Project Harbor Community, 12 Jul 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: CNCF Harbor's Community Zoom Meeting - July 12, 2023

Description

CNCF Harbor's Community Zoom Meeting

A

All right and we're recording hello everyone uh Welcome to our bi-weekly community meeting for project Harbor today is July 12th. My name is Orlando I'm the community lead for project Harbor. This is official community meeting, just be nice to each other and follow the code of conduct with that said, I'm gonna paste it into the chat the community meeting notes.

A

So it will be super awesome. If you add yourself there and let's see what we have for today, should I share.

B

A

Okay, I hope everyone can see my screen.

A

So I've added a few stuff and Belgian at it as well. So some of this from my side um submitted everything that you folks wanted to have for the cubecon channel, um the the kiosk and the maintenance media internet's truck talk, um there's no project um project meeting session for China. Don't know why.

A

um What else uh yeah finally managed to record that access to the root account uh for the cncf cluster for AWS, with the hardware team I have the username and the password so I'm gonna request also a separate LastPass.

A

um So we can store that and and have it for the future, not to ask again uh Jeffrey from from cncm. So hey.

C

Audi third.

A

Here interrupt.

C

um By the way, do we have any updates on the apply application for um since, if we are VMS to so.

A

C

A

That's part of that's part of the same effort uh came out. We we have, uh we have account already created uh within AWS and now with this one, we can create the keys and then deploy whatever we want and we need so.

A

um That's just like a follow-up question and I said uh this: uh how you think you're gonna trade, these VMS I, can create these VMS for you. If you want, or are we going to use some kind of automation like from GitHub actions or something to spin up this VMS and use them or what was the.

C

Well, but, according to my uh knowledge that these VMS that were used to create kubernetes crafters for overhem Pablo, now it has nothing to do with AWS account. It is like a like a sort of like a on-premise uh VMS with the machines that will be used for for Abraham to to run pipeline.

A

uh What do you mean by on-premise I'm, confused with that on-premise, where within VMware or.

A

If you want to do some tests with the helm, chart.

B

A

Yeah yeah, but now we have the environment so I'm, not sure why why we need to do VM. Some Prem like are talking about one cloud or something like that or within VMware or.

C

Eventually, our goal is to create a kubernetes cloud Turf and that will be used for hover hand pipeline. But to do that, we need some virtual machines and.

D

A

C

And I I record that and thank you once asked you to create some virtual machines for him to run the pipeline of uh run the netany test of the performance tests for for Harbor OSS project. Yes,.

A

C

It is especially the same thing like I would like to apply. I would like to kindly ask you help us to apply some motion machines that will be that will be used to to create kubernetes clusters so that our hand pipeline will be able to run okay.

A

uh We can, we can definitely do that in that account uh uh or we can. We can kick off like a AKs or setup eks I'm, sorry. So, whatever you need right now that we have the the resources we can utilize them. So if you need VMS I can I can create VMS, um and we can. We can run it. uh I prefer if we do that in some automated fashion like if we, if we want to do um tests in uh in AWS. So that means like we need like three machines or whatever machines.

A

I would like to have that through GitHub actions and terraform and stuff like this, so it can be easily trackable and recreatable if needed.

C

A

I mean I I'm I'm, not in favor to over complicate things, but if I just log in and create two VMS and I'm, the only one who have access to create them or whatever is just not optimal right or me just just an example that could be you that could be varim.

A

That could be anyone right so, but if we have the credentials as GitHub GitHub secrets and, for example, we create a new repository, let's call it, for example, infra or whatever, um which has the actions to spin up all these VMS and set them up for testing.

A

Then we can rely on on that environment. Not not one person right. That's that's my that's my idea. If you, if you're okay with this one, we can go this way. If you're not, we can discuss further.

C

Okay, I discuss with you, you know, yeah your message, maybe on the flag, yeah.

A

Okay: let's do that.

C

Okay, cool thanks.

A

uh For those of you who joined a little bit later, like valim and Thomas, were discussing that I managed to get hold of the uh CCF cluster AWS account for for Harbor.

A

So now we can utilize that thing and actually spin up some VMS to do testings or whatever it's we needed one for the operator we needed a few for the home and so on and so forth. So now we have kind of playground to do stuff, which is cool I, think so we have to use that and we bring you up to speed with the discussion.

A

Is that I don't like the idea of having manually created VMS inside AWS, so we should think of some kind of some way of automating this one, and there are plenty of ways to do that so.

