VMware TGI Kubernetes, 12 Mar 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: TGI Kubernetes 148: Gateway APIs feat. Contour

Description

Come hang out with Josh Rosso (@joshrosso) and learn about the new Gateway APIs in Kubernetes. In learning about these APIs, we'll test out a new cut of Contour that implements a subset of them.

A

Hey everybody happy friday, welcome to tgik number 148. so psyched to see you all uh looks like we've got steve waleed, martin rory sevi, all joining us as usual. Thanks so much for joining today.

A

Glad to see you all all right so today we're talking a little bit about gateway apis inside of kubernetes, um some new stuff, that's kind of coming down the pipeline out of sig networking and things that we're going to start to see ingress controllers like contour, you know imagine nginx traffic and others start to implement, so so so psyched to check this out with you.

A

As always, if it's your first time joining us for tgik, it's kind of tradition, if you feel comfortable to say, hey in chat and where you're logging in from, but what we typically do in these episodes, is we go through some topic inside of kubernetes land and we just kind of explore it together. Sometimes we know a little bit about the topic, but most commonly like today, it's new to us as well, which for me gateways and the implementation of gateways, is completely new. So I'm really looking forward to learning it with you all today.

A

So, let's see who we've got joining us so far like we said steve, waleed, martin rory, savvy, we've got you as usual, thanks for joining rodolfo from austin, thanks for coming back luke, hey luke yeah, I'm in colorado as well.

A

I'm waiting for the snowpocalypse to hit us here um eric great to see you eric, as always hope, you're doing well um ivan great to see you steve steve, is in from the contour team, so he's a little bit close to these gateway apis and by a little bit I mean a lot so as we mess around with implementing these or using a controller that implements them he'll be here for backup.

A

So thanks for joining us, as always steve, we've got tim joining us again: hey tim elko from holland, uh steve yeah, new location, I I'm still in boulder, but um I'm in a different place, just moved in. That's why you see a bunch of junk behind me, but uh I'm slowly slowly getting my stuff together here! um Maddie thanks for joining us maddie! It's great to see you youssef great, to see you as well um john jay great to see you again. uh We got marcin from poland. Welcome!

A

Welcome kr from scotland, uh philip from germany, hey phillip, all right eric says it's 80 degrees in dfw. Today, yeah we had. We had great weather in colorado uh the last couple days. It was like 70 degrees almost, but uh we're we're due for some snow and some cold. It's been it's been a pretty easy winter for us this year. So um I'm sure it's I'm sure it's coming soon um ismail great to have you. I know uh anzo from paris great to see you smee from tunzia.

A

uh We've got leaf, hey how's it going richard from austin, hey richard irby from london or iroby, hey kasharov, nice. To see you again! um No, it's not a box of climbing gear, uh that's that's in a different room and that room is way more messy. So I'd be embarrassed to show you all that all right, so thanks so much for joining us today, let's get into the news for the week as usual, you can find this at tgik dot, io forward, slash notes.

A

If you're interested, um we have a bit of a light newsweek, mostly because I'm not I'm not up to date with the news, but I did have some folks put in some good stuff. If you have anything else, you want to share, feel free to add it.

A

Kubernetes 1.221 will be built with go 1.16.1, so pretty exciting stuff. I don't really know uh how hard or easy this transition was. I think there were some like weird bugs and stuff that it brought up in switching the go versions, but at least to 116. That is, but I'm glad to see that we're we're already staying on top of of the newest patch release in golang, the specifically the security update that they put out um and go 116 is great right.

A

It's got a uh some new features in it, unlike most go releases, so I'm looking forward to checking those out is 116 is where they put in the uh the static file stuff right, where you can actually like build with static files just out of standard library. I can't remember, and we've got generics come in and all these different things and go. So it's an interesting time to be a go programmer, huh pretty cool stuff. Also, uh there's a garbage truck pulling up right now.

A

So hopefully, it's not too loud for y'all, okay, so uh go is being built with 116. um kubernetes 121 code freeze is in effect this week. So if you are a contributor and you're working on um kubernetes stuff do note that code freeze is coming up for 121, pretty exciting stuff all right. uh Additionally, if any of you happen to work in like some sigs or some larger repos in the kubernetes ecosystem, there is now a documentation for uh migrating from a master branch to a main branch.

A

It talks about a lot of the different stuff that you can do from like a proud perspective, make sure your pr volume's low all these different kinds of things a lot of times the hardest part is not so much the changing of the name, but it's all the tentacles. We have in our projects right that depend and reference on all these different things.

A

So it's super super cool to see that some work has been done to lay out um how how we can switch over from a kubernetes perspective, so nikita and bob thanks so much for putting this together and anyone else who contributed this is. This is really really great stuff um peter from poland: hey cool, sportiva jacket! Thank you! Yes, um yes, I I I'm always rocking sportiva stuff. For some reason, um cool cool um dennis, hey, dennis great, to see you too thanks for joining us today.

