►
From YouTube: Contour Community Meeting - March 3, 2020
Description
March 3, 2020
What have we been working on?
Contour releases
Contour 1.2.0 released
hot-reload of certificates for Contour, thanks @tsaarni
Envoy shutdown manager, thanks @stevesloka
blog post
Contour 1.2.1 released
upgrade Envoy to 1.13.1 to fix CVE, no code changes
Envoy 1.13.1 announcment
@m2
CNCF donation
No updates, sig-networking is reviewing the proposal
Next step is @m2 completing a form for sig-networking
@youngnick
service-apis “support” is in master. Only logging for now.
Contour watches for new objects and logs their presence
Tracking spec evolution upstream; will use for an experimental test bed
Public board bug triage
#2264
Original connect timeout value is arbitrary
OK to tune, but want to be based on evidence
@youngnick to follow up with reporter to gather more information
#1691
Needs decision on whether to accept this as an issue
A
A
B
I'll
I'll
take
the
the
start.
Yes,
contour
1.2
was
released
a
little
while
ago
now,
and
the
blog
post
came
out
yesterday,
thanks
to
Stephen
Janis
for
sorting
it
out.
The
the
two
main
features
are
the
hot
reload
of
certificates,
work
on
tour,
with
thanks
to
Tarot
that
allows
contours
that
the
G
RPC
TLS
certificates
for
contour
to
be
rotated
without
restarting
contour,
and
the
other
feature
is
that
envoy
shutdown
manager
which
will
allow
envoy
to
drain
before
closing.
C
But
yes,
T
V,
yeah,
I
wasn't
safe
or
in
yeah
in
the
blog
post
generative
you
could
pop
to
that.
There's
actually
I
recorded
a
video
that
walks
through
the
shutdown
manager
so
I
actually
like
spit
up
a
cluster.
You
know
fire
a
bunch
of
traffic
at
it
and
then
change
envoy.
So
we
want
to
go
and
roll
the
envoy
pods
and
then
you
can
actually
see
we
have
a
new
dashboard
panel
in
the
graph
on
of
dashboards,
which
shows
the
active
listeners
or
active
connections
to
each
listener
in
envoy.
C
So
you
can
actually
see
you
know
pod
a
is
gonna
shut
down,
I
guess
the
the
hook.
You
know
and
then
it
traffic
peels
away
from
that
pod
and
then
the
shutdown
manager
watches
it
and
then
it
kills
it
in
terminate
and
then
so.
If
you
want,
if
you're
interested,
you
can
watch
to
watch
that
video
and
it'll
walk
through
that.
It's
always
fun
to
watch,
see
how
it
works.
You
know
in
real
life,
absolutely
yeah
yeah
sounds.
D
C
E
So
no
updates
on
the
CNC,
F
donation
and
the
fact
that
today,
at
the
QC
called
I
mentioned
that
you
know
their
signal
working
is
undergoing
our
review.
I've
been
swamped
with
other
things.
I
had
a
chance
to
finish
up
the
doctor
sent
me.
So
that's
all
of
me
so
I'm
trying
to
find
some
time,
but
it's
hard.
E
E
F
E
Have
to
fill
out
the
document
for
them
and
I
haven't
had
a
chance
to
do
that.
I
need
to
her,
but
I
was
blocked
on
them
for
maybe
three
weeks
or
so.
They
eventually
finished
we're
looking
at
the
stuff
that
I
sent
them
and
then
they
came
in
documents.
A
well
go
ahead
and
fill
this
out
and
Lee
and
I
chatted.
Yesterday
and
I
talked
on
dude
I'm.
Sorry,
it's
been
a
week.
I
haven't
done
it
yet,
but
I
need.
B
Awesome
thanks
very
much
into
so
thanks
for
popping
open
the
thing
there
Jonas
to
remind
me
that
I
forgot
to
mention
release
1
point
2,
point
1,
which
is
to
address
these
CVS
that
you
can
see
on
the
screen
for
long
way.
Some
of
them
are
heists.
We
wanted
to
make
sure
that
we
get
this
addressed
as
soon
as
possible.
