VMware Contour Community Meetings, 17 Mar 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Contour Community Meeting - March 17, 2020

Description

March 17, 2020

What have we been working on?
@davecheney Ingress status updates
@tsaarni and @jpeach TLS Certificate and SNI changes
TLS does not do authentication or authorization
There is a difficulty when you add authentication or authorization
There is work behind the scenes to ensure that when we add client certificate authentication it does not have a security problem.
@michmike CNCF donation update
Building the collateral for the governance and other details
@michmike will coordinate getting the calendaring sorted out.

Issue discussion
https://github.com/projectcontour/contour/issues/2323
Ingress annotations
https://github.com/projectcontour/contour/issues/2325
External services
https://github.com/projectcontour/contour/issues/1269

A

For the coordination, this is the culture community call for March, seventeenth, twenty twenty calls being recorded, as always, so please follow our code of conduct. Now I would like to get started with the what we've been working on lately. I am just got a little bit the way this morning or so I'm, just in the process of typing up some things for us, some of the things that I can remember um gay. Would you be able to talk through what you would would you been working on lost? Well, please, let.

B

Me just let me just turn that off that's probably a bad joke.

B

What I've been working on this month is the long-awaited ingress status update, which is on the ingress field. There is status and my bouncer, which is used by external DNS, so that when you're in Reverse object is claimed- and this is only the hazing dress- we're not doing this for I'm type supported by contour use that bar any great controller hit right back.

B

It writes back to the actual status field prior process, which can mostly be approximated as magic, the IP address or hostname that its externally accessible this powers, things like good, DNS and other things that just assume that this data is useful and it's been something that people wanted for a long time. So I've made it my project to get this done for 1.3.

A

That's it excellent thanks very much so yeah I think the most important part about that, for everybody is that that that we know the ingress is managed by contour will be able to be useful for external DNS, amongst other things that need that status field. We're also going to take some cues from this work has also done some foundational work to set up getting finally getting HTTP proxy status running in as well.

A

So next up the other thing, that's the other. Anything major thing that two people been working on is there's been a lot of work going on around TLS handling.

A

Tarot, sunny from from Finland has he's, obviously not here today, because it's a very own, you can make your turn for it, but the he has done some great work on bringing a whole bunch more tearless config into contour, and he is in the process of adding he's looking at adding certificate off to the front door of control so that clients, clients, will you it will be possible to ask a contour to ensure that that clients must apply a certificate in order to be able to get to a a particular special host.

A

There is an outstanding the way that we have done contract until now also has a does have a security issue in the event that we turn this feature on, and that's that once you have authenticated to the once, you finish the TLS session for any any virtual host. You can. If your your HTTP host header, says a different virtual host, then you will get the config content for that. That's just yeah completely things to Dave.

B

You said a word there, which is probably little bit scary to people so I want to give yes very clear guidance about what what what is going on and why. This is not an issue at the moment, very, very heyo.

C

Our committee meeting is.

D

B

Know that I.

C

Thought communities at 6:30 Eastern, that's the other week. No, that's what the website says.

A

Ok, the the I think the calendar that we had the calendar and mother we had is now yeah.

C

You had the old calendar, invite says every second Tuesday at 6:30 p.m. Eastern, okay,.

B

C

B

This is tablet, this is the other Tuesday, not that one yeah.

C

That is this in the morning, though,.

B

A

Yeah so anyway, I said obviously say I'm gonna put on here that we are working on the calendar in issues yeah and and we'll we.

A

That we, what I want to do, is have that. There's there will be a canonical single place where you get your calendaring from and at that point I will send an announcement to the contour announce list and we all answer on all the things telling you to please delete. All of your existing community meeting invites and you get the ones from the central sauce. I am sorry about this.

C

A

Okay, so and sorry, there is another thing that there is another step that I missed in my eagerness to you know and talk about what we were actually doing and that's a intros for incase.

A

If everybody who has been here before my name is Nick Young I am the tech lead on Couture and I will hand over to Dave. Yes,.

B

Sorry, um so, just to just to come back to what Nick was speaking about earlier um TLS, as in when you connect to HD case and website, does not provide you two things. It does not provide your authentication and it does not provide you with authorize authorization. The indication is, Who am I that is not provided by TLS authorization is what am I allowed to do, which requires you to know who you are to start with, but it's also not provided by TLS. So, in the current scenario, a set of a.

B

Web server, which presents for a bunch of TLS, enabled virtual hosts the sni negotiation, which is, which is what I'd like to negotiate with, and the host header that you send once you've initiated. That connection are independent and in fact the s and I certificate is also. If you request a certificate, you don't want or is not signed correctly. It is on the client to decide whether it likes that or not this.

