed service account.

B

So that way too, we can actually run and then test against that node that we can actually check and make sure that the domain communications working the way it should there's been a number of comments on it, since I put it in yesterday and I haven't been able to address all of them yet, but I'm hoping I can get through them. Today.

B

C

A

C

Think, like we also wanted to point out the fact that it doesn't actually need to go into a PS engine for the 116 I think like we can host it in the windows, DMS, a repo that we have and like pull it in, but I think what we'll need to change. Maybe from Adelina is the a casing in template. That's faster.

C

So that needs to point you this to this extension and the extension will be hosted in our kubernetes six three point stuff in its engine and it'll, get pull down and configure the GMs and stuff that that is needed. So just want to add that clarification that it does not need to actually get into it. Yes, and you it's more there for a review and it might have some test specific things that may not make sense for it using it so I, I guess.

C

The main thing here is just a heads up that we do one this for I hear of a casing in base tested for that we have, and this would be coming in pretty soon.

A

Okay, I'll take a look at this and and get some feedback from that IKS engine team on whether or not they want to maintain that in this repo versus in the in the separate one deeps right and that both are both are possible.

A

Yeah soft enough to review that later.

A

So, in addition to getting something like this merged, then your proposal would be to also set up a separate job, just at GM si as like a periodic like once a day thing or what other work would be needed to get this fully Mart fully uh covered. We need to e yes,.

C

I think what this does is. It sets up a separate pool, basically, which has the DC the primary DC in there with the GMs are configured, and there would be a simple III test that will just try to a sit into the machine. Get the Fred spec. That's needed, configure the credits back and run a full end-to-end GMS, a test which was one of our beta graduation criteria. So, okay,.

A

C

The goal is nano.

A

Stop or not, uh I.

C

Know that is being worked on right now for the actual each week and the other question we had is. This is fairly I, hear specific, so it'll work with the with the main test rate, I, think that gets insulted, but for GCE and the other test fader on VMware I think there. We need to think how this could can be replicated as well, but I guess that can come a little later and that's okay. Well,.

B

For the other cloud providers, I mean the test would still work as long as you had a main controller setup and cred spec created. So the test itself should work. I mean the the AKS extension is really just trying to automate the whole thing exactly.

C

Good point so they'll have to figure out that setup step separate before GC, for example, yeah.

A

Right which we can document yeah I just did a couple: quick searches and it looks like Asher's got something that they call all I haven't ever tried, deploying this as your Active Directory domain services, which is really confusing because, as your Active Directory, those three words is a different product. But apparently the domain servers services says that it does actually have says that it's fully compatible with Windows Server Active Directory is so there's a there's, a chance that might make setup easier but I.

A

This is the first I've looked at that, and this and there's also a service listed over on for GCE. That I don't know if these are like comparable or not, because I haven't used either one yeah, but it says that they've got a managed service for a Microsoft Active Directory, which is actually wrong. It should say Windows, Server, Active Directory, that's the trademark, not Active Directory, but.

B

Well, we use we use Azure ad in my place of employment. So if you want to chat real quick with that after the meeting or if you have time later, all okay.

A

Okay, but it's the domain services option, not the not to call it I doubt anyone.

B

Write that one's more for either standing up your ad strictly in the cloud or setting up a hybrid with your on-prem lady, okay,.

A

Okay, we could. We could talk more about that later.

C

So I think the next steps here would be just to get our tests up and then we work with maybe Adelina to get the changes in the template or JSON that's used by a case. Engine I think she already tried it out. It worked out. Okay, so it'll dis, Lee, just like formulas. Everything.

D

Actually, when I tried it out, I had some problems, but that was a long time ago. I mean I just go or something like that, but um all about the PRN ik is engine and give it a try to see to see how it would integrate, because we have. We basically have a similar environment like the upstream prong to be pretty pretty pretty much.

D

The same thing, my only concern my my only question here is exactly how we would set this when we add it to a conformist run that we already have or I was thinking. Maybe we would make a separate jobs, new job that we were actually discussing with some alpha features and some some other stuff.

D

So, for example, though the run is username would also be in that in that category.

C

Yes, so I was thinking like today. We specifically skip the GMs a test as part of the three run, and once the e to e is working. Maybe we just uncomment or, like you know, remove the GMs a test from that skipped list.

A

Can we put a feature tag for GM si on those tests, so maybe we could just say absolutely.

C

A

Our include could be, you know, feature GM, si and feature run as user name or something like that.

D

A

D

Of this more in terms of resources, because the.

D

Periodic job that we have for staging and the same virus apparently often I think it runs six times a day. So imagine adding an extra machine with the kind of bumper and by requirements.

C

So this is actually not an extra machine is just one of the machines. That's prepared, a little specially, which is like a PowerShell to promoted to a GA, but that's pretty much the only change. It's the same worker pool, but one of the nodes are in a separate group.

D

Okay, because my understanding was that we had two different pools.

C

It's two different pools, but basically like let's say, if you had like three windows workers before this will now have to win the initial pool and in the.