As
always,
we
need
to
update
envoy
as
soon
as
this
comes
out
because
always
only
supports
the
most
recent
version.
B
So
this
release
one
point
two
point:
one
has
zero
code
changes
and
literally
only
updates
the
manifests
to
point
to
the
new
version
wrong
way.
Everything
as
long
as
you
give
you
a
running
one
point
two
already
then,
then
all
the
only
thing
you
need
to
do
is
to
apply
the
changes
to
the
Envoy
employment
or
limit
it,
and
if
you
running
an
older
version
and
you're
gonna
upgrade,
please
just
go
straight
to
one
point
two
point:
one.
B
The
other
thing
that
I
wanted
to
talk
about
was
that
yes,
support
for
the
service
API
objects.
The
new
objects
is
currently
in
master
behind
an
experimental
service
at
the
US
flag.
So
if
you
add
service
API
CR
days
to
your
cluster
from
from
the
service
ochio's
repo,
then
you
will
yet
you'll
get
a
you'll,
be
able
to
run
contour
with
that
and
see
the
objects
be
added
and
removed.
A
B
This
this
will
be.
This
will
be
worked
on
as
the
service
api's,
a
project
continues
and
the
the
behavior
of
the
object
is
defined.
We
have
a
base
now
that
we
can
build
the
functionality
in
and
as
it
goes,
without
having
to
start
from,
how
do
we
wire
up
all
this
stuff
into
contour?
That
work
is
all
done
and,
as
we
define
the
behavior,
we
can
use
contour
as
a
testbed
to
test
how
the
behavior
works
and,
in
a
real
reverse
proxy.
The
plan.
D
It's
some
of
the
some
of
the
contribution
upstream
is
that
we
both
active
in
the
sinks
and
also
said
we
want
integrate
these
types
into
contour
as
soon
as
possible,
because
we've
built
an
architecture
that
lets
us
support
multiple
ingress
documents.
We
already
have
three
at
the
moment,
so
one
more
isn't:
gonna
one
more
isn't
going
to
hurt
and
we
get
some
real-world
testing
of
like.
D
B
B
B
B
E
E
Yeah
so
I
mean
I
can
give
a
little
bit
of
a
very
quick
background,
so
we
have
a
thirst
that
felling
some
of
the
interaction
with
control
because
of
a
timeout
that
already
exists
in
and
voyeurs
a
configurable
option.
Contour
put
a
default
option
there
that
that
seems
to
be
fairly
short
for
their
environment.
E
So
one
of
the
things
that
David
Cheney
had
recommended
saying
well
well,
if
we
update
this
timeout
to
one
point,
two
seconds
which
it
seems
to
be
kind
of
the
max
for
this
TCP
handshake
so
and
Nick
I
know
you
had
some
thoughts
about
you
know
yeah,
my
personal
me
is
Michael
was
thinking
what,
if
we
just
clear
the
custom-build
of
contour
with
an
increased
timeout,
it
doesn't
have
to
be
200
milliseconds.
It
could
be
some
other
value,
maybe
500
or
600,
and
see.
Does
that
work
in
that
environment?
E
D
The
concern
that
I
have
is
that
in
in
full
disclosure,
I
picked
the
value
200
millisecond
entirely
arbitrarily
on
the
first
day,
because
we
need
to
have
that
he
needed
a
value,
so
I
just
made
up
about
it
and
with
respect
to
those
1200
600
500
we're
all
just
guessing
and
guessing
were
shipping
docker
images
to
people
and
saying
does
this
work?
That's
also
guessing
we
don't
know
what
the
underlying
cause
is
remember.
D
F
D
E
So,
let's
add
that
in
the
questions
that
yeah
they
can
get
for
us
to
get
a
Dumbo's
language
starts,
but
don't
don't
finish
up.
Your
message,
though,
is
there
anything
else
that
we
need
to
understand
from
this
environment.
I
mean
it
is
conceivable.
There
are.
Some
environments
are
slower
either
because
of
network
pipe
and
not
in
there
there's
latency.
We
don't
know
how
everything
is
configured
and
the
things
that
I
always
wanted
to
avoid.