B

This in no way affects the security of the affects the privacy of the data being transmitted over that connection, of course, unless of course, they're sniffing it, you negotiate, negotiate against, has been compromised. My said, or something like that. So um if you want to get the details, this is known as the main fronting, which is basically I'll. Give you a really good example: you go to any any website hosted by CloudFlare the users TLS. They will offer a bunch of different s. Nice.If Achatz, they'll, negotiate against.

B

You can offer any one of those get a valid certificate, set up your layer, seven connection and then send the host request for anything else. This this is. This is no different from you know, different from hate which to be painting on encrypted HTTP. If you, if you consider you contour on port 80, you send it a host request, if yeah, if we have a route for that, we send it back to you.

B

So the the difficulty comes when we want to add authentication and authorization on top of the scheme you someone can spawn if they have the yes.

B

I'm, just pausing, because I want to limit my comments here, because it could be very long. The short, the short answer is that we have to do somewhere behind things to change the way the contour sets up assigns virtual hosts to TLS hosts in a way so that when someone is using certificate authentication on the client, they are actually only those virtual hosts that we came through that certificate are accessible behind there. And, yes, that's this website, although I suspect a participant will be confusing.

B

This is a very nuanced topic, because, most of the most the ways that we interact with this as users, it just seems to work and it's actually a potpourri of different standards that all work together by an entity so house, that's confusing.

A

Thanks Dave, could we maybe I think 11 Michael? Is that clear at all? Is there anything that you need to anything more? You need to know about that Peter as well. Frank.

A

Okay, no problems; okay, well, I'm, so yeah, so that that work is ongoing on. You may have seen some discussion in the channel about the order in which we're gonna learn.

E

A

And so the whole point here is that just that we want to make sure that a no point do we deliver a even a master cut image, docker image that has a problem like this, that people where people might get bitten without knowing it. So yes, the, and so we will organize all this stuff, but they keep. The key takeaway here is that client certificate authentication is coming and yeah. Hopefully it will be delivered soon now, currently on github for the 1.3 release date.

A

Is this Friday we'll be pushing that back until next Friday to try and capture these changes and Dave's English status updates and possibly as well? I have been working on some backend changes as well. That will make doing some doing some further work with the servus api's easier, as well, mostly back in Suffolk now so I think so again, I'm very sorry about the confusion with the toning. As you can tell we've, this calendar eating needs working out time zones. A hard calendars are hard.

A

When you cross mix meetings, time zones and calendars, it gets really hard. So yes, I apologize to that and I will sort it out as soon as we can and does anyone else have anything that they would like to talk about.

A

A

So the last thing that I wanted to destination was the as a core maintainer team. At the moment we are, we are using as n approaches in issues and I will put a link to two Zen hub in the show notes, and so please have a look at that too, and you able to see get a bit bit of a better idea of how far out the we are currently planning for things to be.

A

Perhaps the last thing Michael, we had a little update on where the weather donation process is that.

C

Absolutely so we are were basically creating all the collateral. Stevie's actor who is sick right now is is finishing up their the matrix of competition and that the thing is one of the last ones left I will send you guys the governance and the maintainer for contoured tonight, so you can actually view it. I'm, actually gonna PR it directly into the community point, and you know you guys can basically iterate on that alright, like having that discussion in PR is probably going to be a little bit weird Dave, the I'll.

C

You know you guys will see the the the both governance and the maintainer ziz kind of very similar to what we've done with other projects like harbor.

C

Essentially, the way we'll work is we're going to open it up so that contributing companies that want to come in and both influence contour, as well as influenced our ability to move forward. Every company would get one vote in voting decisions from a governance standpoint so and I'm not gonna, put an upper limit on the number of maintain errs, but usually most projects kind of manage that themselves.

C

Just give me a basically, it's almost can be a direct copy of what we're doing with hardboard, since who kind of battle-tested that before no governance model is perfect, it's all about the community and how people interact with each other and how they work with each other and I. Think. That's that's really the most important thing.

C

Once we actually get the rest of the documents out and the competition then signal working is going to basically initiate the reviews. The TOC today did not really meet properly. They had the discussion around artifacts and repositories. So there was no discussion around when next steps are for some of the projects are waiting in the pipeline. I think they're gonna postpone that to the first meeting of April.

A

Yes, sir I see hi Micaiah, I'm, sorry about the confusion about the calendaring today again, yes, the meeting started at the wrong time because some of us said the wrong time enacted calendars, um so we actually are pretty much getting to the end of our getting to the end of our agenda.

