VMware Contour Community Meetings, 18 Feb 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Contour Community Meeting - Feb 18, 2020

Description

February 18, 2020
What have we been working on?
-------------------------------
Contour releases
Contour 1.2.0 due this friday
Envoy 1.13.0 support
Upgrade to client-go 1.17, It does have compatibility implications
service.protocol schema validation
tcpproxy healthcheck support
certgen job YAML improvements
Contour automatically reloads SSL certificate for xDS
shortlog of changes since v1.1.0
@m2
CNCF donation
@youngnick
Ingress V1 graduation PR
IngressV2 types investigation repo
Contour switched to dynamic client for CRD types
experimental support for Service APIs type will land early in the Contour 1.3 cycle.

Other business
---------------
automatic XDS/gRPC certificate rotation, background material
@tsaarni, how’s it going?
Support for Contour to reload its certificate is merged: https://github.com/projectcontour/contour/pull/2198.
Documentation is still not covered https://github.com/projectcontour/contour/issues/2229.
Design proposal for Envoy https://github.com/envoyproxy/envoy/issues/9359: it now seems clear what kind of solution is acceptable to enable the proposal in the “background material” slide.
@stevesloka
Contour Code Overview: https://twitter.com/projectcontour/status/1229793584175513600

What’s coming up?
-------------------
Contour 1.2.1 coming March 3rd for Envoy CVE, (1.2.1 milestone)

A

We're good good morning, everybody, it is February the 18th of 2020, except if you've been Australian, which case that's a lie, because it is simply then I think we talked about that this is the community call for February um yeah? Let's, let's get started with a few, my name is David I'm assumed the call would have Steve Michael, James and Nick, let's see also from family.

A

um If there's anybody else who wants to jump on, introduce yourself and perhaps especially talk about how you came across this project and what you're, what you're hoping to get out of contour? That would also be very useful.

B

This is Danny and Hanson, with red hat. I am involved in the service api's project and have been working with the when we're forth a lot of the folks on the call here and just trying to better understand, contour and hopefully start getting involved as it relates to service api's and then beyond that after we get over the service API shrivel. Oh.

A

Yes, we had much to talk about in service Safety Island. Is there anybody else.

C

Hi this is Mike I, but the massacres also from Red Hat, and also interested in service api's welcome.

A

Okay, let's go through some of the more um some more formal agenda and then we'll open it up a little bit. Contra leases. We are planning to do contour 1.1 or to release this Friday, where Friday is relative to the local understanding. Friday there are did this. This is this is effectively trying to keep with the kind of a monthly cadence, so basically stuff. That's in master then call it one or two, so you can have a support and release and get out there and use it.

A

um Some of the I might throw it over to James and Steve and Nick to be honest, League most that's worthwhile is traveling to point out anything going, miss quickly things that I that I know I know for contour one or two are going to be on boy one: thirteen when we did 1.1, which slightly out of phase with the 1.13 release like it's always a there honor can imagine they released cadence and on roughly four to five week, those cadence.

A

So there's always some time we fall out of phase there so that their addresses that there's been a lot of internal work, which would probably talk about we did later in the core Weather Service API is good basic, but one of the things to realize whoever's sharing the screen you can just click on the words or ability implications is that we have upgraded the kubernetes client to 117. This is Steve. This is so we can have the dynamic client correct. Yes, I.

D

D

Yeah there was some things in there that helped us I, think part of it was just bumping it to keep current with with latest. Yes,.

A

There's a bit of kind of like prior out here, which is when every every every development race when you open the tree, one of the first things I do is just go and see if anyone penalties need to be updated. So we would generally keep up to date with what it was. The latest couldn't notice, client that been to to hyper-aggressive in general. This shouldn't have a big impact on users like partially, because we've been doing this for last two years.

A

Didn't notice a problem before it's probably no problem now, but technically, because the kubernetes client only really supports the versions of kubernetes that are supported effectively. We have kind of moved the coop native support window and someone go to the project control website and are given a support page it's under not the other one yep and get the docs and then down on the left hand side. So we community support matrix yep.