D

C

One in this special in.

D

The special pool they would just have this Gemma say: yeah, okay,.

C

B

D

B

You can still schedule other workloads against that one. It was just the.

D

B

Have to be done on that one.

D

D

C

Know yeah so, as Jeremy Figaro yesterday, a case engine will mark it, as like. It'll have a specific tag that the test will use and as part of the set up, we will also add through a chess engine. Another specific tag that say this is a primary DC and the test can use both tags, basically to figure out that this is the VM that you need to SAS CP, the bread specs from and they basically go around during the test.

D

A

As far as scheduling the test case, though, it can still run on any node right, correct, okay, it's just that one node has the extra set up and you need to get the files from it. But that's.

E

A

Done as part of the CSC, it's not done as part of the it's not done from within the pod yeah.

A

D

Whatever feedback is necessary, just to mention I, think or if it's strictly a testing thing I will Jamis X mentioning a mr. cat testing thing. I mean it is written in the sense of in my two senses: I'll, probably just go in Windows testing. What we already have extensions for testing.

D

But again this is my a my mapping in there I.

C

Yeah I'm not sure I got the last point big.

D

Session I think it's probably it's place. It will be better to have the extension in the Windows testing repo, where you already have extensions. Oh I see Tomy yeah yeah. That makes sense absolutely.

C

D

It's it's easier to. You know, maintain templates and whatever, but yeah.

C

So so I guess Jeremy will just have to redirect the PR towards the testing yeah.

A

I think that makes sense, because I want to make sure nobody confuses this as a something that's like production supported great.

C

Point yeah because.

A

This is not secure, well, I mean rather stud. It's not secure for business data right. The way it's being set up, it's got hard probably has hard-coded passwords, and some stuff like that, which would be a yeah, should be a bad idea.

A

But yeah I think the windows, testing repo makes sense if we want to keep it keep it consistent.

A

And so I'll just double check with the other folks work on a guess engine and see if they agree on that or not okay.

A

But yeah thanks for all the hard work on that and I didn't realize that had gone that far alrighty, so that that's good.

A

Let's see here so I can see who's on the call day by one discuss potential options around GCE today, or should we postpone uh no I do see you do on the call.

F

Yeah I also happen to look at the testing setup. I also didn't assign so I do constant, so I will look into like what it's possible and set up this using GCE, and you also meant you also just mentioned that there's go just looking managed service, Active, Directory mm-hmm.

F

That is doing the Alpha, so not sure if we can use it for testing, but that's also an option, maybe in the future that we could use as well. Yeah.

A

And I think you've got a contact on that team already, so they might have some feedback around this.

F

C

So I think, overall, just to get back like I think that a test will be done in a way so that it just looks at a generic tag besides a decent intact. So as long as we can tag, the node where the dcpromo has happened, I think we are all good from the test site. So.

A

C

The part that'll need to be figured out for DC.

D

C

The remaining item for beta was the clean up, PR I think that's probably already in use rather and I. Think besides those two, we are kinda ready for beta.

A

A

F

I think to clean up things and are Christian yeah.

C

That makes sense.

F

That was, you had two events for the station: cleaner, I think yeah yeah.

A

E

Okay right since so it's worth having another look at you. Thank you very much. Okay,.

A

Okay, excellent I get that a little list there well I scrolled past okay, it's under less! That's all that matters, okay, all right! So so moving forward under this I did a I. Did a quick look at the stuff. That's in progress here, these first ones around updating, wind cat and the pause image.

A

I'll go ahead and take those. Unfortunately, this one I'm trying to get Michael to approve it. When we set up the sig windows tools, repo, we unfortunately only put two approvers on it and he's out right now, so I sent him an email, I'm hoping he can. If he sees it, he can go in there and say, approve and then that'll get merged and then I'll go ahead and open up PR to get this one merged in there as well.

A

So hopefully we can get both of those done at once, and I can just update that pause image.

A

Claudia's got a PR, that's in review here for an update to the DNS tests so that one's actually so that one seems to be on track.

A

The one that is get that up there, the run as username test case PR, is open.

A

So we need to need a review on that, but I, don't think, there's anything blocked on that. Oh wait. I got the wrong.

A

Okay, so get that cleared up.

A

Took it at Pierre's there, okay, so those ones are, are all basically, you know you need to be reviewed, so we'll be putting people on those.

A

We need to get that driven down to zero the stuff that I wasn't sure about I still having this backlog item, and so, if we don't have anybody working on it, I'm actively I think I want to take it out and just put it back in the general backlog, so that way, we're tracking what what we know is in progress, because all this stuff needs to be merged by the 29th.

A

So we have just two weeks left in the milestone for 1.16.

A

So the CSI plugin stuff is this something that's still in progress for for 116, yeah.

C

So I'll have a pair for that buy most likely end of day today, so I'm glad I don't have to add that to the backlog. Oh okay,.

A

C

That's mainly for the increased stuff, so that's that she going by today, okay.

A

This next one was actually tracking a Windows issue.