A

Does again I'll just make one final call for all the other business I. Think yes, most of the most of the most of the stuff is, is still in progress on the service. Api work is ongoing. The and yeah as I said the other stuff that we mentioned already ongoing. There's.

C

Probably a couple of issues that you can discuss just to because other folks might join us later. So what.

E

C

So I can bring a couple of things to the table: Michael pain, you're traveling. When you were in India last week, I think now, you're in Australia I mean are you're doing a global tour. Yeah.

D

I just met in Australia, it's be crazy, but everything is calling to complain locked in here. So I probably know that you going to be able to see my father who I came to see, which is quite ridiculous. Okay,.

C

Wow, alright, so so the first thing I want to discuss is I'm. Gonna put it here on slack is there was an issue on the Kentucky hub that one of the community members brought this issue, 23 23 so and that's around you know what do we do as a project in terms of support, features and functionality around regular ingress and when we get requests like this, what do you want?

C

Our or post modus operandi will be, and as well as our response and and and kind of at the high level, I wanted to say that it depends because every situation is going to be different and we're gonna evaluate every request on its merits. In this case, the request is around supporting sticky sessions by regular ingress.

C

Do you guys want to take a minute to read through the ticket, so everybody brings it into their cache.

B

What people talking um it's important to remember that contour, under the hood doesn't use any of the ingress objects that we talked about like these are just notation mechanisms. The first thing we do in Contra immediately is we do sugar into our own data structure, so supporting a feature in a particular CID or communities resource is a question of methylation.

B

The reason why many features not available in being real object.

C

You have to do it's very notation, so you'd interrupt to you're coming in a little bit. Robotic I, don't know if it's just for me or everybody else as well.

A

Yeah, it's really an Internet can suck. Sometimes so it's just you, you was having.

E

A little issue, a.

A

E

A little bit harder dive, okay,.

A

So yeah I think I. Think Dave's point is fair, though the you the reason. The reason that we don't have like all the annotations is that you try not to add functionality on the contour until people ask for it.

B

Well, the reason, the reason that these things are not available he posted communities best- is that they are only possible via annotations, which are disgusting. Yes, I've I can read it the bottom there about my two ways: we can implement this feature. Neither of them are perfect so that, if that is why we're not really we in the past we've not really prior to post engineering effort towards it because well, there are better ways to do things.

E

C

I guess my two I'm.

E

Gonna have two cents on that on this one: I I'm, not if I, don't have her fully on board with this approach, because I feel like if you, when you add things piecemeal like in this way, to ingress your ways it you're, always in this uncanny valley, state right. You always in this state where some things are supported in some through some api's and some things I'm not and I. Think that makes it I think that makes the whole API surface area unpredictable and that feels like an uncomfortable place to be. It's.

B

It's also useful, fortunately, for me to encourage people to not use old shity ingress, be what feel a big one, which is terrible. It has all the problems, which is why we, we created ingress, ingress, router and HTTP proxy right, which would be into.

E

Deliberate forcing function right and that that would be a reason to just say: no, we don't, we don't add we're not going to add arbitrary, bespoke arbitrary project, contour, specific and functionality to ingress.

A

So, in this case, in this case, the the reason why I'm leaning towards towards doing it is that the I agree I understand what you're saying and I do agree that it's not ideal to have ingress.

A

You have sort of a subset of the features of available and other things, but the fact is, the ingress document, as dave says, is just not capable of expressing some things and even the annotations that we required to do over like unwieldy and not great, and so in this case, though, there are people who have a genuine need for this functionality and they cannot use HTTP proxy for other reasons and so yeah. That means the only way that we can help them is to do that.

A

The you I know I personally, don't feel comfortable about saying to people. We could do that, but we're not going to because you we want you to use hatchapee proxy, you you know I mean. Perhaps we can spend some more time with the with people who are asking for annotations on interest. So why can't you use HTTP proxy, but I?

A

Think the you I don't think that we should be, although in general, I'm in favor of being like pretty pure about like what we implement, what we don't like, we already have a bunch of annotations on the ingress object. You I think, and this one the only reason I said the only reason that I felt that this one was okay was because it's not a large amount of work to it said it's about D sugaring. The annotation only is the work.

B

E

Ahead, I think sorry.

B

One other thing to consider is is what happens in the future? Ingress v1 would be replaced by ingress v2. Are we committing to maintain sanitation soup forever.

C

I mean it's true: I, don't know if we're gonna make yes commit to maintain this annotation sue, but you're committing to supporting grizzly to write so whatever English we two supports. Let's.