A

A

Sorry alarm all.

D

Right, so is there already an idea what you want to deploy on the cncf cluster on this on the cluster? What is the on the account? It's like a demo instance, for example, or is there something else me.

A

D

A

Anyone anyone I was uh that that's request for that account. um Okay, that need for that. Account came out from the uh the thing that we needed some VMS to do, Hampshire, testing or or actually we needed a cluster to do the helm. Chart uh testing also I think um we teach Thomas. We discussed that or so I'm, not sure uh the the operator testing as well, that we we need some environment there, so practically everything that that needs testing and its resources, some sort, it's a it's.

A

That's the right place, I think not some, some, let's say VMware internal or someone else's internal infrastructure.

D

A

So yeah, so now we have it. We just need to find a way to set it up and have fun with it. That's it, okay, great and and for me the most obvious way is by creating some kind of repository for infrastructure. That's like, for example, our kubernetes project is doing it and and run GitHub hashings with with all the secrets and everything. So we have practically just hit up a button to have the everything set it up or destroy it or normal infrastructures code can approach nothing special yeah.

D

Makes sense: okay, cool.

A

I'm gonna start documenting all this stuff. It's somewhere and I'm, not sure this. There will be some sensitive data like the AWS account number or who has access to it. There will be, should be some accumulation between uh some publicly available information and some others that is not publicly available only for maintainers, I, suppose yeah. But if you have some fancy camera, which is following you.

D

Oh yeah, it is it it's the same. One I just I discovered a new functionality. There I can show it yeah.

A

It looks super cool all right, so that's about this topic. If you have some more questions, we can discuss it or we can jump to the next one.

A

Oh okay, so do you wanna yeah yeah? Let's.

E

Go ahead, nice screen yeah.

A

Sure I'm gonna stop sharing and.

E

Yeah, let me introduce the new feature that we are going to deliver. We need in a two dollar now the issue uh for 496 address the pen, part of the see.

E

Of the user, such as the previous CV report, is uh or artifact of the colleges I have to click and check every artifact to the to get a detailed information, and the city report feature can export this information, but it only can export the information by a single project and it is not easy for user to such as when they are active on new release and to review their severed as severe vulnerabilities in a single project in a single release, so I mean the security Harbor provide this uh to provide this new feature to solve this issue.

E

We provide a dashboard of vulnerability, summary information for current system or the project, so that user can see how many critical or high or median or longer level different levels of vulnerability count, and we also can see the most dangerous availabilities.

E

We can't be. We started by the stability, vulnerability count.

E

This is the user story of this mainly focus on query conditions. One user check the search, the vulnerabilities.

E

And for the to simplify the privilege of implementation, only administrators could access the security have a feature.

E

And the current visual is the only compatible with pluggable scanner aspect 1.0 and support only to support the true adapter. uh Maybe in the future, is a real uh Implement, more or tested the compatibility of the other adapters.

E

For some performance uh consideration that scan report the table, you need to add the following columns. Previously, this information was aggregated honky Bank. Currently we are going to add this information in a scan report table so that we can improve our performance.

E

And the implementation we are going to deliver to uh I understand guys wise to schedule summary information uh scan summary when we provide our with.

F

D

E

Option we will provide the most dangerous activity and amongst the dangerous artifact, um usually the top file, dangerous city and travel file, dangerous artifact and also currently, we are only implement the summary by System level. In future, we are going to implement the uh summary by project level so that when we click that each project, we can see the project as uh three vulnerability. Information summary- and this is the query for the uh for this summary- this is a Secret online sequel.

E

And the second is a search, vulnerability information, so developing information is, if we are include all the informations related to the vulnerabilities.

E

The vulnerability is different with the cve, because for each series is a classification of the vulnerability, but for a single CV maybe appear in uh artifact for several times. For example, the logo project can be installed in College job profile or in a application servers uh image.

E

And the problem for performance consideration, we add our query, parameter team count, one. The two count is two and it means that when the query, the total conduct uh larger than one thousand.

E

To uh minus one, and the response is the same as the response content is the same as the query: without the tune count option and the only difference is the external comp will exceeded, we are, will be a minus one and in UI it will display that account is uh 1000 plus in the UI, and this is the acquiring conditions for such vulnerabilities and the country we can. We support such vulnerabilities by City ID, and also we can search that by civility levels such as critical, uh high or medium that as such and research score.

