►
From YouTube: Contour Community Meeting - March 10, 2020
Description
March 10, 2020
What have we been working on?
e2e testing suite coming soon from @jpeach
@stevesloka working on some changes to how clusters are built
knative
healthchecks w/multiple upstreams
rate limiting work in upstream envoy
https://github.com/envoyproxy/ratelimit
docs work!
Great place to help contribute! (https://projectcontour.io/docs/v1.2.1/httpproxy/)
@stevesloka looking into some Gimbal work around connecting clusters
upstream multi-cluster proposal: https://docs.google.com/document/d/1hFtp8X7dzVS-JbfA5xuPvI_DNISctEbJSorFnY-nz6o/edit#heading=h.u7jfy9wqpd2b
@tsaarni working with external client cert auth and trial of using cert-manager for xDS cert rotation
https://github.com/projectcontour/contour/pull/2250
https://github.com/projectcontour/contour/compare/master...Nordix:cert-manager (just a PoC at this point - requires fork of Envoy and Contour)
Other business
@stevesloka on Bret Fischer show Thursday, 1pm EST (https://www.youtube.com/channel/UC0NErq0RhP51iXx64ZmyVfg)
[jonas] Fixing the community page with updated times after DST change
@tsaarni Potential new feature: secure backend connection with client certificate for Envoy https://docs.google.com/presentation/d/1i37kHBcLfGLO8et77gS7gDWqwDLfqTC52WWC44OrfxI/edit?usp=sharing
A
Hello
and
welcome
to
this
week's
episode
of
the
contour
community
meeting
today
is
March
10th
2020
and
we're
going
to
talk
about
what
would
we
would?
We
have
been
working
with
in
the
contour
project
and
yeah
talk
about
the
future
so
with
that
I'm
gonna
share
the
hack
MD
that
we
use
for
meeting
notes.
If
you
have
anything
that
you
would
like
to
add
in
it,
please
do
so.
If
you
have
any
discussion
topics
or
anything
you
want
to
talk
about,
please
add
those
in
there
and
I'm
gonna
share
my
screen
as
well.
A
B
So
unfortunately,
James
isn't
here,
I
think
he's
asleep
right
now
over
in
Australia,
but
so
there's
a
new
testing
suite
that
James
has
been
working
on,
which
is
pretty
cool,
so
whenever
a
new
version
of
envoy
comes
out
or
if
we
want
to
validate
what
extensions,
maybe
contour
needs
or
doesn't
need
in
that
envoy
build
it's
difficult
to
do
that
today
right,
so
we
didn't
up
spinning
up
a
cluster
and
just
running
things
by
hand
which
isn't
very
scientific.
So
we
want
to
do
this
in
a
better
way.
B
B
The
second
thing
here
is
so
I'm
working
on
this
idea
of
we've
have
some
things
with
with
the
Canada
folks,
as
well
as
other
users
that
have
reported
this.
And
basically,
if
you
have
multiple
up
streams,
say
in
an
HTTP
proxy,
what
one
is
you
had
is
the
health
checks.
So
if
you
have
say
you
know
two
different
services
that
you're
sending
traffic
to
and
say
you
have
active
health
checks
on
them
on
envoy
and
say:
one
of
the
upstreams
goes
away
completely.
B
It
just
gets
totally
destroyed
envoy
will
detect
that
there's
no
healthy
end
points
in
there
and
it
removes
them
all
from
the
cluster
and
envoy.
But
the
problem
is:
is
that
one
we
will
still
route
traffic
to
that
cluster
right?
What
doesn't
make
any
sense,
so
I've
chatted
with
the
folks
upstream,
that's
just
kind
of
how
it
works
today.
So
we
looking
at
one
way
around
solving
that
the
second
poem
we
had
was
some
cañedo
folks.
They
want
to
use
contour
as
the
ingress
controller,
4k
native
and
then
their
testing
suite.
B
B
So
you
know
we
have
CVS
and
envoy,
and
today
contour
will
match
a
service
in
kubernetes
to
a
cluster
in
envoy
and
then,
when
you
switch
that
configuration
in
your
proxy
or
ingress
object,
whatever
one
you're
using
contourable,
then
or
envoy
contour
will
send
that
change
down
to
envoy
and
then
I'll
go
will
consume
that
and
then
the
change
will
happen.