A

Be, let's be clear: Ingres v2 is actually a very bad name. It is not going to be in gross v2, it will never deprecated the ingress. Where you want object. The ingress b1 object is going to be G a it will be G a for the foreseeable future is the ingress of the like G, a object will be available and will be will be useful for the foreseeable future. The service API objects, which is one of the reasons why we change the name.

A

They are intended to be an adjunct to a supplement for use cases that aren't well fitted to the existing. These ingress object.

E

So I have no problem with supporting arbitrary features through the ingress API. My concern is that we make with those features. My concern is when those features are chosen on an ad-hoc basis.

E

Right, if we do everything through all the API is in that that that's consistent and and predictable, and that's fine, but but when some things are, and some things aren't I I feel like I want to have some underlying rationale, for you know, selecting those and being able to predict which features are going to be available.

A

So I think the yeah I understand what you're saying I mean there are. There are things that are just incapable of being put onto some of the api's, and so you between that and the fact that developer bandwidth is limited. We haven't focused on backporting all the features to ingress yeah, because right now there's you we have been waiting for people to say: I need this feature before we would consider it. You know, in the interests of ensuring that we don't spend it all the time working on something that people don't need you that's.

A

That is my feeling on. The rationale is that we don't spend developer time on things that people aren't going to eat. I. Think sorry, I'm, not sure. If your interest is it I'm. Sorry, it's.

F

Pincus yeah, because sorry yeah I, am just to give some perspective. You know showing the user, you know just as a user one. One of the issues we have is. If we open things up, when we start supporting, you know we started out with English route. We have not enabled HTTP HTTP proxy for the for the reason to this underlying reasoning. Right, we have a bunch of users who are writing these objects, and we cannot carry you know now.

F

We will forever for perpetuity need to support multiple, multiple types now HTTP proxy on top of English Road, because they were going to be sitting all over the place.

A

You follow one third yeah yeah, we don't yeah yeah. So one of the reasons we're aware we didn't make the decision to deprecated English wrote lightly, but the, but we found that there as we started to try and add features to ingress route, to do things like being able to make routing decisions based on non path functionality.

A

We just found that there were significant issues with the design, and so that was why we, that was why we've got HTTP proxy, was to change the model model from delegation to inclusion and so because, because we needed to do that, the way the way that we decided to help with that sort of situation is that, on the I mean English read is deprecated. It will be removed from the product at some point in the future and the idea there is to give you a forcing function for your users to say at some point.

A

You know this is going to go away. The second prong of that attack is to ensure that there is a way for your users to migrate from English route to HTTP proxy, and to that end, we provided a tool IR to proxy that you can run over an ingress route that will convert it to the equivalent HTTP proxy for for you or your users.

D

Hey it's it's Michael here, yes, another end user, I've, I've, actually I'm very close to deploying internally a web vote r2 to proxy, so I've managed to it's very ugly, but it sort of works. So it's just something we'll run on our kostos. That will allow our developers to cut and paste their stuff into it, just a web page and get the output in a web page and then. Secondly, you know just our plan from because we've got a bunch of ingress route. We have roughly half ingress route, half h-e-b proxy at the moment.

D

It's an issue for us as well, but we just plan on getting aggressive and turning off ingress router and we're actually going to block it through open. So we're gonna send out email, email notification to our X thousands of developers, so we're gonna turn this off on this date. Here's the tool convert and then I'll enforce open block the creation of you ingress and delete all the old ingress. That's we're taking a pretty heavy innit approach, but otherwise is carry too much debt through so.

A

The last I guess the last. The last problem that you look to there is that we intended that one of the reasons that we changed, the name rather than changing your version- was to make it easier to do our back to be able to enforce people not being able to create new ones. So you know you can give you can take people's role that allows them to create ingress crowd, objects away and only give them hash. Typically, that will mean that they have to migrate.

A

You know, as Michael says it's a pretty heavy-handed approach, but we want, and we wanted to live it up to you as the users as to how you did it so the yeah and so the idea, the idea there HT proxy supports a superset of English route functionality. So all of the functionality that was present in I believe is now present in HTTP proxy. So you should any any syntactically correct. English that you can write should be able to be should be able to be converted to HTTP proxy.

A

Now there are because of the changes in the way that we did inclusion delegation.

A

There are some situations where that automated tool- just can't guess what you mean, in which case the tool, will actually tell you a better can't guess what you mean and indicate to you the bits that you need to change, and so that's what that was sort of our plan for English were out on I know that, and we certainly don't want to do that again, and so we won't be duplicating a proxy for the physical feature, any further additions, HIV properties, now everyone it's and we will be new- that that has a support T that we will not perform any destructive operations to it.