A

All right, I think. That's all I've got for the core news right now. um We do have some stuff going on in the ecosystem. So if you are interested, the tanzu developer portal has a new post on contour that talks a little bit about ingress and beyond. So this probably goes over the ingress crds, something that we'll be talking a little bit about today.

A

um I'm guessing this post is not as bleeding edge as tgik is so today we're going to be jumping into like brand new apis that are being designed and talked about in an alpha right. um But if you do want like a a more structured approach to contour, rather than the chaos that I'll be taking you all through, um the tonsil developer portal has a has a guide up here for how to concretely do um some cool routing stuff with with contour and its apis, all right, um ooh thanks.

A

Whoever added this psp deprecation replacement proposal has been posted. I have not looked at this, um so this has been something that I feel like we've been talking about forever I mean. Can you all remember when we started talking about psp deprecation and then we like, maybe weren't, going to deprecate it, but then we probably were going to deprecate it, but then maybe we weren't going to deprecate it well, it sounds like it's actually going to happen.

A

So if you do use psps in your cluster do take a look at what's going on with the security proposal, I got to do my homework here um in regards to how we're going to approach uh pod security policy like functionality going forward. um So really looks super super interesting. I think my biggest hope I don't know about y'all going into psp spaces.

A

Psps were great um and they did a lot of the checks we needed to do. I I think, at least at least for me as someone who I think, sort of understood them. I think the ux around them was kind of hard, um so I'll be super interested to see like what we implement in their place.

A

How we approach it. You know a lot of folks have been plugging in gatekeeper and things like that for this type of work, but even that can have some some problems. Like um you know, gatekeeper does stuff at the api validation layer so where psps could do deeper resolution. Like an example, we we've run into before in tgik is like.

A

If you do it the admission control layer- and you don't declare what what user is going to run your pod, then it could fail thinking, you're, assuming you're running as root, but in reality the pod might default or container might default to run as a different user right. So there's always kind of this discrepancy between how things could happen at that layer relative to like the conventional psp layer, so um check this out and maybe on a future tgik we'll be checking out some some interesting stuff regarding uh psp replacement.

A

That would make that would make a really interesting episode, I think so steve says oppa will take over. That seems to be the direction for sure um cool all right. So, let's see what we got going on here. uh We've got the psp deprecation proposal, thanks whoever grabbed that we have got container signing verification and storage in an oci registry, ah interesting, let's check this out, cosign cool, all right, so container, signing verification and storage right. This has been something that has been a hot topic for a lot of us for a while.

A

I feel like a lot of times. We have aspirations to do kind of this signing in validation, but it oftentimes kind of falls to the side in our backlog. So it looks like cosine is a project that is doing some of these bits. I have not personally looked at cosine, I don't know if any of you all have have used it or tried it. I'd be super curious.

A

You can tell us in chat how what your first impressions are, but it looks pretty cool at a high level um looks like you can sign and then push that up to a container registry. So a consistent way to do this would be really really nice. um You know, I think it's something that we've been struggling with for a while, so cool maddie says oppa and kant kant test. uh Do you mean conf test maddie, I'm guessing so conf test for the win? I love conf test as well. It's great. um We did do it.

A

We did an episode on oppa and some contest stuff too. Everyone, if you haven't checked it out yet so, do be sure to check it out. um Kr the link to the tgi kate's notes is tgik dot, io forward, slash notes if you want to check them out or add anything to them, feel free, um steve says: cosign is epic and I've been messing with it this week? Oh that's! A brave review, steve cool so I'll, have to give cosign a check.

A

It'll be really cool, probably check it out next week, sometime um cool cool, all right.

A

Okay, so we've looked at cosign a little bit. um Istio con recordings are out, I didn't even know there was an istio con, I'm so sorry, there's so many cons nowadays. How do you keep track of all them? This is really cool, though um so we've obviously covered istio and other service meshes inside of our inside of tgik. In the past you can check some of those out, but it looks like istio khan did some seemingly really interesting episodes so be sure to check out the recordings.

A

Oh very, very cool, sketch mash enterprise support um envoy hears you when istio speaks what envoy hears when istio speaks. That's that's pretty cool. This would be an interesting thing to understand right when the control plane is sending out signals to program envoy, I'm guessing, which is what this talk is about. You know what what kind of signals does envoy get and how does that translate into eventual configuration or an envoys case? Probably api calls right so very cool um alex, uh hey josh. Are you deploying the contour operator today?

A

I might be, I'm not sure I'll see uh I might do the contour operator. I might do normal contour if there's anything wrong with doing the contour operator alex. Let me know I haven't even uh haven't even gotten that far in the thought process. Yet to be honest with you, um steve says he calls it crd con yeah. I like that we should have a crd con and it's like everyone who publishes crds.

A

We have this kind of universal con for all the service meshes and ingress controllers and csi drivers, and you know all that kind of stuff um eric says, should be called you're killing me smallscon. That would work too. I would attend eric if you want to get that started up um cool kr, you said: do we really need network policies when we have istio authorization policies?

