VMware Contour Community Meetings, 26 May 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Contour Community Meeting - May 26, 2020

Description

May 26, 2020

What have we been working on?
(@youngnick) Updating HTTPProxy addresses
(@jpeach) xDS certificate rotation #2143
Contour Release v1.5

Issue Discussion

Image Pull Policy (Examples)

A

One I'm rollin and welcome to this week's contour community meeting today is May 26th 2020 I'm gonna talk about what we've been working on and go through some issue discussions, and if you have anything that you would like to add as well to the discussions or to the status updates, please do so in the hack and eat that I'm linking there and yeah. If you have any questions, just speak up throughout the thread and I'm gonna share my screen, so you all can see.

A

B

A

Go share my screen and shared all right, so Steve, I'm gonna. Let you start here so.

C

Yeah, so I was just given it a little update on and work that Nick's been doing cynic, so contour updates status in two places. Now so one place is in any HTTP proxy. There's a status stands at the bottom of that. So, if you could invalid status or valid status whatever that is contourable update that what we're adding as well is we added in 1.4 ability to update the ingress or the load balancer status, so it information elite, a create a service type load.

C

Balancer would flow into the ingress object and update that status field there. What Nick is adding as well to add this to the HTTP proxy resource so again, the same just like ingress you'll get that now in the RC already. The problem now is that we have two different places where we're updating status. So one isn't you know the valid invalid status of the CRT, as well as the new ingress status for the load balancer. So Nick is working to kind of revamp that work.

C

None of this really be visible to users, sort of all behind the scenes refactoring, but just one just to know that. That's coming, which is cool as well as once we have this, we'll, be able to send a PR to the external DNS project, so you be able to use external DNS with the HTTP proxy resource. So just an update on that and in Excel has just won these reviewed. I know: James security.

C

Take a look at it yet, but that'll become me, which is cool once we have this stuff, this work time and we'll be able to add more status information into there. We've kind of wanted to do all along some of the information about you know includes that sort of thing with the proxy resource. Once we have more information in that status, stands that don't be able to drive things like maybe an octant, plugin or other kind of ways to get information back to the user to make it make it easier to consume what.

A

Would that be conservative phase three of this or step three.

C

If you click on the the link down end on two three seven, one I think Nick outlined all the items in this: oh yeah, so there are James it I guess. Yeah.

C

So yeah so I think this is adding the ingress status and then the third part is to add the right now when you, when we build when Contra goes and looks at all the ingress resources, it builds up that diagonal that directed acyclic graph. What happens is today the output of that is a set of Status Messages. Let me set that, so we want to update that to I. Guess what you get today.

C

Is you only get one status message so like say, you had three areas with one resource: you'd get the first one in the status. You'd fix that and get the second one need to fix that you at the third one idea is that to get back return, a set of things, that's kind of a bigger, a bigger change to make that pop through, but yeah I think these are all the bits that James outlined for us, which is great.

A

Awesome, thank you. Yeah I think we have James on the phone here as well. Do you want to talk about the XTS certificate rotation.

D

So Terry who's in the call good morning. It did all the groundwork for this, so we have all the machinery in place in envoy and contour to be able to update and rotate the XTS certificate Els certificates online. So this is the certificate that is used to secure the XDS channel that Wade and Conti were configures on. Why so, this series of PRS is basically so that we can operationalize all of Tara's work, so I think we landed I. Look at that I have to check off a couple of hours.

D

We landed 22 you that I thought 2494, we've Leonard, and so the next step is to go through an update or we example llamo.

D

So, what's going to happen, is that, though we did condor 1.5 there'll, be a new version of the certificate generation job and in basically, everything is gonna flip over to reload all certificates as a side effect or kind of part of operationalizing. This change is that the format of those certificates secrets is going to change and they're going to be compatible with certain manager, so it'll be a drop-in replacement to change from using the search in generated certificates to using your own set manager, generated certificates.

A

Cool, do you need any any reviews or anything like that on any other issues? The PR is here I.

D

Think we're good. We have one issue which we're going to discuss, which is on the agenda for the usually discussion, which is the image pool policy. I will talk about that in a second.

A

Thank you, James Steve. You want to talk about the upcoming release.

C

Yeah so I linked in the the close PRS, so this week we're looking to release contort, 1.5 and there's a whole bunch of stuff in here. I think is a good mix of features as well. I was just internal restructuring that we've done so the big ones, I think, are the the fallback certificate work. So this is the case of Todd. Talk. I talked about this on a few different meetings now, but I think all the bits are now merged into there.