The
problem
is,
it
can
happen,
there's
a
timing
issue
of
when
all
that
information
can
get
passed
down
to
envoy.
B
So
one
thing
I'm
looking
at
solving
this
is:
is
that
having
multiple
clusters
per
service
having
a
cluster
per
route
and
then
what
we
can
do
is
then
just
swap
the
endpoints
inside
that
one
cluster.
So
hopefully
this
might
solve
both
of
these
different
issues
here
again,
just
something:
that's
kind
of
happening
that
there's
some
issues
open
on
it,
but
other
than
that.
You
wouldn't
know
that
these
are
happening.
Any
questions
out
there
on
any
of
this.
B
So
if
you
want
to
actually
do
rate
limiting
and
envoy,
this
is
what
the
left
team
uses,
how
this
gets
set
up
in
terms
of
how
envoy
configures
any
kind
of
services
you
set
up
your
service,
and
you
have
a
GRE,
PC
connection
that
talks
from
envoy
to
this
external
service.
And
then,
when
request
comes
in
when
you
configured
it
envoy,
will
then
pass
that
request
off
to
this
back-end
service
and
say:
hey
you
basically
thumbs
up
or
thumbs
down.
So
this
is
on
or
lifts
implementation
of
the
rate-limiting
service.
B
It
wasn't
the
lift
organization
it
just.
We
did
recently
just
moved
it
to
the
Envoy
proxy
org
and
then
I
just
bumped
it
up
to
using
go
modules
and
stuff.
So
that's
all
up
to
date
now-
and
so
next
thing
I
want
to
do
is-
is
make
this,
have
a
public
docker
image.
So
once
we
have
that
and
we'll
be
able
to
actually
reference
it
from
contour,
so
get
nothing
really
contour
specific,
but
just
helping
in
the
upstream
community
that
eventually
will
help
out
the
contour
community
as
well.
B
I
think
in
this
this
is
how
you
configure
their
service.
So
you
see
how
it
has
the
unit
is
second,
so
this
is
I.
Think
setting
up
a
setting
of
500
seconds
is
their
is
their
limit,
so
it'll
it'll
yeah,
so
you
can
make
that
minutes
or
hours
or
whatever,
and
then
you
can
kind
of
combine
these
things
together.
So
you
can
pick
apart
the
the
request
and
stuff
and
have
it
look
at
I
think
this
one's
yeah.
B
If
you
go
up
a
little
bit
there
Jonas
there's
a
yeah
right
there
in
the
middle
here
this
one.
It
has
like
a
key
in
a
you.
There's
different
ways
that
you
can
have
the
rate-limiting
service
react
to
how
the
requests
are
coming
across
you
does
it
have
a
specific
header
in
the
request
or
have
certain
things
on
it.
B
So
we
can
do
one
sweet
one
sweet
so
again,
I
have
a
design
proposal
to
update
from
the
original
one
because
of
the
reason
one
was
built
again
against
ingress
route.
So
I
think
you
know
Nick
and
I
and
James
are
looking
at
that.
Once
we
have
that
done,
then
it's
a
matter
of
just
plugging
in
the
bits
and
pieces
to
make
this
functional
so
yeah.
So
this
doesn't
require
that
we
have
to
use
this.
This
implementation,
that's
the
kind
of
the
cool
part
about
envoy.
B
You
just
have
to
fulfill
that
got
the
contract
on
the
on
the
other
end
of
the
G
RPC
connection
that
you
know
under
what
get
configure
to,
but
this
one
is
one
that
you
know:
--left
uses
in
production
and
I
think
it's
probably
fine,
but
if
you
had
your
own,
you
could
build
your
own.
This
does
use
a
Redis
database,
so
that
may
or
may
not
I'm
excited
or
scared
folks,
depending
on
how
you
feel
about
managing
your
Redis
database,
everybody's
cash.
B
B
The
next
place
is
I
know
we
talked
about
this
before
and
I'll
make
really
done
a
whole
lot
yet,
but
if
folks
are
looking
to
get
help,
get
contribute
back
and
do
some
things.
This
is
our
one
of
our
kind
of
sore
spots.