E

We can so. We support the search that School.

E

And uh because the NBD score is mostly popular, it is supported by Advanced, for example, we we can specify the.

D

E

From 7.0 to uh 10., so all these vulnerabilities with that between these scores we are displayed, and we also support the quality by project ID and the Repository. This is our exact match and uh package and attack.

E

This is the example of the query. We.

B

E

The queue as the query condition and use the cellular, ID and then separate with the comma.

E

This is a underlying Circle.

E

And this is the thing called to update the scanning powder table.

E

um Beside the upper wall outline windows, we also need to reflect some of the code. First, we need to.

E

Get a decoupled the previous job services such as Scandal, and to duplicate the serious information.

E

And also, we need to improve the performance to reflect the Scandal power. Summary information, such as the.

E

As we mentioned in a previous.

E

And then we also need to refactor the previous uh cve process.

B

E

Regular data inside in the table, such as the CSS cgis of these three score, currently is empty and we are going to extract this information from vendor attribute of the data understanding existing column, the CSS cdss, weekly score column.

E

And this is uh we.

B

Also migrated previous scanning.

E

Plot because previous Scandal include at the critical counter, High count and medium count on the local. We will extracted this data from previous scan report and this is the UI of the security Hub. This is uh the first feature is the screenshot of the summary information.

E

The first panel is the color.

B

Vulnerabilities.

E

This is the core system, how many artifacts are included and how many advice or scan and how many critical or high availability or million vulnerability found, and the second one is the top file vendors artifact, the vulnerabilities occupation under the top five most dangerous cities.

E

And uh in the button, it is the search, vulnerability interface.

E

We currently support our statute by cdid and the serial ID and package, and this condition can be combined.

E

E

Sv3 score or HBO.

E

Under the pop-up for the performance consideration, the topic typical production environment may have more than 10 000 artifacts and each other, and they have 170. So the the table of report vulnerability record will have many many records. So we need to consider the performance um popular query. We need to refine the current query for better performance and, for example, index for these tables.

E

And in the future we may for the performance we make use, we might use the black search.

D

E

All thank you. Do you have any other questions.

A

Thank you very much.

A

Maybe the others can and address something or maybe yeah.

F

A

Through the week, yeah.

A

Thank you, I'm, going to add that into the meeting minutes.

E

Already in a conference.

A

D

I have a question regarding the clarification, so only administrators have access to this dashboard.

E

Yeah, currently, we are both to simplify the implementation. We are like only administrators can either access this dashboard. In future, we can add more dual to access this information.

D

Okay, no other question that.

A

That looks a lot like the like the project that we try to create in the Linux Foundation mentorship program right or overlaps. A lot with it is in terms of functionality. Right, yes,.

A

And I was about to ask the same question about the administrator. Why only the administrator?

A

But you answer that already thank you.

A

Anyone else any questions about this proposal by the way right now, it's just a proposal right, it's and you have something some code that is working already, but it's not committed.

E

A

Repository or I'm wrong.

E

Yeah you can edit your comments in uh yeah.

A

uh The pr for the proposal or the pr for the actual code, implementation.

E

G

Cool by the way, this is the anchor feature of 2.9, so we have already uh released some PRS I mean for the source code. So um so actually we didn't cut chance to present this proposal. But actually this is uh should be the the the anchor feature in 2009 release and still.

A

We I think we lost you.

A

So we plan we planned that to be released as part of T9 and that will be the dimension feature or plug the highlight of the two nine.

G

Yes, yes, and we actually already started from this- the the code implementation from maybe one month or more than one month ago, but yeah like like I, said we didn't get chance to present this proposal in a community meeting. So um but we did it yeah yeah.

A

All right um by the way, do you think we can add.

B

A

Two nine one of the uh the other projects from the mentorship program like have you managed to uh review uh wilfred's uh changes and and the others.

G

uh I I don't think so, because that we did not plan any feature of the programmer in 2009.

G

So if we would like to have some of them, we can maybe plan them in 2010 uh finding window so decide which one will be in to London 2010 and then so. We will focus on that. So.

G

A

And 229 is planned for like mid-august right uh to ten. Do we have already some idea? Have we discussed I'm, not sure I cannot remember if we discussed the time frame for.

G

The yearly yeah uh we usually start to plan the next release after the FC stage of the previous release, so uh me should be uh reached to the planning of 210, maybe in two weeks.