E
Is
that
it's
good
to
have
sensible
defaults,
but
allow
them
to
be
configured
because
we
can't
be
experts
in
every
single
environment
configuration
out
there
I
understand
the
thing
that
this
time,
what
cannot
be
too
huge
because
there's
certain
things
that
are
gonna
break
or
it's
gonna
masks.
We
mask
real
issues
understandable,
but
you
know-
and
we
already
like-
did
not
make
this
hard
coded
value
in
such
a
configurable
option
for
a
reason.
B
Yeah
I
was
going
to
say
it,
so
the
reason
that
this
is
configurable
is
because
in
in
the
different
use
cases
where
envoy
can
be
put
to
their
our
new
journey
different
values.
Most
of
the
time
when
you,
when
original
authors
of
one
word
using
it,
is
used
in
a
cycle
where
they
connection
a
lot
of
the
connections
to
him
from
envoy
I'll
over
local
host,
and
so
they
should.
It
should
be
very
short.
We
are
using
it
as
a
roast
proxy.
So
the
time
that's
a
different.
B
This
has
happened
to
us
many
times
before
the
you
I
do
like
that.
As
I
said,
as
I
do
probably
I
do
think
that
you
I
mean
one
point
two
seconds.
One
point
two
seconds
to
250
milliseconds
is
not
that
different.
It's
probably
not
a
big
deal,
but
the
thing
that
we
need
to
be
careful
about
doing
is
that
we're
not
like
you
said.
Is
that
we're
not
like
making
a
problem
for
ourselves
further
down
the
road
by
by
doing
this
I?
B
Don't
think
it's
likely
that
we
are,
but
that's
the
question
we
need
to
ask
ourselves
every
time
we
allow
a
value
to
be
configured.
We
also
allow
people
to
do
silly
things
with
the
value
if
they
don't
know
better,
but
they
might
be
like
you
know.
Well,
I
just
want
you.
I
just
want
this
to
always
work
so
I'm
going
to
set
it
to.
You
know
five
minutes
you
and
the
you,
and
because
a
lot
of
people
will
do
that.
B
D
B
F
F
That's
a
I
have
some
evidence-based
process
that
I've
gone
through
and
I
know
that
I
need
a
value,
a
specific
value,
but
the
second
reason
is
there:
I
can
use
a
tunable
to
eliminate
a
part
of
possibilities
from
my
triage
process,
so
I
can
use
it
to
explore.
Is
connect
timeout,
really
a
problem
really
the
problem
that
I'm
seeing
and
I
continue
it
and
eliminate
that
whole
path
of
possibilities.
So
there's
kind
of
there's,
there's
I
say
that
that
having
a
tunable
gives
you
really
two
different
purposes.
G
And
as
far
as
having
a
tunable,
there
are
a
bunch
of
different
ways
to
do
it
I
think
I,
don't
remember
if
it
was
Dave
or
Nick
said
you
could
das
all
the
other
folks
I
think
there
was
an
assumption
there
that
you
could
set
the
tunable
on
at
a
very
precise
or
granular
level.
It's.
We
could
also
add
a
tunable
to
the
grand
line
that
only
the
cluster
admin
can
touch.
B
Yeah
so
I
think
in
this
case
the
connect
timeout
is
remember
if
it
is
connection
manager,
specific
property
or
if
it's,
what
I
would
say.
Probably
we
would
want
to
say
unless
you
have
a
really
good
reason
why
you
want
different
ones
per
thing.
We
would
just
set
up
contour
wide,
and
so
it
would
be
a
cost
of
love
away.
Concern
not
HTTP
proxy
change.
B
Yeah
I
need
to
look
into
it
more,
but
so
I
think
the
process
for
this
is
I
can
see.
The
I
can
see
what
you're
saying
James
that
it
is
useful
in
this
case,
for
diagnostic
purposes,
yeah
I
would
say.
Let's
I
would
like
to
see
the
stats
steps
up
from
the
customer.
Maybe
they
might
need
to
show
it
with
us
privately,
but
a
steps
done
from
the
customer.