A

So what we want, what we want to do in the teacher interview, some ideas of what Canadians version supported by conference, it's kind of like a two dimensional problem, because it's not on those forward in time.

A

In kubernetes miss Borden times well, there are versions of kubernetes that aren't supported, yep, the probably I'm speaking too long that something which is not really an issue, but it's just kind of like like if, if you have processes inside your company, which like well we're on communication X and it's the tool version y like like you might need to solve that compatibility kind of thumb, kind of multi, dimensional chess, this this page can hopefully help you and over time it will grow.

A

Just like the supported on vibration, page the main driver for this is we needed your client to work with the dynamic client.

A

If you guys types so it all kind of comes back to comes back to service api's, any questions I'm guessing I'm, missing, donan and in the car. This is this is pretty like pretty standing, loose and stuff.

B

Yeah I think so maybe I missed the first part of it. Of 118. Support is at plan for the next contour release.

A

So that's really quick, like like this table, is driven by what the client says now think the client like what the prominent the client promises and what it actually works with are two different things. The client promises, basically this like. If you someone clicks on that client go link.

A

Second, paragraph yep, this one here like this. This is, if you use Kydex, these are the things you compatible with in reality in reality that table it's much bigger as long as you as long as you're, not trying to use new features like like new data types or new keys on classic core good news objects. Client works all the way back to like you dot. So there is there. Is this difficult difficult thing between the client officially supports certain cognitive versions and actually works with much larger said.

A

We have to go with what officially supports, but.

E

Remember it's important to remember that officially supported actually means is tested against correct. So that's the that's the that's the other important there is that that means that you know those clients are all just against the.

E

We have found in that that, because we're generally using versions like reasonably core objects like secret and universe, that haven't changed in a long time. It hasn't actually mattered on that will actually change at some point because at some point we're gonna need to move the contour contour h-2b proxy CID to the GA CID spec.

E

Once we do that, then we do put a hard limit on 116, because that was when wonderful anyway, what about 114 116 was when the GAC IDs, but first came in, and once we change our IDs to that it won't work on the show running. That will be the minimum good and we do need to do that for reasons but yep.

A

So I'll take a note to update this page for 118 get an answer for 118, but the other thing to take away from this is over time when older versions are not supported, they're not supported, because we require new features, updated cid, remember a couple of rinses ago, when extensions, giving extensions moved to network indicates that I/o. So you need to eat those things that in the client driver compatibility, not the product itself, it's the libraries adrylek on I think so I'm Paulo Nina cool.

A

Thank you. I probably spoke too long on that and made too much of a deal over small thing, see some other things before I, throw it over to Steve, James and Nick's service protocol schema validation in 1.1. We added the ability. We will get a much better way of saying what is the protocol this supports, rather than the annotation, so in stuck you can check the buddy hated. We've now add in the field. To say you know should be proxy when you talk to the service it expects this protocol.

A

That's now validated I believed, through through validation from the CID, like just publish an enumeration of valid values. Is that correct? In.

F

A

Yep, so did you reapply the CID definitions when one but to 1.20 is out now all the sudden, you won't be able to give the wrong the wrong emotions.

D

I'm in the wrong spot so.

A

You were right there. There was like, like an annotation of the oh you're right, okay house, yeah, yeah yeah. We know look at the yellow as well, but it's actually see they're on line 23. We now you might make me clear to the make it clear to the generated CID and thus to Q control.

A

These are the valid values for this this field, but just just nothing to try and make it make it make it easier, because otherwise, if you previously had me bound by you just be either ignored or the whole, the whole document be considered invalid. So this just helps get few validation earlier in the process. Absolute, better feedback, I'm.

D

Mad dog steers. Well, then point is you did two different didn't.

A

D

A

um Now we proxy health check support and it's not gonna go sleep.

D

Yeah, so we migrated over from ingress route. There was some things about health checks that we kind of rethought. So at one point we took out all the health checks and then we implemented them into this health check policy which we've been kind of following throughout and I. Think in our one to finish. To get that complete, we just didn't overlooked, adding the health checks back to TCP proxies, so that is now in there and will will be in there I guess and 1.2. So you can.