C

So the idea is that if you have a request, some one client doesn't support SNI, which is what we used to do: the routing for multiple host headers. If you have client is in past sni, then you can enable this fallback certificate which lets us still handle the requests, even if you didn't have SNI. So all the details are in there there's, you know the PRS all in there. The docks and everything should be should be all merged. By now, that's one of the big ones.

C

You go back to the list, I think the ingress stuff we fixed. There was an issue we mentioned about the ingress status. Updating there was a race condition, I think we'll have that fixed with his VR merging.

C

What else have we done.

C

Got a bunch of internal stuff, the the certain rotation stuff which James just talked about, which is great, so Thank, You Tara again for all that work, that's fantastic! To have that! You know coming into the project. I, don't know it's all in here. I feel like we'll get this all put together and a better set of release notes this week.

C

But these are all the PRS that match into that that release.

E

So should we have some kind of documentation, how's this be and now it's because it is kind of hidden in a way that there hasn't been that much documentation anywhere about about these XTS certificates. But how do you see how how to make this known by by the users I.

A

Think, yes, we should talk you it.

D

You're right so I think search in. We have a issue saying so we issue somewhere. That says we should document search in so this whole machinery is currently undocumented.

D

You're right, it needs to be, it needs to be documented it and we need to kind of talk better about the all the moving pieces here so that people know they exist, and so people know how they can.

D

You know put then replace their certificate generating machinery with their own, so I'm not sure that all the documentation will land before the 1.5 release, but we do have issues track middle. So it's kind of on my list, but I'm happy for people to help out with that too.

E

I was thinking, for example, somewhere about about using certain furniture.

E

Of course, that least that is something that and can then be ridden when, when we have a story to tell that how how to deploy it, the correct volume mounts and, and so on, with this compatibility changes that that you've worked with, but I haven't started any kind of article, but that that is like one perspective of that, but still of course, that there is that the other thing that people who have their own ways to issue certificates like proprietary systems, that to issue certificates, those those are, of course more interested in in their like the machinery underneath and how how it works and just to be aware that this capability exists there that this may be harder to fit into any any existing document that there is no.

E

Today, yes,.

D

Steve just got a link to a document which, in the index, is called enabling TLS between envoy and contour. So that's the document that kind of guides this machinery and yeah. So thanks Steve. If that we do have a place that we can update and put all these all this information.

C

And this in pieces- maybe you know, know, there's a couple different workflows, one is using the the Jen job was using certain manager, one. You know, and the moment you'd like to do it on your own.

E

Time that there is left before the release, would it be the most.

E

Somehow mentioned here in this document having some kind of chapter I could try to think and try to talk me to be. Are yeah.

C

E

C

I think, at least, if we outline that hey this, this function not exist now the rotations there, and then we can maybe it's a guide or something we can build out to do more more detailed. You know talks on how to do each different scenario. Yeah, but that'd be great yeah.

E

Yeah I think that them and trying to submit to be her cool.

D

Awesome I love that there's no he's particular rush before the release, so all the docs are actually built out of master anyway, so I'm, okay, if we don't land all this documentation, you know strictly any before the release we it'll it can come in afterwards. That's okay, too. You.

A

Know it should be covered in the in a blog post around the release or if you want to cover it a little more. If you want to wait until the docs are there and then we have a guide and then we can do a blog post about it as well. I'm gonna, walk, walk people through that.

A

But yeah Doc's first and then go from there.

A

All right anything else regarding 1.5 the planned release date for this is Friday. Is that correct, Steve.

C

Yeah I believe I'll be it'll, be out. I'll show you Thursday Australia Friday us yeah.

B

End of the month, it will be hot there and over than one thank you, I did Dave / Janice yeah.

A

Yeah, thank you my times. Those are all messed up right now. I think that would be Saturday Friday us fine know.

B

If I just fell yeah Thursday night, us okay,.

A

Okay, there we go yeah.

C

Yeah reverse that yeah, oh.

A

So wait time zones out of the way. Let's move into the issue discussion here about image policy actually.

B

Before we land on the issues, it's actually it might happen any minute now I know the person is working on it. Contour is gonna, go up for voting by the TOC literally in the next couple of minutes. It's been a long journey for us five months so start at the end of December, beginning of January, Michael I know you're you're you're very involved in the open source upstream, big community.

B

From from your work with the, since you have in the board, love to hear you know, +1 non-binding from you as well, and everybody else is using and contributing on on contours. So is big news for us. It's gonna, be a tremendous I, think to donate, to scene CF and have open governance and encourage more contributors to come and join our community and and take contoured to to bigger height. So love to see your support.

B

I'll go ahead, John, a syringe wrapped.

