VMware / Contour Community Meetings

September 8, 2020

News
Contour 1.8.1 was released with a performance fix for status updates

What have we been working on?
[stevesloka] go-control-plane xDS Server
InFlight PR
Config File
[stevekriss] internal/dag refactoring

Discussion
[Chad Cravens] External Auth Providers, how do they work?
https://github.com/projectcontour/contour/blob/main/design/external-authorization-design.md
https://www.envoyproxy.io/docs/envoy/v1.15.0/intro/arch_overview/security/ext_authz_filter#arch-overview-ext-authz
https://github.com/projectcontour/contour-authserver

September 1, 2020

News
Status output performance issue found by @mattmoor
[youngnick] I propose we fix it and cut a 1.8.1 point release.

What have we been working on?
Refactoring work
[stevek] DAG builder refactoring part 1
Issues
[stevesloka] External Name Regression
[zianke] Add clickable anchor links to the website
[jonasrosland] Will look into CII Badge Silver status

August 25, 2020

News
(youngnick)Bringing forward 1.8 release: we have a few bigger PRs almost ready to go, we will cut 1.8 before they come in, which will be a few days early on the 28th of August, instead of the 31st.

What have we been working on?
[stevek] Guide for using Gatekeeper with Contour

Feedback
[stevesloka] Version of Kubernetes users are using. (re: CRD v1)

August 18, 2020

News
Roadmap update PR. tl;dr we are pushing the roadmap out for two months while we refactor to allow us to deliver the features in a more sustainable way.
Kubecon Meet the Maintainer Sessions:

Wednesday, August 19 • 17:00 - 18:00
Thursday, August 20 • 20:00 - 21:00
Kubecon Contour BoF - Thursday, August 20 • 13:00 - 13:35

Office Hours:
Overview Page: https://github.com/projectcontour/community/wiki/Office-Hours
Cal Link: https://calendar.google.com/event?action=TEMPLATE&tmeid=Nm9qN2lrMm1lcnNxc29pMWlyYWoxY2s3YjFfMjAyMDA4MjBUMTcwMDAwWiBzdGV2ZUBzdGV2ZXNsb2thLmNvbQ&tmsrc=steve%40stevesloka.com&scp=ALL

Discussion
Setting up local development environment [Chad Cravens]
Contour architecture (envoy API, go-control-plane, dag, etc.) [Chad Cravens]
Issue 2287, Service APIs implementation [Daneyon Hansen]. How to proceed with the following:
List of issues that block doing some implementation of the Service APIs behavior.
List of issues that need to be implemented to actually deliver the v1apha1 Service APIs behavior.
Issue 2187, add an operator for Contour. Cluster-addons is a k8s-sigs project for managing addons (e.g. CoreDNS) using operators [Daneyon Hansen].

August 11, 2020
News
What have we been working on?
[stevek] exploring Gatekeeper as a validating admission controller
Discussion
Next week

August 4, 2020
News
Contour CVE - Ingress data plane (Envoy deployment) is vulnerable to DOS
What have we been working on?
Office Hours this Thursday!
https://github.com/projectcontour/community/wiki/Office-Hours
New distribution lists
Discussion
Renaming master to main once Github adds tooling for that
Move to two reviewers per PR
Endpoints Slice Support
ExtensionService for Auth support
Next week
Move to Envoy go-control-plane: Some discussion around how to handle Endpoints
Finalize discussion around changing the number of reviewers for PRs.

July 28, 2020

What have we been working on?
Integration tests running on CI jobs
Add response timeout min/max limits to the config file (https://github.com/projectcontour/contour/pull/2741)
Migration from Google groups to https://lists.cncf.io/g/cncf-contour-users

July 21, 2020
What have we been working on?
[jonas] Contour now has a Passing CII Badge: https://bestpractices.coreinfrastructure.org/projects/4141
[stevek] consistent timeout syntax across HTTPProxy and config file, and internal refactoring
[slokas] go-control-plane: Tests pass!
[youngnick] Adding Conditions to HTTPProxy: https://github.com/projectcontour/contour/blob/master/design/httpproxy-status-conditions.md
[robinfoe] OIDC support for external authorization. Proof of Concept Demo!
[youngnick] Contour’s Landscape, July 2020: https://projectcontour.io/contours-landscape-jul-2020/

July 14, 2020

What have we been working on?
[stevek] finalizing initial set of configurable timeouts
[slokas] removed all IngressRoute bits
[glerchundi] TCP Proxy Bugs
[jonas] Contour Office Hours

July 7, 2020

What have we been working on?
CNCF TOC Accepts Contour as Incubating Project!!
https://www.cncf.io/announcement/2020/07/07/toc-accepts-contour-as-incubating-project/

Envoy Security Release: Contour v1.6.1
Envoy v1.15.0
Proposals
External Auth Design
Proxy Status Conditions
Configurable timeouts