A

Do the same active.

D

Health checks against a proxy yeah.

A

But back in the in the pre 100 days we had the same stands that same health check stands, which we apply for both TCP proxy and HTTP. Kind of endpoints turns out there's a bunch of fields in there like like half and query and host that don't make any sense when you're talking at layer layer 4. So we don't do a little bit of magic behind the scenes to define two different, two different types for the generator which have site from schema.

A

So basically do see you can't you can't say things like what part am I going to throw that's just not a thing. So yeah, that's going to be in 1.2 now is that James Nick? Is there anything else that I've missed I'm, sure, there's stuff that I've missed.

E

There were a few I think there were a few partners, but nothing huge. A couple of things like the certain job. Now correctly will succeed if the secrets already exists. So mm-hmm and steve has also made a change a while ago, so that the search a job if you're running a more recent communities will be deleted. Basically, that just removes a blocker for people just reapplying the ml over the top of the old one. Let me just couple other things.

A

To James, since this the short log I wish, we should get, you know, get up with generators directly. This is fabulous I, always.

G

Just have it normally when I do a release. I do a script which slams the short log into the tag which is useful, but the short looks great I think there's a lot of sort of bug, fixes and cleanup since release, and we have this little sprinkling of small quality of life improvements. So I think it's a nice release. We've seen it's pretty low risk. Nice benefits.

D

I think the one thing else that we've added or Isis is in flight- hopefully we get it finished, is the ability to roll out an envoy cleanly. So today, when you there's a pull request for I, know: I just finished up their review from from James and Nick, but we've added this new command to contour called the shutdown manager and idea.

D

Is that when you roll out a new envoy, the problem is: is that there could be active listener, active connections to those listeners, so we need a way to have you be able to roll that envoy well after draining connections. So this helps you assist with that and there's a bunch of Doc's and stuff on it, but hopefully this gets into the 1.2 as well. So when you need to upgrade envoy, which is going to happen here soon in March, you'll be able to do that without having to lose connections.

D

So previously we did this with.

A

Just a terrible combination of bash kind of like curl on the end point on envoy be sure we I made some horror show about that.

D

It was pretty fancy.

A

It was, it was the wrong tool in the wrong place, but yet so the idea is to connect the shutdown signal that the kulit sends to the pod envoy to say. Actually, please go and drain yourself, don't just sit quietly until you and and then till you murdered.

E

You know and I think, if you want to, if you wanted to briefly explain it, your diagram that you've got in there is actually very good I. Just.

D

Pulled that period I see that diagram there. That's pretty good, okay cool, so the idea here is that, like they had mentioned before we would you created a readiness probe on envoy and envoy itself. Has a health check fail endpoint? So what we would do is on a pre stop hook. We would call that health check fail envoy so on where we start draining connections and then the readiness probe and kubernetes would look at that probe and say: oh it's failing because now it's unhealthy, it would take that pod out of service.

D

So then no new connections should route to that envoy. All the while connections will start to drain the the problem we had was we didn't have any way to know you know: are all the connections gone yet or not? So this is the idea of the shutdown manager. So the idea is that this top part is just the live in is probably can skip that. So here's what happens so crew Bay's is gonna, say: hey cubelet, go destroy. This pod is polities, a terminate look.

D

You look well then hit the pre stop hook on envoy and then the shutdown manager will also get that same hook. It'll, say: okay, audibly, go start draining connections, and that's this arrow here going left so that that point envoy will be unhealthy and then it'll fail. Its readiness probe so it'll get taken out of service. So no new traffic should happen should be directed to that instance of envoy.

D

So now on we're starting to drain connections and then what happens is the shutdown manager is gonna pull here? So there's a configurable time, it'll go and pull and look for open connections on all the listeners. In our case for contour, it's only an HTTP and an HTTP listener, so it's gonna pull and look for again a configurable amount.