We
feel
that
we
could
make
better.
So
this
is
our
HTTP
proxy
CRD
reference
and
it
goes
through
all
the
different
features
and
functionality
of
how
this
proxy
works
in
the
different.
You
know
things
on
that
on
that
resource,
but
it's
one
big
giant
page,
it's
not
as
it's
hard
to
like.
B
B
A
C
B
Think
it
should
really
change
it
because
whenever
so,
basically,
like
I,
said
today,
when
we
have
a
service
in
kubernetes,
we
mirror
that
with
a
service
and
a
cluster
and
envoy,
so
a
cuvette
a
service
to
a
cluster
and
envoy.
What
we're
looking
to
doing
now
is
having
a
route
and
envoy
match
a
cluster
in
I'm,
sorry,
a
route
in
kubernetes
or
in
that
your
recent,
your
ingress
resource
mapping
to
a
cluster
in
envoy.
So
basically,
then
what
you'll
have
is,
when
you
have
multiple
up
streams.
B
You'll
just
have
a
set
of
end
points
in
EDS,
which
is
the
end
point
system
in
envoy,
so
you
have
a
cluster
like
incurably
IDs,
which
matches
a
service,
and
you
have
endpoints
which
make
up
that
that
cluster.
So,
ideally,
ideally,
this
dish
is
not
gonna
affect
that
memory
issue,
because
we're
only
gonna
be
swapping
endpoints
in
and
out
of
EDS.
C
B
B
Oh
yeah,
it's
the
docks
are
good
place
again
if
you're
looking
for
things
to
do
is
outside
of
things
as
well.
Folks,
okay
I
want
to
work
on
something
I,
don't
know
where
to
start.
We
could
probably
go
find
some
things
too.
If,
if
I
something
code
would
be
interesting
as
well,
it's
always
fun
to
have
folks.
You
know,
contribute
things
back
so,
but
don't
be
scared,
I,
guess
we're
here
to
help,
if
you,
if
you,
if
you're
interested
I'm
happy
to
help
find
them
things,
you.
B
Alright,
let's
go
through
your
proposal
here
Steve,
so
this
isn't
my
proposal.
This
is
so
we've
done.
Some
talking
about
gimbal,
so
folks
aren't
familiar
with
gimbal.
Gimbal
is
kind
of
like
a
set
of
discoverers
that
go
and
look
for
end
points
in
an
upstream
cluster.
So
today
contour
can
route.
You
know
two
end
points
within
a
single
cluster
and
what
gimbal
does
is
lets
you.
Drought
two
end
points
across
multiple
clusters
so
and
how
it
works.
Today.
Is
you
can
route
to
kubernetes
clusters?
B
You
can
route
to
OpenStack
clusters
and
I
have
to
finish
the
PR
you
can
route
to
these
secret
clusters
as
well
or
VMs
running
on
these
four
clusters.
So
idea
is
that
you
replace
like
a
load
balancer
with
a
kubernetes
cluster
and
that
cluster
then
acts
as
like
a
load
balancer
on
your
network.
So
you
have
it
go,
discover
all
the
endpoints
that
exist
these
different
upstream
clusters.
B
You
can
figure
routing
to
send
traffic
to
different
clusters,
so
you
could
do
you
know
Bluegreen
deployments
from
cluster
a
to
cluster
B
or
failover
traffic
from
you
know,
one
cluster
to
another,
or
just
simply,
maybe
add
in
endpoints
that
maybe
never
be
containerized.
You
know
like
I,
used
to
work
at
a
large
health
place
and
there
are
some
applications
that
just
will
never
come
off
of
a
VM
or
never
come
off
of
where
they
live
today.
Right,
they'll,
just
always
be
there.
So
gimble
gives
you
the
ability
to
route
to
that.
B
The
one
limitation,
though
gimble
today,
is
that
all
those
end
points
need
to
be
routable.
So
in
the
case
of
kubernetes,
that
upstream
cluster
has
to
have
a
routable
end
point
for
every
pod
right
and
there's
ways
to
do
this
and
okay
Calico
has
a
bgp
method.
Aws
there
CNI
will
give
you
a
route
about
pot
IP,
but
there's
some
some
drawbacks
to
doing
that.