June 23, 2020

What have we been working on?
Introducing Steve Kriss to the team
(stevesloka) Ingress Class for Kubernetes v1 Ingress Spec: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
(stevesloka) Replace XDS Server with go-control-plane
(skriss) Bug fix for issue where some routes would be dropped if they had overlapping header conditions with another route
(skriss) Added some more validations for header conditions (disallow conflicting exact+notexact, contains+notcontains)
(stevesloka) Envoy Security Release v1.14.3

June 16, 2020

What have we been working on?
Security releases
Envoy 1.14.2 has been released with a security fix.
We will release a 1.5.1 with this upgrade.
If there are any releases shortly after Contour 1.6 is released, then we will consider releasing a 1.5.2, on a case-by-case basis. If that is you, please ask.
IngressRoute removal - IngressRoute will be completely removed in Contour 1.6.
ir2proxy is available for your conversion needs. Please log issues if you find them.
ir2proxy v1.1 was recently released with TCP Proxy support.
Removing the IngressRoute code will allow us to make updates to the general CRD handling code without needing to support two code paths.
Interest in Helm Chart, we have contributors interested already, if you are also interested, please contact us in the Slack channel or look at this issues.
Please check our roadmap: https://github.com/projectcontour/community/blob/master/ROADMAP.md
This is not set in stone, but is a rough outline. We’ll keep it updated as we can.

June 9, 2020

What have we been working on?

[m2] We are planning to completely remove IngressRoute from Contour 1.6. Voice your concerns now :)
ir2proxy is available for your conversion needs. Please log issues if you find them.
ir2proxy v1.1 was recently released with TCP Proxy support.
Removing the IngressRoute code will allow us to make updates to the general CRD handling code without needing to support two code paths.
Roadmap update
[stevesloka] Security releases of Envoy 1.12.4, 1.13.2 and 1.14.2 are now available

May 26, 2020


What have we been working on?
(@youngnick) Updating HTTPProxy addresses
(@jpeach) xDS certificate rotation #2143
Contour Release v1.5

Issue Discussion

Image Pull Policy (Examples)

May 19, 2020

What have we been working on?

@youngnick - Address Status Updates for HTTPProxy:
#2371
At some point, we’ve introduced a race #2522
@jpeach - xDS certificate rotation. @tsaarni did the underlying work, so plumbing it through the deployment and tooling. Will be easy for operators to replace certgen with cert-manager. Certificate rotation support makes the secret format transition possible.
#2538 certgen doesn’t have enough RBAC permissions to update secrets
#2537 Stop using ImagePullPolicy of Always
#2524 Update deployment to use rotatable bootstrap config
#2494 Certgen should generate secrets that are compatible with cert-manager
@stevesloka - “ingress/v1” ingressClassName

Contour 1.5 release
Currently scheduled for the 29th May, PDT.

If you have landed a change that needs to be discussed in the release notes, the draft is available and can be updated now.

Issue discussion

#2483 Are we all agreed that we are going to take a Lua dependency for 1.5? (note that taking this dependency does not imply we will give the ability to configure arbitrary Lua filters)

May 12, 2020

What have we been working on?

Status Updates
Status Design
ExternalDNS
ExternalDNS w/HTTPPRoxy
Fallback Cert Updates
Design Update
PR #1 Impl
Repository Updates
API
Examples
Envoy bootsrap for xDS cert rotation update
PR updated after round of reviews, added test case

Issue discussion
Contour YAML Wrangling
Kustomize Draft PR
[Venki] SNI not being passed through: https://github.com/projectcontour/contour/issues/2517

May 5, 2020

What have we been working on?

Bugs in 1.4:
2481, fixed in 2482
2483
New GitHub label schema
Issue discussion
2495 Richer status

Contributor Shoutouts
2480 thanks @savithruml

Demo/Presentations

Kubernetes VMware User Group meeting: Contour/Gimbal in on-Premise environments (Thursday 5/7/20 @ 11am PST)

April 28, 2020

What have we been working on?

New release!
https://projectcontour.io/client-cert-auth-ingress-improvements/
https://github.com/projectcontour/contour/releases/tag/v1.4.0

External Auth
https://github.com/projectcontour/contour/issues/2459

April 21, 2020

What have we been working on?

Fallback Certificate Design #2428
SNI for clusters #2442
Timeout settings #2225 #2247
Contour Donation to CNCF

April 14, 2020

What have we been working on?

Upgrade Envoy go-control-plane #2432 @stevesloka
Upgrade Envoy v1.14.1 #2434 @stevesloka
Improve diagnostics for Secrets errors #2422 @jpeach
Updates to annotations docs for new ingress-class behaviour #2420 @youngnick
External client certificate authentication feature concluded #2390 #2410 #2250 @tsaarni
Work in progress: support for Envoy xDS certificate rotation by bootstrap config change #2333 @tsaarni

Contour donation to CNCF update

Issue discussion

The separation of metrics and health serving has been merged and will be available in Contour 1.4, due for release in two weeks time.