A

I'll have to double check on this one, because I know that they were. We were looking for an ETA on a fix for that.

F

F

Think that one's probably fixed, we just need to re-enable it and see if the tests still pass. Okay,.

A

Okay cool, then, in that case, I'll I'll move that over to the right column, yeah. So just so Peter can just double check that then we should be good to go and.

F

Then there's one Jing from sick storage is working out. Is we get the disk usage or the usage of a volume, but we actually report a whole disc for empty there or other volumes. I know she is working on the PR I'm, not sure. If this is checked here.

A

And so this is for the ephemeral, storage calculation right.

G

Right I'm working on unit tests and they were sent out PR soon, so visitors use a recursive call to walk down the dr. tree and get each file directory size and okay.

A

A

Okay, I remember that one that was the one that was the discussion we had around FS step behavior on UNIX gave you the size, bytes and windows. We have to do a recursive.

G

Meaning so they used tú commands me do the same thing: okay,.

A

F

I don't know if there will be any concern about the usage of the funding to come in I know. Do you is very resource? Heavy I, don't know what the new solution for Windows so.

G

It's I think it's really the same so depending on your territory, the tree size, and if you have a huge tree and the lots of levels, hmm it will take a little bit time to collect to walk down the whole tree.

A

Yeah, but the good news is that should still be pretty quick, though, because the almost all that metadata is cached in memory. So it should be a pretty quick I.

G

Plan to maybe just test with some some kind of create a directory tree is different level different size mm-hm. Let's check the how much time it takes I'm addressing you, okay,.

A

Yeah, if you got any questions on on that stuff, feel free to ping me or myth nicks available on sock, you probably another good person to look at that as well. Relations are on that. Thank.

G

A

And then we still have some stuff around cube. Atm.

A

Do you have any updates on that? I lost track a names on here, Jack, Kalia, I, don't know yeah.

H

A

You're on the call.

H

I fix ups yesterday, so this script is in working condition. Ok,.

A

H

The only thing that needs to change is I'm: gonna pull the cni binaries from the container networking plugins page. Ok,.

A

H

Shouldn't be too hard, I just don't know what's in there yet, but other than that, it's good and I validated. You could see the commits I validated yeah join all that. So ok.

A

H

Yeah David's gonna help me validate. Ok,.

A

Excellent yeah that'll be now be great, so Ben I know there was some discussion around the empty Durer volume and paths. Do you have you had a chance to look at this to see if that's still, a problem always been on call.

G

I can help to take a look. This yeah I.

A

Think these tests tests have been passing on to Azure environment I.

F

Think the test itself has been fixed. The fact that empty does not really has the permission equivalent to seven seven seven in the next is still a problem.

G

Yeah, it's different from Linux right here. It means user group and all they have readwrite executable, but for Windows it's different. Yet we can say the user have the full permission, but I.

F

Think the problem is not every user has the permission to write to anteater.

G

Why do we need to give users the right permission.

A

So yeah, so so the difference is that the container has a different security database from the host, and so if the problem is that this is happening where users create in the container can't access files on empty there, then you could. Basically, when you create the empty Durer, you could set a.

A

You could base do the equivalent of doing a set owner bit.

A

Well, that's not even but there's no UNIX equivalent for this, but you could set an AK well that will be inherited by all child files and directories such that it would be readable by all users.

A

G

Do I need readwrite for all users, those, oh yeah, that's.

A

What's saying in the issue.

A

Okay, let me leave that one there and just try to take a closer look at it and make a decision on it. We only got one minute left.

A

Is anybody looking at pod auto-scaling tests? Do you happen to know anything about this Adelina or Claudia yeah.

I

I

But they have the serial thing that we have to separate. If you remember, okay, but.

A

Okay, so double check to see. If so, if that's scheduled, can you just add a comment on there that this is already done.

A

A

Can access default service.

A

Try surface actionable.

A

So this one looks like a DNS issue related to a possibility of routing things. Set up in VX are specific to flannel.

A

I'm gonna move this one out just because it doesn't look like that's, probably something that would be 116 specific and then this last one been said is going to look at it. So we'll try to get that I'll ping him again on that so or out of time did anybody have any any other? Last last-minute stuff I.

G

Had two items in the dark, but we don't have time so maybe we can talk next meeting. Why is yes proxy? The relate to ice cos API and the other is that I want to discuss the caching behavior for writing files in Windows. Ok,.

A

G

Can opine offline, okay.

A

All right sounds good. Oh I just saw this here. Ok, crap King.

C

I can probably follow up with you, but I scuzzy API.

E

A

C

Also ping me about it sure enchanted all.

A

Right, oh sorry, you put it up there at the top. Okay I'll just put a note on there for next week. So if we don't get to it offline, then we'll be able to cover it next week so and then next week Michael will be back and driving the meeting. I'm gonna be out Tuesday, but we could talk about this storage, stuff, I'm slack. So, okay, all right! Well, thanks everyone and have a have a great rest of your day. Thank.

G