Right.
There's
expensive!
B
Now
you've
got
to
deal
with
all
these
different
IP
sets
in
your
bigger
network
architecture,
and
not
everyone
does
it
so
looking
at
some
ways
to
maybe
have
the
idea
of
gimble
work,
but
not
have
to
have
that
limitation
or
that
requirement
of
these
routable
IP
addresses.
So
in
some
work
that
I
was
looking
at
doing.
I
found
this
from
the
sig
multi
cluster
teamed
and
they
have
some
ideas
that
are
similar
as
well.
B
That
are
just
interesting
to
read
through
a
few,
if
you're
all
interested
so
I
haven't
fully
finished
all
of
this,
but
the
idea
is
they
have
a
couple
CDs
that
they're
building,
which
act
as
meta
endpoints.
That
tell
you,
when
you
want
to
expose
certain
things
to
this
multi
cluster
idea
and
then
once
they
have
it
exposed
and
they
can
use
those
seer
to
use
to
them,
tie
things
together.
The
way
that
gimble
wants
to
do
it.
Sort
of
so
does
that.
B
And
the
ones
I
come
up
if
this
I
guess
where
we
are
with
that
is.
If
this
looks
like
a
good
place,
then
you
know
what,
if
I,
try
and
contribute
back
to
that
or
if,
if
there's
some
design
ideas
that
we
can
help
with
that,
then
I'm
gonna
help
but
they're
otherwise
might
have
a
new
design.
We
implement
to
help
yeah.
D
I
mean
we
talked
on
this
Steve
right,
so
definitely
this
is
important
for
us.
I
think
the
general
idea
of
what
we're
trying
to
accomplish
here,
jives
with
with
that
community
document.
So
it
definitely
there's
there's
a
level
of
interest
here
so
I'll.
Let
you
kind
of
guide
us
from
the
technical
standpoint
of
what
the
best
solution
is
for
contouring
Timberland
and
couldn't
start
working
towards
that.
B
A
B
So
this
one
I
think
this
specifically
is
with
the
cig
multi
cluster,
so
it
live
in
a
cig.
Org
much
like
the
service
api's
live
in
a
you
know.
It's
like
you,
have
the
comm,
/
kubernetes
cig,
slash
whatever
it's
called
yeah,
so
yeah,
it's
not
it's
not
owned
by
a
company
or
anything.
This
is
just
the
the
kubernetes
itself,
I'm
sick.
It's
like
an
ecosystem.
B
A
B
Are
the
ideas
that
here
like
with
this
fit
gimbal
and
should
like
you
know,
gimbal
go
away
and
this
become
you
know
what
gimbal
is
in
a
sense
or
are
there
things
that
we
can?
You
know
pull
from
this
to
then
help
help
gimble's
Gimple
story
out
because
they're
you
know
this
I
haven't
read
through
it
fully
all
the
way.
I
know
before
this.
B
This
this
thing
was
looking
at
making
a
lot
of
the
applications
be
deployable
across
clusters,
not
so
much
routing
them
together,
where
gimbal
was
more
of
like,
let's
connect
the
thing
together,
the
end
points
so
we'll
have
to
see
you
know
what
this
ends
up.
Being
this
game
is
the
proposal.
I
know
there
are
some
links
to
into
the
service
API
work
as
well
that
they're
doing
so.
There's
some
commonalities
to
know.
We
can
leverage
for
this
a
lot
as
well,
I
think
them
I
think.
D
From
my
viewpoint,
one
of
the
you
know
two
main
scenarios
that
this
enables
is
the
first
one
is
obviously
being
able
to
route
pods
and
communicate
across
clusters.
So
if
you
have
a
service
that
split
across
multiple
clusters,
either
4dr
or
for
data
locality
or
for
any
other
reason,
that's
super
priority.
Zero
scenario,
the
other
priority,
0
scenario
and
I-
think
that's
can
unfold
over
the
next.
You
know:
X
amount
of
months
years
is
a
fact
that
this
can
be
a
whole
cluster
of
hybrid
services.
D
There's
this
up
modernization
that's
happening
on
existing
apps,
and
some
of
them
are
on
VMs.