D

So maybe for you in your environment, you know a thousand connections is, is a low number or maybe zero is a good number so to continually pull for those those connections to be drained once it hits that mark it'll then send a response back to that. Pre stop hook that happened up here and that tells the cubelet hey, I've, drained everything. I've done on my cleanup: go ahead and terminate me I, think you'll. It will terminate now in the event that this doesn't happen fast enough.

D

So you can configure basically this termination in grace seconds for the pod, so you can define basically how long you want to wait for that pod to stay around while it's waiting to drain. So maybe for you don't be. You know five minutes that maybe a half hour actually don't know what the max is and kubernetes just have. That's you, but that's from your max window.

D

So either your open connections is met or that termination grace period gets met and then the pod will get terminated and then the next one will roll, and that has to be able to define. You know how how you're gonna wait for these connections to drink. That's kind of the idea that make sense. Folks.

B

Thanks for the run, dance, the shutdown manager, that's a container that runs within the contour pod.

D

B

D

Alongside envoy, okay, yeah, so contour an envoy in our default model, now is their split, so envoy runs as a daemon side. So one instance in per node and then contour runs is a deployment. Yeah shutdown, manager's job is just to you know, implement those the polling logic there and it's just it's written as a command off of the contour binary. So it's the same contour container with just a different command that it gets run just for simplicity. So we all have to push and you know, manages hold up a container or image.

H

Actually and uses a lot less resources, since it's does a little bit different job than the kanto binaries right, yeah.

D

Oh, it's running is just you know, a small girl, HTTP server is all it's running, so it's it's very minimal. Yet I mean.

G

It is the same binary is built into the contour binary. However, it's not we're not shipping a brand-new binary for this.

B

This makes me think of a problem that we've been trying to solve. Micaiah and I could use your help explaining this in more detail since you've been leading. The effort is that was the graceful I forget what what does it call graceful upgrades or a challenger? We got we're upgrading our ingress controller from one version to the other, or what is it called hitless upgrades? Is it correct.

D

Yeah happy to I mean.

G

That doesn't really occur, for the problem doesn't really.

B

G

For contour, because contour itself is a separate deployment than envoy yeah.

E

And so, as long as we're a convoy successfully, it's fine and is, if you're, using a contour with the later election, then usually because as long as you roll the contours, one at a time like usually the amount of time that it takes to roll the thing with enough time for contour that contour a new contour coming up to two fully to initialize its coaches and stuff. So that there is, there is a bit of a race enos around config, that's possible. But as long as no.

A

E

A

The leader, actually little action, does not play a part in that anymore.

E

Yeah this one said the point that I'm making is that there's no there's no racing us as be few years later lecture. That's the point that I'm saying is that because you as long as you're, when you do a deployment up to update it, will by default it'll roll in one at a time the way we've configured the deployment? So you won't have to worry about that, and that means that you will get a hitless upgrade because the gun dual control plane will roll.

E

When it's ready and now with the on with this envoy change, then the Envoy control plane will roll one at a time and won't drop connections. While it's doing it because it'll put it'll, put them into training mode.

G

B

It sounds similar to what what we're doing, but we're still Mike I am I missing something here. It sounds similar to what we're doing, but we still see. Okay, we probably better to talk about that. The other time yeah.

G

So one interesting wrinkle with this is the contour image is now in two place: I guess it was always in two places right. It was always the image was always associated with the envoy deployment and the contour deployment. Yes,.

E

So when you, if you change, if.

G

You change your contour image and you're rolling out a new contour image. You might want to orchestrate that so that it rolls out to contour first and then one boy, second or whatever, is appropriate right. I.

E

Think I think in those ones are we actually do set it to lightest as opposed to painting the version like we do in the continuity bonds.

E

I think there's some big benches for 1.2 days: yep cool.

A

All right, let's, let's move on the next thing, which I admit I copied over from the previous meeting notes. Michael is: is there anything we can? We should discuss about the scenes, definitions.