April 7, 2020

What have we been working on?
Nick as new tech lead
Contour 1.3.0
What’s up for 1.4.0?
Contour Donation to CNCF

Issue discussion
403 - Ingress status

March 17, 2020

What have we been working on?
@davecheney Ingress status updates
@tsaarni and @jpeach TLS Certificate and SNI changes
TLS does not do authentication or authorization
There is a difficulty when you add authentication or authorization
There is work behind the scenes to ensure that when we add client certificate authentication it does not have a security problem.
@michmike CNCF donation update
Building the collateral for the governance and other details
@michmike will coordinate getting the calendaring sorted out.

Issue discussion
https://github.com/projectcontour/contour/issues/2323
Ingress annotations
https://github.com/projectcontour/contour/issues/2325
External services
https://github.com/projectcontour/contour/issues/1269

March 10, 2020

What have we been working on?
e2e testing suite coming soon from @jpeach
@stevesloka working on some changes to how clusters are built
knative
healthchecks w/multiple upstreams
rate limiting work in upstream envoy
https://github.com/envoyproxy/ratelimit
docs work!
Great place to help contribute! (https://projectcontour.io/docs/v1.2.1/httpproxy/)
@stevesloka looking into some Gimbal work around connecting clusters
upstream multi-cluster proposal: https://docs.google.com/document/d/1hFtp8X7dzVS-JbfA5xuPvI_DNISctEbJSorFnY-nz6o/edit#heading=h.u7jfy9wqpd2b
@tsaarni working with external client cert auth and trial of using cert-manager for xDS cert rotation
https://github.com/projectcontour/contour/pull/2250
https://github.com/projectcontour/contour/compare/master...Nordix:cert-manager (just a PoC at this point - requires fork of Envoy and Contour)

Other business
@stevesloka on Bret Fischer show Thursday, 1pm EST (https://www.youtube.com/channel/UC0NErq0RhP51iXx64ZmyVfg)
[jonas] Fixing the community page with updated times after DST change
@tsaarni Potential new feature: secure backend connection with client certificate for Envoy https://docs.google.com/presentation/d/1i37kHBcLfGLO8et77gS7gDWqwDLfqTC52WWC44OrfxI/edit?usp=sharing

March 3, 2020

What have we been working on?
Contour releases
Contour 1.2.0 released
hot-reload of certificates for Contour, thanks @tsaarni
Envoy shutdown manager, thanks @stevesloka
blog post
Contour 1.2.1 released
upgrade Envoy to 1.13.1 to fix CVE, no code changes
Envoy 1.13.1 announcment
@m2
CNCF donation
No updates, sig-networking is reviewing the proposal
Next step is @m2 completing a form for sig-networking
@youngnick
service-apis “support” is in master. Only logging for now.
Contour watches for new objects and logs their presence
Tracking spec evolution upstream; will use for an experimental test bed

Public board bug triage
#2264
Original connect timeout value is arbitrary
OK to tune, but want to be based on evidence
@youngnick to follow up with reporter to gather more information
#1691
Needs decision on whether to accept this as an issue

February 18, 2020
What have we been working on?
-------------------------------
Contour releases
Contour 1.2.0 due this friday
Envoy 1.13.0 support
Upgrade to client-go 1.17, It does have compatibility implications
service.protocol schema validation
tcpproxy healthcheck support
certgen job YAML improvements
Contour automatically reloads SSL certificate for xDS
shortlog of changes since v1.1.0
@m2
CNCF donation
@youngnick
Ingress V1 graduation PR
IngressV2 types investigation repo
Contour switched to dynamic client for CRD types
experimental support for Service APIs type will land early in the Contour 1.3 cycle.

Other business
---------------
automatic XDS/gRPC certificate rotation, background material
@tsaarni, how’s it going?
Support for Contour to reload its certificate is merged: https://github.com/projectcontour/contour/pull/2198.
Documentation is still not covered https://github.com/projectcontour/contour/issues/2229.
Design proposal for Envoy https://github.com/envoyproxy/envoy/issues/9359: it now seems clear what kind of solution is acceptable to enable the proposal in the “background material” slide.
@stevesloka
Contour Code Overview: https://twitter.com/projectcontour/status/1229793584175513600

What’s coming up?
-------------------
Contour 1.2.1 coming March 3rd for Envoy CVE, (1.2.1 milestone)

No description provided.

No description provided.

No description provided.

No description provided.

No description provided.

No description provided.

Our first Contour Community Meeting of 2019!

In this meeting we go over what's new in the next release, spent a great deal of time on the road towards 1.0 and what's needed there, and answered questions from the community.

For more information about these community meetings, head on over to https://projectcontour.io/community