A

There are additions to it. There will be additive only.

E

A

That your existing HP pro proxy Oh guess what keep working and the yeah and we won't- and we won't be taking that away anytime soon, whereas we add the service IPOs objects, though, as Dave said, they will be added as you as additional options for configuring things, and so they will again will have options for, for you doing doing slightly different use cases and having a come in in a slightly different way.

A

So yeah I guess thank you for asking that question, because it's once some of those I've kind of wanted to address for a while, I haven't had the great forum, I'm Michael. If there's any, if there's any way, then you can contribute back the website thing that you've got there. Then I certainly be interested to see it. If you can't totally understand that's fine but yeah, and because if you, if you would like something like that, then feel free, please log issues in the IATA proxy repo.

A

It's github.com, slash, project, contour, / ir to proxy I'll, put it in the show notes as well and yeah. And yes, so, please, like.

D

Using my might, I might be able to share it, but it's also pretty horrific pack very ugly. So if you want you to polish it over well yeah.

A

Yeah sure sure, if you want to, if you want to just give it to us and we'll clean it up and make it available there as a separate mode, then if that makes it easier for people, then I don't see. You know that, especially if you've done my sniffle work at least to get it started sure but yeah so um because please also get feel free to engage with us if you need any assistance with either proxy or any other things around.

A

That, and the last thing that I should mention in relation to this sort of versioning discussion is that the thing that I have been working on the backend change is actually to make it so that so I'll look up the github issue in a minute it's to make it so that the contour will talk to the API server at startup and detect what C IDs are available in the cluster.

A

So if you don't want people to be able to write English routes, once you have removed all the English routes from your cluster, you will be able to just delete that CID and then contour will detect that it's not there and won't look for it anymore and won't watch for it right now.

A

If you try and do that contourable, it will spam your logs with a lot of error messages saying that I can't you know, I can't look I can't find anything any types of ingress, egress route, but this this functionality will make it so that that's a lot more dynamic.

D

Okay, so hang on just let me play that back, so you haven't, we do this deprecation and we tell people were turning it off. We shut up make sure that we remove the the.

A

Old CID yeah once once these features delivered, which hopefully will be in 1.3 and yes, then it will be dead. It will mean that currently as well there's a there's, a experimental flagged will enable you to look at the service api's once I've delivers. This feature I'll be able to remove that, because if you don't have the service api is in your cluster, then contour and look at them, and so now, if you want to experiment with them, then you pull the service. Api was in your cluster.

A

If you don't, and so it's the same with english. Well, the idea is that you know there is a. There is a hard way to ensure that there can be no ingress routes in your cluster by simply not installing the city cid or removing it James. You I mean okay,.

D

And then just just one thing, I was going to say the reason why we're using ogre to do this is because we've got this like highly sort of granularly, granular isolation, around namespaces and so doing. Pasta white stuff with our back is possible for us, but it's actually a fair bit of work when we can consider all of their different environments.

D

A

D

A

E

A

Okay, sorry I thought you were I'm meeting to say them: okay, Oh, welcome. Welcome to a new prisoner, Aaron I believe that's background by the way yep. Thank you. The.

D

Rooms on our team cool. Thank you.

C

Alright, so so, or look I guess kind of to to do, but on this issue up, it looks like you know: there's lots of arguments to be made both for and against it, given the fact that there's a real need here from at least some of our users to to be able to utilize some of the ingress capabilities, like this sticky supports and compounded by the fact that this is a relatively low amount of work.

C

I think would prioritize it and deliver it sometime in near future, because I can really provide real dates, but we'll add it to our backlog and and see if we can work on it and and include out there in terms of next steps. I think that, for this discussion, I'm wondering I want to basically put another ticket and I want.

C

Since now we have a significant number of community members here, and this is something that we've discussed last week, some some of the folks that were on the call and I put this together and give everybody a couple of minutes to review this ticket 2325. This is a ticket that Nick kind of surfaced around. There's lots of requests around exposing specific capabilities of envoy without all capabilities, access, log, service and rate limiting, which I believe is something that one one of our guys is looking at right now.

C

I want you guys to go through this and read it and we'll have to hear some of your thoughts and feedback on this.

C

Let's give everybody a cover to silently read.

C

A

Wait um I just made some updates to the to the notes, just with some of the links to these things for posterity. Oh, you.

C

A

C

Poster notes lingers while in the chat, because I think people that join late don't get to see the old chat, link, yeah sure.

A

So yes, as the person who log this issue, yeah I just wanted to explain a little bit about it. So the the idea here is: we have a few I request. Currently that's written in the ticket for what for what amount to please can please expose this functionality in one way that lets all the way talk to a third service.