H

No not yet so the the TOC kind of cancelled a meeting today and then we call it I, know Daniel you. You comment on the PR I made the change. The two changes you asked for for meeting signal working on Thursday so should hopefully get someone. That's gonna be in charge of doing this with us. So far we haven't been able to pinpoint someone. So hopefully this happens.

H

I've made terrific progress on harbor in the last week, so Harbor finished one out of the two secret views and the second actually finished two out of two, but the second one did emerges PR so now I'm able to actually go back to the same folks and ask for more resources for contour, so a bit a big pest like across the board of CN CF. So this is hopefully gonna pay off, but there's no more. This Thursday.

B

Yeah and I think the Signet working contact would be Bowie or Tim, Hawk and I know. Bowie is well aware of you know all the involvement and the plan for content to support the ingress, v2 yeah.

E

H

No kubernetes signal working since here.

D

B

C

H

Even be zero folks, yeah.

A

I mean things isn't hard just for programmers. It's also people that run around working groups, yeah, okay, what I might what I might do for the next? Let's call it two minutes here we go Nick.

A

Can the redhead folks like? Shall we talk about Zyliss api's? What what's happened so far, and what's perhaps how the subscript upstream potentially feeds back into contour, because I know that suicide guys is part of upstream signal working that is written quite rapidly.

E

Okay, well, I guess: I'll start there, so the in case there's anyone watching this who doesn't already I'm the service api's is the is the sub networking, the sub-project of c networking to build a replacement for ingress and next generation ingress that it's going to be? It's gonna cover a lot more use cases in ingress. So that's why it looks shape of.

E

It is a bit weird if you're used to looking at a single document that is in goes, the I think where it's at at the moment is where we're still working pretty hard to sort of define a lot of a lot of the sort of a really basic functionality and how it will work and how how there are different constructs fall together, where the important part for contour is that I want contour to be able to consume these types as soon as possible.

E

So to that end, I've been working on bringing the bringing just the basic wiring for the types into contour as soon as possible. Behind a experimental flag, I could have a payoff for that ready to go. That's been approved. We're gonna hold off on that. Until after 1.2 so we'll come in, I want to buy one so it'll come in as part of 1.3.

E

The part yeah. The idea here is that then once I do that, then, if you are running contour, master or controller, one poetry, when it comes out, you'll be able to pass a experimental service, a few guys flag that you'd have the service. That then will expect the service api's objects to be installed in your cluster, and currently all it will do is record that it has seen the objects. But the whole idea here is to just wire everything up, so that wiring is ready for us to add further logic.

E

In once, we get to the point of actually having logic defined by the server-side guys at project.

B

Build our foundation yeah.

E

Yeah so I mean it's yeah, it's pretty exciting that you know I, think we're gonna be the first English controller that have any support for this arm at all, even if it is super basic right now, because the objects are just not I mean practically. The objects are just not ready for for anyone to actually anything against them yet, but having this wiring. That now means that you, as as the objects, get already it's just a matter of updating, goat, mod and and then bringing the logic into bringing the logic into contour to actually handle.

E

However, the api's are nothing to find what.

H

Their unique really quickly, with their default kubernetes ingress, now have support for this right off the bat so.

E

No, so the whole idea of this the holiday realness project is that it will produce a set of CR days that have extra functionality, but they will not be included in kuva days, but all you will need to install them separately I'm in order to access this functionality, and this is the sort of the new model for extensions two key areas going forward, that the core is sort of manageable, larger seeds, and so there is a separate effort that Jen's is working on onto a team to bring us to a ga object.

E

Instead of being a beta object and there's a few actual feels that it's a lot of stuff the days before we talk more about, but the I yeah I think we're waiting there for that aspect to be accepted. In for those changes we moved in and then at that point we will probably will move contour to using the you to want to wanting to use the the GA ingress object, but supporting the other ones.

E

I think Dave and I have talked about this a lot, but I think that the one of the things that we really want to do for contour is that we want contour to be will take your English config, no matter where you got it from or for as I or as I like to say it. We don't care who you are where you're from or what you did as long as your ingress.