B
Who
has
this
problem
and
then
see
like
how
long
is
it
actually
you
and
then
we
can
make
the
change
in
master
yeah
and
they
can
they
can
if
they
want
to
run
a
bill
with
the
t-test
I
can
use
master
to
test
and
then,
if
we
need
to
change,
if
we
change
it
again,
we
have
a
master
docker
image
available
that
people
can
use
to
test.
So
we
don't
need
to
ship
specific
versions.
We
can
just
change
any
monster
if
it's
good
enough
for
this
one
person
should
be
good
enough.
Everybody
so.
E
Nick,
can
you
so,
let's
not
spend
like
too
much
time
on
this?
Can
you
add
your
questions
to
the
ticket
for
them?
Give
your
stats
Tom
asked
the
question
like
I'm,
assuming
this
test
time
will
tell
you
that
using
SSL
in
the
backend
or
not,
is
there
anything
else
that
you
need
to
know
about
the
environment
like
what
kind
of
questions
can
we
ask
and
I
don't
know
to
what
extent
the
customer
or
even
the
other
folks
will
be
able
to
answer
us,
but
is
there
anything
else
that
you
can
answer?
B
Mean
there
are
plenty
of
things
we
can
ask
for
some
of
them,
like
may
not
be
relevant.
Like
you
know,
where
is
your
cluster
running?
What
is
the
C&I
that
you
are
using
that
sort
of
stuff,
because
all
those
things
can
impact
on
the
amount
of
time
it
takes
for
one
point
to
connect
to
another?
You
know
like
what
is
why.
D
B
B
B
My
short-term
thing
is:
yes:
well
will
increase
the
default
time
out
to
twelve
hundred
milliseconds
since
it's
a
you're
arbitrarily
chosen
number
anyway,
the
but
and
we'll
ask
for
more
data
from
this
specific
customer
and
you
the
and
if
they,
if
they
have
some
education
and
they
really
really
need
it,
then
we'll
look
at
putting
in
the
setting
to
change
it.
I
mean
again,
we
need
to
decide.
We
need
to
look
at
the
setting
yeah
yeah,
oh
so,
where.
D
F
D
B
So
that's
why
we
need
it.
That's
why
we
need
the
information
so
I'm.
So
sorry,
that
is
a
better
way
to
say
it.
Thank
you.
Dave
I
am
okay
with
changing
the
default
value.
If
we,
if
we
can,
but
we
need
some
information
about
how
long
it's
actually
taking
to
do
this,
the
practically.
If
in
their
use
Kay
use
case,
we
might
need
to
as
Michael
says,
give
them
a
build
with
some
arbitrarily
large
number
so
that
we
can
find
out
the
actual
numbers
for
how
long
it
takes.
That's.
E
Exactly
what
I'm
looking
for
so
because
otherwise,
how
would
they
figure
out
how
long
it
takes
I
mean
like
that's?
Why
I
asked
earlier
can
be
used
to
tell
us
how
long
the
handshake
would
be,
and
if
there
is
no
real
answer,
then
make
it
big
enough
figure
it
out
what
it
looks
like
in
their
environment?
Let's
figure
out
the
why
behind
it,
but
please
Nick
are.
They
are
the
questions
you
have
here
and
let's
yeah.
B
So
I
think
that's
probably
anyone
has
any
else.
Has
anything
else
burning
the
one
that
I
didn't
notice
Dave
you
commented
on
that
I,
don't
know
if
it's
not
was
one
that
I
was
loved
by
you.
We
saw
some
time
ago
about
adding
ALS,
which
falls
into
the
same
bucket
as
adding
external
earth
and
hanging
rate-limiting.
D
D
B
Yeah
yeah,
okay,
so
it's
either
we
need
to
we.
We
need
to
tell
them
something
about
it
or
cause
it.
Just
so
good,
okay,
I
think
we're
pretty
much
out
of
time.
I've
just
got
a
text
that
I
have
to
actually
go
so
I.
Think
I
will
call
them
any
done
there,
and
thank
you
very
one
for
your
time
and
we
will
again
soon
thank
so
Genesis
right.