G

I mean we should start the uh plan window for 2.10, maybe in 10 weeks. Sorry in two weeks. um So probably we can uh uh and create a new discussion for uh to collect the requirement from the community for 2.10 yeah, maybe next week or or yeah two weeks after yeah and then.

A

Okay, yeah! That's that's the reason why I'm asking uh because we have to um address this this as well: yeah, okay, cool.

A

All right, uh so anyone any more questions about security, hope.

A

Okay, thank you Jordan again, uh okay, uh so next on an agenda out of the making sure. Oh it's discussion, topics about the kubecon Chicago uh with Stephen. We still haven't applied for any of this stuff that I'm showing the kiosks or project meetings I'm just wanna. Last time, sure um sync, with with everyone uh that there will be presents there, like volume, you're planning to be there right, yeah.

D

I'm planning to be there and we can have a kiosk and a project meeting if yeah.

A

And and the okay, so we we do as we did it in the in Amsterdam yeah.

D

A

Need I need to write.

D

The this uh the talk for the president.

A

Yeah foreigners track exactly.

D

A

Actually, we have something that I've submitted for.

D

A

We can step on this one and just Okay Internet, maybe not, because we have to submit yeah because we have to submit it like in the next four days. Okay,.

D

A

D

Is that's good? We can.

A

Use the starting point: yeah yeah and the thing is: we should keep it a little bit generic because we are submitting it now and that should be done like November right. So a lot of things will change until then in.

F

A

The new, the new stuff that you are going to go into, 210, which we don't know yet right so yeah- should.

B

A

Little bit, generic in in terms of names and and descriptions and such yeah.

D

That's good I'm agree.

A

Okay, good yeah, the same thing goes for the project: update uh I, think the emphasis will be the security hub functionality, obviously, uh and some other stuff around uh operator and um on the telephone, for example, provider um and that's about it because we yeah it's so far ahead of time.

A

Then the conference that yeah, we don't know what will be entertained so yeah, okay, uh okay, so that I think that that's cool I'm, gonna contact you about the kiosk depends on the time frames that we we want to have like afternoons or something and about the project meeting the same thing like what the same thing that we did for Amsterdam alrighty.

D

Can you share the the document with me, so I can take a look at it and edit, it sure.

A

Yeah I'll do that um another update, okay, that should be in the update section but I've created. uh Maybe you saw that on the maintainers mailing list, um I've created a new zapier account uh uh under the cncf harbor maintenance, email address and I use that to sync whenever we have new recording into Zoom to be automatically uploaded to YouTube, so that password the same, that user will be into the future shared LastPass account for the project. If you want to use it for some other, like automation,.

D

Okay, that's good.

A

Because, right as of now, it was it is under the account of Jonas but yeah having it on private accounts is not it's not good, so I decided to migrate it to our own account, which will be inherited by whoever wants to take care of the project in the future. If something goes differently that we anticipated right now, so yeah yep, my my operations site is kicking in. So sorry for that um and yeah I'm on uh community29 release, update.

G

All right, thank you. um We are in the uh FC stage up to the night and the plan date of FC stage is the July 17th. But, however, since we uh there's some updates on the uh security harp proposal like a stone and just pretend um we did some API chain as well as some UI change, so they we would like to require more one more week for the code implementation. So we would like to today at the FC state for one more week.

G

So uh last should be the July 24, as well as the ga day. um The new Jade day should be the August 21.

D

G

So um yeah, so um besides the the anchor feature of the security harm and all the other features are almost a tongue. So um that's the update of the 2.9.

A

Okay, uh do we have that somewhere, documented or like in.

G

In the wiki you mean the the the.

A

G

D

G

In the comment in.

D

The community there should be just just talking.

G

About here, yeah.

D

Just in the comment of this uh yeah I, just added here.

A

Right, yeah yeah just to add it over here, that's what yeah.

G

Okay, a timely of this today, yeah.

A

Thank you and another one that I wanted to bring up is the icons updated.

D

A

Folk provided, um as we discussed, I addressed that to cncf uh they're super happy with the update. If we find it like useful for us and we if we like it, there's no restrictions from their site. uh How how to deal with that so I'm happy with the look so I think we can unblock that thing and everyone can vote.

D

Okay, so I remember to do not merge there.

A

You go yeah, yeah I! Think you added it right. No off nothing!.

D

D

Okay, so if it's okay, we can call.