H

I've take back, there should be a new mission statement.

A

E

So are the yeah, so the yeah, so that's that's just the idea is that we will will support anything that we can, that configures our proxy to do investor looking, ladies cluster, no matter where those objects are from or what they do. As long as we can squish them all into the same committees, cluster there's no name conflict or something like that. Then we are. We will look at adding support for it. So if you have something you want us to add in please organ issue: yeah.

A

It's important to remember the contour count and sports for different ingress objects.

A

The two, the two flavors have won it on the UM Peter one ingress route, which is going away for Lee in June, and they should be proxy, which is that is their placement for that, and we fully and fully expect in grocery one as soon as as soon as verified begin to support that, as well as a commitment to seek networking is that we will be the testbed for me to obviously with the right kind of you know experimental extension, but the best way to know these things are going to work like this is the ingress.

A

V2 stuff is very it. You know that it's not an evolution. It's a revolution of the way that networking, especially external, facing that with these lot of new communities in the best way to know this is going to work, is that you scratch and sniff it and try it so that that's that's what we hope the contour can contribute to the community. There.

A

Cool and just I put a link just for the PR Boyer's in the room. I put a link to the ingress v1, which is not English v2. The english v1 graduation PR, which I know where are we in the community cycle, where they're closing in on 1.19, so I guess like 1.20 or something like that, and that will actually happen.

A

Anything is coming, but this isn't gonna land in 18 yeah, so it easiest way to say is that we know it's coming, we're tracking it and there is a little bit of kind of kind of like like juggling of like there's no point in doing any work until, like the actual bits are available upstream. So we're very much waiting on a part of being aware that we we want to do this work.

A

We we wouldn't jump a gun. Okay, let's, let's move on to other business and I. Think I, don't think terror is on the call today and someone give a quick overview, someone who is helping humanities work. I know there are two parts: there is the contour side and the envoy side, which is not quite going so well.

G

Yeah I can give a bit of context here. So the end goal of this work is for a site to be already employed for a site to be able to rotate the certificates that are used to secure the communication for the XDS channel between contour and envoy and you'll be able to rotate those certificates and everything would continue working theory prints. You know the goal is to is the goal is for this to be an automated it's an automated or automatable system.

G

So on the contour side that changed to automate for contour to automatically pick up, new certificates has has landed, so that will be in the next contour release. The envoy side of it is still in progress. Envoy users I notify to detect changes to files and it that the way it drives I notify is defeated by the way kubernetes constructs config volumes so that when, when kubernetes updates their certificates, the uh notify watch, the contour has isn't triggered because it's still watching the old files.

G

So this talk upstream I think Mac clients just engaged on that PR. So you know I think it's making progress, but it's going to take some time.

A

You may have to URL back.

A

Yeah so I think they the answers that we're like we'll want this feature, we're still we're still working on it. It's if, if we, if envoy I mean this seems like a kind of a larger problem than just our requirement, if envoy kind of has trouble with the way that kubernetes writes a faster temporary temporary volumes, this seems like we can impact a lot of people using envoy as a as a product like eating all of their and I've completely low type things.

A

So I suspect this will probably be fixed, but yeah no answers at the moment.

A

Any questions from anybody who wasn't on the call last last week about about why we're doing this, where it's going or pretty straight for.

A

Cool um see, if you flick back over to the notes. Thank you.

A

What I might do we're doing pretty good on time, so I'm just going to I'll just talk about the one last thing on the agenda and I'll, throw it back over to Stephen and have some open discussion. I said that we're pushing for 1.1.2 by the end of this week and part of that is to keep our regularly strain. Another is to create a couple weeks of free air between between getting everyone up to 1.2 and the inevitable envoy CBE, which is coming out, which is going to be a new version.

A

One word shipped on the 3rd of March. So it's just closed a couple of days ago, and we and because of that we have to ship a version of contour so that we update the manifests to point in this new version and also it is rare. But it is rare, but not unheard of at setting about twice and run twice over history of the project than we actually have to change contour to to to work with what, whatever whatever is fixed in the new version envoy.