A

Now you get I'm gonna link to the pull request as well, so people can do a plus one there. So the image pull policy.

C

Yeah I can start it and then or James. Do you want to chat about it? Oh.

D

You, like sure.

C

Yeah, so the background of this is um so today we have this examples directory in contour, right and in the general idea behind it was that using that we would have this. This, like everyone's network and deployment, is sort of different, so the ideas that we had this examples, things that you could take that and and modify and make it work for your your environment. That said, because it lives on master, there's, not a version on it right, so it uses the the master tag.

C

So, every time a PR emerges to contour there's a job that runs and builds a new master image releases that so you can always use the head of contour if you'd like so in doing some work with some of the integration test that Jamie's been leading up, he needs a way to to pull that those images into like a test cluster locally right and the problem is that the because we were using master, which is a kind of ever-changing tag, every PR that that location moves.

C

We had the image pool policy of always so that anytime, you deleted the contour pod. It would always grab the latest version, but James is proposing that we remove that to make it, if not present. So the issue is on a kind cluster. If you side load that image in this functional test kind of scenario, you don't want to go out to the internet and pull an image, because you're gonna provide the image locally through the through the the testing infrastructure.

C

But if the tag is always that it's always going to try and go out and pull that image out from the internet, which can cause some unwanted behaviors in kind or in your test infrastructure.

D

C

Know kind of another related.

D

Issue, which is we actually we in the QuickStart which we ship as his project, contour io /, getting started QuickStart. You know something like that. We actually in this. We have a script which generates that yellow and for the last, maybe two or three releases. That script has just used said to change the image full policy to, if not present, but because it doesn't know about yellow objects, it does it unconditionally to everything.

D

So the quick start, yeah more, that we've actually shipped for the last few releases, has image policy, if not present, for all images, which is exactly what we want for the tagged images, I contour V, one point: four canto V V one point three, but it's wrong for the certain image which is latest.

C

Right and that's wrong because of the search in jobs, you can't reapply it if it's the using a tagged image, which is obvious.

B

C

For that image, yeah.

D

Yeah yep, so it is for as part of shipping the as far as shipping, the certificate rotation, the certain job. What I would like to do is to figure out how to generate a unique job name for every contour release, so that search in always runs when you install contour. um That way, every time you install you'll get a certificate rotation, which is a nice side effect, and it's also a point where we can leverage search in to update things in the installation.

D

So yeah, so the issue here is about I. Think the question here is: we have sort of two. We have two to two workflows. One is installing things through the Quick Start channel, which we ship and the other one is installing things through the raw examples from the master checking out master, and these two workflows have slightly conflicting requirements. I.

D

Don't really really see a way for us to get both of them right. At the same time,.

C

So, what's the problem, we can't just update the pool policy, so if we could fix that, that's what I'll go away or if we could do it for all the jobs, but but that's the generation job so.

D

I can fix kind, I can I can manage kind with our scripts and kind of make that work. That's cool I, don't know how to fix the this generate deployment, see. There's that said down the bottom Thanks. Is this your screen, Jonas thinking that said down at bottom I didn't have a way to get that right without using something like customized wait.

C

Okay I mean we can so if we use customize this would all go away. I could.

D

Make it go away customize because with customize we could change the image pole image pool policy, for we could change the image. We could have the correct image pool policy for some.

C

Of the things but not for, but not for others, sure sure yeah I mean my fear on changing this to be, if not president, just across the board and examples is that it uses the master tag, and it feels that you know they could folks would deploy that and they would just be stuck on whatever version that is. That said, I mean you probably shouldn't use master anyway in a real environment. It's because it's just you know not a released version, so yeah I think.

D

Your nightly like like when I'm using these when I'm you my workflow for this is I, would always use this on the fresh cluster. So normally, when I'm pulling master, it's because I have created a new cluster and I mean still in contour, so I'm getting I'm getting a master anyways, which is fine, but I can understand. The people might have different workflows.

C

To say I locally, I would deploy the examples and then I edit the image to be my my custom version that I build locally, but that's one place I edit I can edit two places too. If that's something in the world but and the other thing is that we use I, think we tagged the latest I'm tagged as always the the most recent release, which might be better for examples anyway.

C

So contour project, contour.

B

Contour tech latest.

C

You know might be a better one just and it would always be the the last release and then, if folks deployed this, they would get a release version instead of the master version and then, if they want the master, and they could always change it themselves, to do that. That.

D

Yeah I could be convinced that latest it's a better choice than master.

D

It's just what always Paul deal yeah you'd still I. Think if you, if you're still appointing people to this and pointed them to the latest and later sort of what still implies image policy, always sure.