A

For discussion yeah, let's see yeah; okay, you remove it yeah, okay, so cool uh I'm, gonna. Add it into the agenda for today. So uh anyone any thoughts on this one.

D

It looks great for.

G

Me so yeah, so so, if CCF has no idea, unless I mean that they do not against, for this I think we can start voting or just look good for me, but but I I'm I just want to hope for this class, because that the icon should be the property of the cncf. So any updates should let them know.

B

G

A

Are uh yeah yeah I've opened uh I can relate if you want me to to the cncf service desk ticket that I asked them ISD uh was that marketing slash whatever Bureau with cncf and they they took? They took a look at the at the changes that it's fine, it's as long as it's work work for us, it's not violating any like branding or project kind of marketing, oriented.

B

A

Schema stuff so.

A

So I I think from my perspective, as a user that over here looks better than that that over here so yeah but I I, suppose someone from VMware last time wrote and yeah.

F

A

B

F

Our UI designer have reviewed this PR already and uh he he is okay with the change.

A

Oh okay, okay! So it's unblocked so.

D

Yeah all righty, so let's do the edit did it update and if it's done we can merge it. Yep cool.

A

Okay, that's a quick one good, um any any other topics for today.

A

um Holidays in at least in that region of the Earth, where I'm living our project, so at some point uh one is I want to take some some days off, um so I'll be looking for some volunteers to take care of the community meetings at some point. Our output dates for the next one. So if, if someone can take- and just do that thing that I'm doing so, it's not a big deal.

D

Yeah I'll probably won't be able to attend the next one.

D

Yeah I'm, not I'm,.

G

Trying to think okay yeah yeah, the training team can host the community meeting. Don't.

A

G

A

Yeah because I'm planning to take a little bit prolonged application. uh That means August and half of September um so that that we mean was that.

B

A

G

This summer, well Christian.

A

Yes, yeah sorry I'm pretty, but that's yeah, that's the only way. I can do it. uh Otherwise, uh I have super problematic uh situation with the kids. I have to take care of the kids and yeah.

B

A

Yeah so yeah, okay, thanks for that, um I'll put the dates for the like uh until the September uh for for the meeting that we'll need someone else to take care, um I'll be around with the um for the release. So we can. We can work out some some blog posts and some notifications around the release, but I'll be I'll, be I'll join around the release date, so we can figure this out.

A

So yeah, so that's that's everything from my side, ah one one one another interesting update I was invited to uh a conference in Netherlands called Enterprise devops techcon this one enterprise Enterprise this one and actually I spoke with uh uh Thomas O'brien uh from from the Dutch railways.

A

They and we're gonna present, not with him, but a colleague of him we're gonna present at that conference, like a hardware use case for the detroitways.

D

The conference.

A

Yeah, the conference will be in a thrift actually um yeah a bit time for show off, but I was invited to give a keynote session about cncf and how cncf helps projects and such, uh but the the other thing is for Hardware use case um so yeah.

A

If you, if you feel like traveling to Utrecht, it will be super nice to see you. uh It's October 3rd I, think yeah.

A

Nice, whatever yeah, whenever we have something like a laid down on the agenda for the talk, uh I'll put it up for review from from you folks. If you have some ideas, how we can make it a little bit better.

A

A

Yep, okay, that's just everything from my side. uh Anyone else wants to share something.

A

That was everything good on the operator side.

G

uh Yes, I can make a quick update if you want uh um during the last Arbor operator community meeting, we mainly talked about the release of the 1.4 uh operator version that will manage 2.6 above version. Our goal is to release it before the end of summer. uh We try to to visit for the end of July, but uh at worst it will. It will be end of August, so that is our main Target. Today.

G

Right and once this release will be done, uh we'll start to talk about the next full is the 1.5 to see what we want to to do, which harbor version we want to handle and which kubernetes version and and the features. So, if you want to talk about it, you're you're welcome.

A

That's invitation for everyone who wants to join the efforts for the operator and it's interested. What's the what's going on there.

G

Yeah, we are talking every Tuesday uh one weeks on June, so the next meeting will be on next Tuesday sure on testing and that's it.

A

All right, cool.

A

um By the way I have to publish the last last, recording is still pending, so I'll do that now, actually, after the call. So if someone is interested, um Can can uh take a look at the recording uh what was discussed last time, cool all righty. Thank you very much for attending today. I hope you have great rest of the day or have a great evening and talk to you in two weeks.

A

Thank you bye-bye. Thank you. Thank.

G