A

So it's just letting you know that they're insane there will be a patch released to contour 1.2 coming on the 3rd of March, which will also require an envoy update. But that's that's what we want to get all the code changes in your hands a couple weeks before, like basically the end of this week, so that you can, you can upgrade out and don't want to put you in a position.

A

We have to upgrade to a new version, contour and potentially have incompatibilities or things that would mean you can't use that version, but also in situations that you must use the new version envoy, so just giving this coming bit of prior prior warning there and with that I linked the milestone all at the end of the notes to the milestone with that I'm gonna take the rest of the time I'm gonna head over Steve, who can talk about, come to a code overview and if there this is.

A

This is for everyone on Constance your time to ask questions. Ask verifications one.

H

More thing that I want to mention cause David we're gonna, basically update the community meeting for contour. Now that they're having more and more contributions and credence.

C

H

Red Hat we're gonna meet weekly, but we're gonna make it a little bit different. Since we have folks all over the globe will have one week, that's gonna, be in a time zone, that's friendly to us Eastern as well as European time zones, and then we're gonna have a second meeting time. That will be the same slot as this one: that's not as friendly to folks on the East Coast, or definitely not for Europe but friendly for Australia, as well as west coast. So that's coming up.

H

We will I'm thinking that we want to update our meetings and the first iteration will be next week. So it's gonna give us a lot more touch points with the community and everyone. That's working on contour thing who still be set to one hour, but very likely will end early. So we'll just have the our reserve just in case, but overall it's gonna facilitate faster cadence and collaborating on the project.

A

Sounds great in terms of setting the meeting for finding good good good times in evening today, I'm just gonna make an arbitrary decision, or how could we collect feedback on people? We.

H

Actually picked the times already and.

A

H

Jonas is sick right now, so I'm trying to see if I can find them on my calendar really on my on my email to him, but essentially the it one. Slot is the same one as this one and the other one was early in the morning. I don't know exactly. He was like 12 noon, central, something like that which.

A

Was okay so afternoon to the European folks early morning, three strains and midday yep, so we'll put them in this like channel, we'll put them in the meeting notes who put them on the website.

H

Yeah I'm hoping Jonas gets over the flu by the next day or so, and he lab did everything dope.

A

Yes, so, if you're interested in finding out more the hash contour on the curve on the sorry on the kubernetes slack is the plate is the way to find this information.

A

Okay, who's, just loca yeah.

D

So I had some actually talking talking with Athenian and some folks I offered up some support to like walk through contour kind of help. You know how we built it kind of where the components work from from a code standpoint, we've all kind of done, the the intro to ingress controllers and things over and over and over, but I think we've never really done this like hey.

D

How does the code work to help something maybe contribute back who's interested so tomorrow we we just think the time- and this isn't good for the last showing folks but I think you all know, know the code, but if anyone's interested I guess what I'm saying is that two o'clock tomorrow, Eastern I, was gonna, walk through. You know some of the core components of contour. You know how do we support ingress route and proxy and all those different components? How does the you know those objects flow into contour?

D

How does it then take them and do something with them? You know and then write feedback or write status back, so that's it will make it freeform whatever it is. We need to schedule more. We can do that. We can make this part of our community meeting. You know every week, take a ten minute walk through a component or something if that makes sense, I don't know we'll.

A

Try it see, do you think we'll be able to post a recording that maybe we can link it to the exam needs meeting notes yeah.

D

Absolutely yeah once recorded yeah, well upload it and get it global share that yeah. So we can share this in the notes. That's.

A

In it, I know that these things kind of tend to like age quite badly, so like like a code war for three years ago, he's not particularly useful, but it good good have some short-term benefit. So sorry, sorry, opportunity I was.

G

Gonna say: can you also send a meeting invite to the contour announce group? There are people who are already subscribed on the community calendar, see the convert yeah.

F

That's a great that's a great point: yeah this sort of popped up, X.