Today
some
of
them
are
on
pyramidal
and
eventually
some
of
those
and
I'm
not
going
to
be
able
to
come
to
containers.
So,
whether
that's
you
know
the
sphere
clusters
or
hyper-v
clusters,
or
even
bare
metal
or
apps,
are
running
in
VMs
in
public
cloud
providers.
D
They're
gonna
need
to
be
part
of
a
bigger
set
of
applications
and
need
to
communicate
with
it
and
I
think
the
cluster
model
and
sort
of
the
gimbal
model
and
how
you
the
mostly
last
time
at
cubic
on
Steve.
It
has
a
lot
of
value
because
it's
allowing
it
to
have
routable
services,
no
matter
where
they're
deployed
and
and
I
think
that's
that's
a
priority.
Zero
priority.
One
scenario
as
well
and
more
and
more
companies
are
gonna
encounter
that
because
they're
gonna
realize
that
he
come
modernize
everything
you
can
put
everything
in
a
container.
B
Yeah
sure,
also
just
with
the
the
idea
of
having
lots
of
multiple
having
lots
of
small
clusters
looking
out
in
the
world,
you
know
the
more
of
those
you
have,
the
more
complexity
you
have
in
terms
of
getting
traffic
to
them.
So
it
can
be
a
good
place
there
as
well
to
help
manage
that
that
that
problem
of
having
lots
of
clusters.
E
E
E
Been
doing
yeah
so,
firstly,
I've
been
working
with
this
PR
for
client
certificate
on
education,
for
the
external
client,
and
this
is
progressing
I.
Have
a
review
comment,
so
this
is
now
going
to
the
second
round
of
free
with
reviewers
and
same
is
nothing
providing
good
feedback
for
me?
So
there's
no,
no
blockers
at
this
point
and.
E
Yeah
yeah
this
is
this-
is
really
really
about
having
external
client
presenting
a
client
certificate
for
any
wave
and
connecting
to
any
way
and
any
way
then
validates
the
client
certificate
according
to
given
CA
certificate,
and
this
changes
the
HTTP
proxy
a
bit,
there
will
be
a
new
field
for
providing
the
client
certificate
or
or
a
master
secret
later.
What
client
started
with
it's
a
CA
certificate
secretly
to
see
a
certificate
and
HTTP
proxy
and
then
point
to
that
and
a
cut-in
enables
the
validation.
E
E
D
E
D
And
as
soon
as
you
complete
this
one
I
know,
I
know
what
your
next
task
is.
So
that's
the
the
other
one
right.
The
client,
authentication,
client
certificate,
Whittingham,
went
off
streams
and
all
that
that's
important
to
you.
So,
but
let's
get
this
one
through
and
then
we
can.
You
know
start
looking
into
that
couple
of
issues
and
PR
that
you
are
looking
into
yeah.
E
I
was
experimenting
with
this
this
one
today
it
is.
This
is
a
trial.
I
was.
It
is
related
to
the
certificate
rotation
for
the
XDS
connection
or
data,
the
RPC
connection,
and
we
now
have
the
Autry
loading
in
control
and
the
reloading
of
certificate
in
any
way
is
PR
that
I'm
unlocking
a
reviewer
currently
there.
E
This
know
what
what
you
are
seeing
here.
I
just
made
a
sort
of
trial
by
by
creating
a
couple
of
TCR
diaspora
CR
for
for
certificate
manager,
so
that
it
would
create
a
CI
within
that
wicked,
monitor
itself,
that
is
here,
10
me
10
years
and
and
then
the
second
part
here
it.
It
creates
two
certificates,
one
for
contour
and
one
for
annoy
and
deities
are
than
issued
by
certificate
manager
and
stored
in
secrets.
And
then
then
I
I
had
a
trial.
E
Deployment
manifested
in
having
in
in
contour
repository
in
examples
render
and
why
modified
so
that
it
monster
only
only
that
contours,
irritant,
invoice,
alert
secrets
and
there
is
no
supported,
see
a
secret
anymore,
because
the
CA
certificate
is
stored
by
facilitated
management
in
the
same
secret.
So
I
deleted
those
extra
months
with
this
customized
more
parts
and
modified
the
start
of
parameters
for
contouring
and
invoice,
but
it
picks
up
those
those
yeah
exactly
the
other.