A

The there's no right now, there's no way for contour to do anything other than take whatever you give us and pass it on void and that the concerns that I have are around.

A

You know what happens when a an application developer configures something like this, and then it is not working, so their service could be broken and they will have no way to know anything about whether or not it's something to do with contour that has broken their service. So I, don't that's one of the reasons that I push back pretty hard on a lot of these requests is that I really feel as as contour is the thing that is taking the configuration and pushing it onward.

A

Contour should have some way that a conservative information about if that config is working or not so the the things that I've suggested there are that, firstly, if we add the functionality to contour to allow it to health check on work classes, that's as you that's what envoy calls the back in pull. You know old school on Delta terms. If we have a way for contour to be able to check the status of a given on void cluster.

A

By talking to on where somehow exact details TVD, then we can, because everything in envoy is a cluster, including when you configure things like external or flogging or read, limiting each one of those will generate a cluster inside on boyscome configuration, and so then we can use the we can use that.

A

If we can help check any cluster, then we can use the health check of that to be able to get the information that we then can surface to to the people who are actually asking for things with these features enabled so the my my end idea is that the end state I want here is that HTTP proxy will have status conditions.

A

That will tell you that, for example, you have the HTTP proxy you have configured has rate-limiting enabled and the the rate limit is the rate limit service is working as far as the envoys are concerned. That's the sort of the MVP for this functionality.

A

Obviously, once we have it, I would guess that we can extend it in other ways, but I think that the at least the minimal amount of information we should be able to give for all of these things which covers both the main was I'm thinking about other external or Thea's case and the and the read limiting use case that if you are creating HTTP proxy, that uses one of those services, you should be only determined by looking only at that HTTP proxy. If the service is up and running and doing what you would expect.

C

And and kind of looking at this from a from a micro level, this is a super important change for us to make because it enabled us to build for the future as more and more things are coming to an voi I think you know in conjunction some of the other tickets that we talked about in the past around the status object. I think this is a super important thing for us to deliver in the near future, but we'd love to hear everyone's feedback and comments on that like seeing how this may impact you.

D

Well, Michael, here from JP Morgan again, so one of the things we've been looking at because it's related to a couple of issues we have in the contour repo one of them, which is the fall back, fall back suits for the clients that don't support us and I. So, okay, in our case, it's the upstream f5 big IP, dns box.

D

We've got all sorts of issues there because it doesn't talk SMI, but um we're also thinking about it like a delegated health checking capability and so m'boy has like a partially implemented health discovery service, that's sort of there, but not sort of well documented.

D

It sounds like it may be smaller to this, but the idea is that, rather than add that you know pretty crappy f5 box, doing struggling on the board of all the health checking is to try and delegate it somehow down to down to contour and we're thinking some more thing with Clare firmware. It appeals, but so yeah. It sounds like I'm interested in that capability as well.

B

What I think Nick is talking about here is currently, there are three: there are four participants in this equation: the end user, with the browser, the application developer, the cottage administrator and the development team on this call, those those are the counterparties. So if something breaks, one of those bodies fault when when when we introduced a rate living service or an external external authentication service or anything which is and now another component, which is outside the bounds of that the question becomes, what broke, how do I know and who knows and who can be?

B

Who do we escalate to so, for example, if you're an application developer and all of a sudden, the pages starts going off because your service isn't working. You need the current equation. Who are you going to talk to? You can talk to your cluster administrator there's. Nobody else you can. The cluster administrator is going to either try and figure out themselves they're going to escalate it to us.

B

There needs to be a way that, if the reason that your application is not available is because some Active Directory server fell over or some external rate learning services decided you're out of tickets, we need a way to communicate that back to the application developer, so they can solve their own problem.

A

Things like that, that is exactly what I'm saying yeah.

D

B

So it is I think that the technicalities how we've made this our resentment and how the the figuring out of what went wrong is crucial, but they think the key is. We need a mechanism to give that back to the application developers, so they can solve their own their own problems.

A

Exactly so, I guess could I ask any other end users on the call what I think I.

G

Agree with the fact sorry, this pivot here I agree with the fact that we should have one spot. You know if we're creating something and it fails under the hood. That should be one point to understand the status of anything that's dependent underneath.

B

So to speak, to that directly, like we already tell you in a very crude way, your head shoe proxy object is valid or invalid, but what, when there are now external services involved, your object can be valid, but your traffic doesn't work. Why is that? Well, because the global rate limit to the administered, if you think of it you in, are they aware of its just decided? Sorry, sorry, you don't get a request today. How do we communicate that back to the end-user? So they understand? What's it's?