A

Right, we have a mailing list, don't we Michael? We have the contour announcement list. We should at least link it from the I. Will I'll find out and link it from the notes, but yeah again. This is another place that you want extremely low volume. Micra tree is a new release. Yes, community meeting stuff period, it's another low-balling way of keeping keep in touch with the project.

H

Yeah I think their mailing list is a Google Group. It is yes.

A

H

A

On notice, to figure out figure out who created it, who composed to it and we'll make sure that we send that information.

A

Okay, so we have, we have some time really for any any questions at all. This is down in maker. If you have any any questions at all. This is an opportunity, constant, alright, there's anybody else on the call who I haven't previously introduced.

A

If you want to feel confident speaking on camera, just um just message me a question: I'll answer: if that's not anything, I.

B

Do have a quick question on one of the topics that were covered as service protocol validation. I, see that there's three valid strings, TLS, h2, HTC, I, think I know what the first two are, but I'm not sure HTC is so. I was just curious. What that means.

A

A

Actually I was gonna say, but it was kind of involved guessing James, it's it's derived directly from like it's.

G

E

A

G

Sorry HTTP HTTP to over TCP so not know TLS, okay,.

A

Yeah, so it's it's right, so it is not encrypted. It's not multiplex inside of TLS TLS frames.

B

And are these values defining somewhere.

A

E

Defined the same values as we had in the annotation that we had that we asked people on the service right though yes,.

A

But where they actually come from I'm gonna say that they come from the Envoy Docs, as they would have just been directly with the fields now, privacy, perhaps to add fresh tears in meta-commentary. They are not the most friendly values. Let's be straight about that, so we could.

A

Perhaps we could add a this is but um I mean hh2 is kind of quite straightforward. I mean he took the Jota to see thing is, I was gonna, say, don't think anybody in factory as it takes to be two without encryption generally most of the people who are doing HD to implementations like we're not going to do all this work and not have encryption like like, so that part of the spec is kind of looked at.

A

It's like yeah, we'll get to it someday when I, you know, I put it slightly low and going on holiday, so he can't exists as a thing, but doesn't I don't see what we mean. We have to admit that you make that configuration, but it kind of it kind of exists, because there are three options were supported by onward, so we directly expose those as annotation names protocol names. So.

G

H 2 and H 2 CA, LPN protocol names, TLS I, don't think is every protocol name because I think they open cuz, obviously I guess it could be yeah.

A

Yeah, but sometimes it's a not a great deal of thought, was put into what was put into to choosing the choosing the names. So perhaps one of the one of the things too that we could even prove that is that we can create effectively Alice's so h2 could be, could be alias to hate to be I. Don't know what to do about H to see I, don't think. That's the don't think.

A

That's the biggest depend of TLS is probably fairly straightforward, but perhaps too dense and it's the question didn't ask: we could potentially it's not it's not a big deal to create more meaningful aliases. We can't remove the current ones I'm just coming back, it's a billy problem, but we could add better aliases yeah.

B

I tend to just look at the you know, godox of the API, and so even if it was just explaining what each of the values means or if they comes directly envoy, just having a link that says no for more details on these values. Go to this.

A

Url yeah I'm, making a note that we can definitely. We can definitely like that. That's pretty straight forward to at least if we can't justify those names at least link to a description, what they mean so to help people like okay, I, don't understand what these three options are, but at least I can read the description of each of them, and maybe I can choose that yep I will I'll. Take a note to do that.

A

Okay, not problem I,.

A

Hope, that's that's the end of the agenda. I I'm just going to pause here for a little bit and if there are no other questions, we may may end a little bit early tonight. So that's a kind of speedy meeting start time yeah. So thank you all for coming. Thank you all for coming along the Sybil will be holding these more frequently Michael, we'll make sure that we publish the different plate. Sometimes we do about that. Do do join Steve tomorrow for the code walkthrough and with that I think we'll call it a day.

A

Thank you very much. Everyone thank.

H

You I appreciate their before running this, not.

A

A problem thanks coming thanks, ed, okay, thanks, oh yeah, will you push the stop button Steve.