C

It'll still try to pull yeah, but as long as in our workflows, we can change that, if not present, I. Think if you said, if not present, the latest overrides it so yeah.

D

I think um I'm, hoping we'll talk about we'll have some time next release to kind of talk a bit more about the customized thing and move this new tool, this yellow into something that we can all agree is like supported. Well an example, and then you know these kinds of questions would naturally resolve. As part of that you.

A

But just a quick question and question here: James the this PR is only for local development right. This is not for deployment no.

D

This is the same stuff, so this is this. This is the it's yeah, it's so awkward, because it's an example, but it's also the quick start. So it's the closest thing. We have to the official way to install contour. Okay.

A

D

This is the yeah Mille. This is the yellow that it's is linked to is published for they contour Quick Start. So when you just say, hey Quick, Start contour install this yellow. This is act.

C

So for 1.5, the least effort is someone just runs this and edits. The file directly and commits that is the release. Right fix is the one little product part that shouldn't be changed in the search engine.

C

Yes, I understand, that's lame and that's you know. I bet workaround. At least that gets us through this release in three days.

D

C

Then we can just say.

D

Yeah, you know like.

C

Customized I'm fine with customized I, just worry that if we don't keep that examples, folder it's just too unwieldy for folks to consume, there's just so much stuff, then, but again it's a different conversation. You can chat about yeah.

D

Yeah we could do it. We could do it by hand in the relays. Sign I didn't like that, because I'm trying to do less things by hand didn't release, but since we're so close to release I guess, hopefully we can just.

A

Issue, sorry is the issue here: the set command that you can't get right: yep, okay, so actually just some help with regular expressions and exclude some files.

D

Okay, yeah I. Certainly that could mean.

A

Just do I mean we're we're listing all the files here. If we had one specific file, we don't run this for all other files. We just run this.

D

Alright I'll make that change. Yeah.

A

But that should be an easy. If else, if you, if you need anything, let me know I'm happy to do all.

D

Right I can change you're right, I can change in there. I can just I can just check match them the phone over there and only change the and make sure that I change a different image policy for for the surgeon once yeah, okay, cool done.

D

A

Sure thing and yeah ping me: if you need any testing.

A

All right, I think that's it did you want to add anything else for the image policy here.

D

Nope I can do that. Workaround doesn't work. Fine. All.

A

Right yeah, so that's it for today's meeting as mike.

F

Is a good question before we close yeah I missed I missed last week, unfortunately, but I just wanted to go back on the lean Lua and that change owner James shaking me about that.

F

What was the outcome of that was the decision. I think I think your PR has been merged, so you can use lower to do that. Browser coalescing issue with s anion wildcards, yep,.

D

We're doing that today, so that's in that's going to be that's there for 1.5, so Louis. There adds any implementation detail high.

B

D

It's not exposed through the contour API in in any way. It's just that will will generate will generate TLS virtual hosts that make this check. Okay,.

F

And have you I'm not sure of the impact of lower on performance? Is that have you looked at that at all, in terms of? Is there any degradation on through portal performance by enabling the lower check, or should it be once it spins up? It should be quick. It.

D

Should be quick, I haven't done any benchmarking. I, don't have a good benchmarking rig. My experience is lower in the past. Is there it's pretty lightweight for pretty much anything except the most demanding sorts of use cases? Okay,.

F

And I ping doing arm slack James, just wondering if there's like an on little way to do this I know, there's been some chain recent trend just to end boy, but obviously the the upstream issue. An invoice is still open. So, yes,.

D

I think because it's an in because it's just an internal change, yeah they're thinking, is that you know when there is a if and when there is an on little way to do that. You know switch over to that, adopt that yeah, okay, yeah so I'm, looking at the private PR that you pointed me to up here just to look, it's.

F

Not super easy, this yeah.

D

F

Some other issues.

D

Linked and yeah exactly so just have a look at it when you get a chance yeah, so that would be, for it would probably let this probably come in our tool in v3, yeah, they're.

F

Not adding any you.

D

F

D

Let's bail off okay, v3 API contour is a while off. I would say.

F

Okay, cool! That's all thanks: okay, thanks Michael thank.

A

You yeah I just want to echo the comment earlier by Michael Michael. Regarding the voting that's happening today, the announcement should go out any minute. We've seen two other announcements already go out. Four four: two other projects, spiff aspire and harbor, so yeah keep a look at on the CSUF toc mailing list, and if you want to add in your non-binding or binding boats there, please do so and yeah with that we're gonna end the meeting have a fantastic rest of the week. Everyone take care and I'll also I'll see you next week.

A

It's good yeah, take a bite.