B

It's so I shouldn't say the end-user, those with browsers the application developer, the person who owns the application? um How do we communicate their back? um There are really kind of two options. There is status on the object or there's the community sites, but the the the key question has to be answered in adding any of these. This class to the feature is how can a failure eating that? How can a failure or like a software heart failure in their feet should be communicated directly back to the application developers who are impacted?

B

G

Have you cut out their on your second way of doing it? The first was status of the object. What was the other that you mentioned? Kubernetes.

B

A

Yeah, the the kubernetes events I think, are suboptimal solution because a lot of people don't know they're there, those who do them that often and they have a virtual lifetime, but.

B

Again, this is the implementation detail. The key yeah block.

A

B

Are any of these features is the question of how can I tell the application developer when this thing is broken?.

A

D

You know with the right limiting while I know the initial implementation and the right limiter was that that lifts weight, aluminum, which is ringing, go and leverages rhiness and sort of runs outside of the proxy I know. Steve sloka has been now contributing to that, because I think they moved that underneath the in boy avoid proxy organization and give up.

D

But you know having having deployed that just in tests there's a whole bunch of interesting sort of things to consider about where that rate limited leaves in conjunction to the invoice like I put them across the clustering. Just that network traffic at high at high rates, the G RPC would start failing so I'm, not going back towards a sort of two pond cheering UNIX domain socket and like that it works fantastically, but otherwise it's pretty tough and then so. There's tons of issues there Dave I, agree in terms there.

D

How does that work and is it stable and then? Lastly, they've added local, like rake the mini danboy based on I, think like a ticket counting type scenarios that doesn't have external dependencies and maybe that's where you should look for initial rate, limiting support without that external dependency. So.

E

Michael, if I understand Envoy correctly, it hits the rate limit on every request right.

D

You know I divert sister here the documentation for that James I think he can do with the local one. Now I think you can do like rap based local rate, limiting I, don't think it's a global! So there's two modes now, if there's like global external and I, think rap.

E

But if you have global, if you have global external ailee's, I looked at the proteins, it's just should it. The proto is just.

E

Is this request rate limited it doesn't ID I didn't see a proto that like lets, you check out a a bundle of requests tickets or ask for a ask to be able to serve more than one request. Yeah.

D

I think the global external one is like that. Yes, it's just a might this level or not. Okay,.

H

E

It gives no information.

F

H

How much quota is left or when it resets or anything like that, that accurate, no.

E

It does it gives you how much quota is left, but that that's only you.

H

Can only do one at a time yep yeah.

E

That's only the quarter, lift is only informative, because you can report that back up to clients and maybe smash my client would. But you can't it kind of force on that, because you don't know how many.

A

E

Are in your cluster yeah.

A

Yeah, so so this is some of the problems that I feel are sort of. You I think a lot of people want one class of requests that I have noticed since coming to work on contour is envoy. Has this envoy has this knob? Please give us this knob, and it's one of the things that I wanted to make clear with this ticket as well?

A

Is that you I've also recently added a philosophy document contour that sort of tries to make clear how we feel about and how we work, with the with the multiplicity of options that hallways and the thing that's sort of most appropriate here is that we try not to give a no, unless there's a real reason to give a knob like.

A

If there's a default is suitable for most people, then we, then we will give them and also just say that devote for everybody and you the case of an early case, so that I worked on that. That word did not have.

A

This was the ability to do to send logs to have envoy log invited Jason instead of wire, its own plain text format, and so there was no way for us to to do that to configure that in the default way, because a lot of the people who have who allow Jason wanted there to be some configure some configurability as well, and that was why we added the coffee file to do that. But that was a last resort.

A

I'm, sorry in in the same, in the same case here you know the external auth and the rate limiting there's a lot of bits to configure and there's a lot of configuration there there's a lot of like configuration space to explore to understand like what most people are going to need, what some people are going to need and what everyone's going to need, and so, as your product developers, we want to make sure that we're that we're meeting the needs of as many people as possible in a way that is going to make it easy for the most people all right.

A

So that's one of those is why we want to be so considerate about doing this stuff.

A

Okay, well, um I Michael did you have any other issues? You would like to talk about. No.

C

Those were the two biggest things: I want to bring up and kind of get gage the community and see what everybody wanted.

C

If we go about our original starting time, we still have half an hour, but if you go by the start time, we really start at this meeting or how about four minutes and like Nick mentioned we'll fix the times in everyone's calendar. But we have a couple more minutes. Is there anything else anybody wants to discuss.