So
so
it
picks
up.
E
Does
the
desert
weekend
no
mean
in
the
same
/
search
spot,
because
there
is
only
only
the
single
mount
point
anymore,
and
this
this
seem
to
work
with
this
private
version
of
my
PI
I
built,
so
I
can
have
a
certificate
manager,
then
rotate
the
briefs
robbery
to
certificates
automatically
as
fast
as
I
want
and
and
both
Condor
and
and
and
we
will
pick
up
a
certificate
and
I'm
unable
to
see
that
in
waters
arc
that
they
they.
If
I
trigger
a
new
connection,
establishment
for
xdx
connection,
they
will
use
the
new
certificates
after
rotation.
E
That
was
just
a
trial.
Today,
I
was
wondering-
maybe
maybe
this
could
be
something
that
could
be
made
made
us
a
blog
post
or
something
when
there
is
more
like
texts
around
this
or
I
I.
Don't
know
what
what
do
you
feel?
How
would
it
be
good
to
tell
people
how
to
how
to
use
certificates
manager
for
19
days,
XD
s-sorry,
so.
D
I
think
I
think
that
once
you
complete
this
work,
it'd
be
great
to
actually
put
it
in
the
official
documentation
of
contour
I.
Think
that's
the
right
place,
so
maybe
drafting
you
know
creating
a
PR
against
the
website.
Underdogs
and
talking
about
you,
know
the
principles
of
you
know.
What's
the
best
practice
here
and
and
and
how
to
do.
This
will
be
a
great
value.
D
C
D
A
B
Am
I
up
yeah,
oh
yeah,
yes,
yeah
Thursday.
We
talked
about
this
before,
but
I'm
gonna
be
on
the
the
Bret
Fisher
show
at
1:00
p.m.
Eastern.
So
if
you
all
want
to
put
me
on
the
spot
and
ask
you
crazy
questions,
do
it
it's
live.
It's
a
lot
of
YouTube
show
so
it'll
be
fun,
so
just
throw
it
out
there
in
case
you
want
to
hear
more
about
contour
yeah.
A
A
C
Oh
Jonas,
sorry,
you
asked
about
the
daylight
savings
time
in
black
earlier.
It's
April
5th
is
when
Australian
Eastern
shifts
back
one
hour
back,
so
we
just
I'm
sorry
yeah
when
they
shift
an
hour
back
that
right.
No,
they
shift
an
hour
forward.
Sorry,
they
move
to
daylight
savings
time.
We
moved
off
of
daylight
savings
time,
so
yeah,
okay,
so
yeah
in
writing,
because
my
my
brain
is
a
little
much
right,
yeah
all
right,
but
it's
April
5th.
So
it's
not
quite
another
month.
Okay,
so
we
need.
C
E
E
B
E
But
the
other
I
think
that
did
this.
This
would
what
we
don't
they
we
did
discussed
about
this
a
little
yesterday
and
and
it's
something
that
would
would
put
need
of
obviously
a
design
document
that
which
we
drinkin
and
so
I
can
prepare,
do
to
flesh
out
the
ideas
of
it,
and
we
can
then
discuss
it
further.
B
E
B
B
Yeah
yeah,
you
right
so
yeah
I
think
an
issue
just
just
describe
the
overall.
You
know
problem
what
you
want
to
solve
think
this
is.
This
is
excellent.
So
thank
you
for
putting
this
together.
Even
this
picture
of
you
great
to
put
in
the
issue
and
then
yeah,
then
we
can
talk
about
a
design,
doc
and
figure
out
how
to
best
make
this
all
work
and
fit.
B
A
A
As
we
talked
about
in
the
community
meeting
last
week,
we're
gonna
run
community
meetings
in
the
Australia
time
zone
on
the
first
and
third
Tuesday
of
every
month
and
we'll
run
them
in
the
Americas
time
zone
on
every
second
and
fourth
Tuesday
of
the
month
and,
as
I
said
before,
we'll
make
sure
that
that's
updated
on
the
community
page
shortly
here
and
with
that.
Thank
you
all
for
joining
and
have
a
fantastic
rest
of
your
week.
Yeah
take
care
well.