C

If any of you have not provided testimonial, since it's probably one of our biggest community meetings in a while, if anybody has not provided testimonial into how you're using contour would love to hear from you there's a issue, that's pinned under the contour oppose or if you go to issues the first one is pinned up there love to hear for you, you don't have to mention your company name, if you don't have to, if you're, if you can't disclose anything, that's also okay, we love the fact that you guys are here. Yes,.

A

Absolutely I'm sorry I'm just just pulling up that easily now so I can drop it into the.

A

A

As well I'll add some more color around the issue, discussion that we just had in the notes. So does anyone else have anything else before to ensure.

F

No one's asking I'll take the floor. Just a clarification on the on the on the authorization is the goal to move I mean. Let me just phrase it this way. Until now, I mean I, guess application developers word would push the authorization back into their app into their container and they would you know the the request would come in you just get to token or whatever it is match against it and come back right. So it's further up.

F

The stack is the goal here to move it to move back so that it happens so that it's configured within between Tom between contour and envoy and there's no need to go all the way out and then use some sort of call to some centralized place. Yes,.

A

So that's that's what the the envoy has envoy actually has a filter, an external or filter that allows you to configure envoy to say you know to do various types of authentication, whether its basic or I, think it even supports like more event stuff, like Eurydice and a similar sort of flow protocols as well, and so the the idea there is you people ask them. Definitely a lot of people have asked for that. That issue is sort of one of our highest voted watched tickets and yeah. As I said.

A

There's a lot of you know, sort of it's very easy to do that. To do that. To do that feature, you know in a half assed kind of way that would make it really difficult to use, and that would make it difficult for both the most both the cluster operator and the application developer. And so that's what we wanted. People considered.

A

We want to make sure that this feature is, you know, is useful for everybody and doesn't build anybody like a support nightmare by sort of creating something where something can be broken and no one knows until the web sites and.

F

This would be, and it would be our thing RZ.

A

Both yes also I mean DUP. The idea is that you know envoy sort of delegates delegates that off to another thing, and then it's up to that thing, whether or not it yes sure.

F

Yeah I mean again: I can see how useful that would be just.

A

F

Judging by the fact that you have apps that look, okay and and then the egress doesn't work for some reason, so the requests come in, they don't get authorized right and then you don't get any. We quit all the requests are returning for threes or something right. So.

A

Yeah yeah exactly and that's the exact sort of experience that we want to avoid that. You know, because you know that the experience I want to avoid it. Is you I'm, an application, developer, I've config, that you know that my cluster operators have asked me to do I've configured my HP proxy, and you know it has external off you whether exactly how that's ended up there whatever, but you but I, don't actually know anything about how the external wharf works, but all of a sudden nobody can get in it's for three is everywhere.

A

You know what I do you know and so that the idea is that you should be able to just be like what's up with my HTTP proxy, get page TP proxy, whether or not you do that with a command line or with an automated tool or whatever, and then inside that HTTP proxy.

A

There will be a status thing that proves you what the new what is going on, and so, if you are, if you are monitoring that HTTP proxy, you can use that for a loading or something like that or you know you know in the the idea here is that this status, this status information will be added in a machine possible kind of way as well.

A

So it's useful that if you're just using command line- or you can machine positive, if that's what you want to and it'll be done, income in accordance with the sort of the broader community say: PR convergence as well, so it's possible with the standard libraries as well. Hopefully, yeah.

F

A

Be great yeah sure.

F

A

F

Would tell you whether the service is available versus its the individual requests failed because it's not as the rice free exactly.

A

Yeah yeah, it's the biggest yet right. That's usually the issue yeah yeah.

F

E

A

E

A

I'm saying that's the sort of the Minimum Viable information that I feel is necessary is if you have a rate limit, or are you or an external orth configured you know? Is it do you have it configured? Is it has it been configured successfully and then is the service that you're depending on actually working? Has it failed if it's failed as it fell open as it fell closed you know, all of those things are things that you, as an application developer need to be able to get access to it. That's.

F

What idea is to bubble it up into the status, so you have.

A

This thing looking.

F

Together, yeah.

A

So that's the idea so that then it just costs like two hops of communication out in here whether there is a problem, yeah, absolutely great.

A

I guess if no one else has anything else, then we'll probably call the meeting done here. I profoundly apologize again for the calendaring problems, and so please watch the slack, Channel and I'm, not even I'm, not sure, if we'll be able to send anything out by the announce on this one. But please watch our communications channels and what I would anticipate that soon. We will say: please delete all meetings from your calendar and subscribe to this calendar and that will be the canonical location to get the meetings from I'm.

C

Sorry, thank you have a good rest of your day wherever you are thank.

A