A

It's a really good question kr! It's something that kind of happens on. I guess on different layers in a way like, if you think about like layer, three left layer for network policy, um some folks do think on that level. um It's something that they want to kind of enforce at the cni plug-in, which is the thing actually doing like the pure routing of packets and setting up routing tables and all that kind of stuff, but it is fair to feel somewhat redundant.

A

When you look at some of the approaches you can do with like, for example, even just mutual tls and a lot of these service meshes right. So if you don't have mutual tls between endpoint and end point b, you already do have some level of protection between communication, but it's happening kind of at a different layer. So you know I think, of that kind of question, as almost like, a networking, slash, defense, in-depth type question and most like folks that I've worked with with kubernetes at large scale.

A

It's just been like what level and layers do we need to protect at, and sometimes the answer is both. um Sometimes the answer is just one. It kind of depends on on sort of like what you're, after as far as as far as policy enforcement goes, but it's it's an awesome question. It's it's kind of a hard one to answer um all right, so speaking of network policies, um I may have accidentally pulled this down when I was editing I didn't mean to.

A

If so, let's bring this one up, because this is pretty cool uh fully qualified domain name network policy uh operator. Let's see, josh get this markdown formatting right there do it yeah, okay, cool! um There is a fully qualified um fqdn network policy to do fully qualified domain names inside of network policy.

A

Now this is obviously something that a lot of folks have been wanting for a while, because while it's sometimes adequate to just go out and say, hey block out to the citer or to this label, sometimes when you're egressing, you might want to limit what domain names you can actually enforce against and we've seen this get implemented in some cni plugins, namely psyllium calico.

A

I don't know if anyone else can think of some of these plugins that have brought like their own crds in play to uh to enforce this on their own level. um Fqdn looks like network policy, so it looks like it's got a pretty similar format and I'm guessing. This probably deploys as a controller of some sort, but nonetheless this will probably give some level of more network more native network policy. That's perhaps not tied to a specific cni plug-in. um That's at least what my my first take is kind of looking like.

A

So this would be a super interesting thing to incubate and then maybe make it first class inside of uh inside of the the kubernetes, um the kubernetes networking um components right. You know it's it's been. It's been super funny to kind of watch the progression of of networking network policy enforcement, especially as some of the cni providers are bringing out replacements for cube proxy right, we're seeing more and more folks do things like this at like a level of ebpf or otherwise, um to provide a more fast resolution for some of this stuff.

A

So it's kind of like we've got the cni providers running ahead in one direction with their own policy models, then we've got core kubernetes doing its its thing as well, and I wonder if, at some point we'll see some level of uh kind of more universal convergence. In fact, what's funny about this, is I'm saying it?

A

I don't know much about gateway api, but I kind of feel like maybe that's a bit of the story with gateway api, where we've had these ingress controllers, solving different models, we've had kubernetes services and ingress, and you know its limitations and so on, and perhaps this is an extensible way for us to start thinking about how we're going to map all of the all the different stuff together. So all right, cool all right uh ishmael says, as I remember, there's a tool which creates net polls based on istio crds yeah.

A

There very much could be if there's something that just translates um some of the istio stuff into lower level network policies. That's totally possible. um Alex said, if you don't have a preference, the contra operator would be great just to get some feedback sure we can give it a shot.

A

Sounds good, michael says what is kubernetes and michael. I have absolutely no idea, I'm so sorry, um but we'll try to figure that out today. Okay, so that's about it for the news. Oh cool, also there's a demo for the network policy working group um that you can check out on youtube for network policy operator, because so you can see how much I butchered that explanation of of network policy and and take it from there so cool. I think we're pretty much ready to get started everyone so uh bringing it all back here.

A

We are looking at gateway apis today, specifically looking at contours, uh well really looking at gateway apis, but using contour as a way to explore and analyze these, because, like most apis or or I guess, some apis right network policy as an example, network policy is great, but without a cni that enforces it and implements it right. um It won't actually do anything so same with these gateway.

A

Apis we're going to be exploring them, then using contour as a thing that kind of executes them, hey, abc glad to see you, as always um maddie, says anyone actually using network policies in production. If so, how do you manage all of those with a bunch of apps um curious if you have tools that automate? That that's a great question maddie. It can get pretty chaotic with network policy. You know one thing that I've seen quite a bit as as a model not saying that this is the best model.

A

Is that namespace scope network policy can be a little tricky and hard to manage over time, especially like. If you have some default rules that you need to deny on and then poke holes in every individual namespace from there. One thing that's helped me out. A lot is using cni providers that offer a cluster scope.

A

Network policy has been really really helpful so that, from a networking layer we can kind of set the baseline of denies, be it like completely locked down or otherwise, and then enable folks to poke holes in each namespace to open up the pieces that they need. um But even that can be tricky right, because if you just give everybody the ability to put any arbitrary network policy in their own namespace, why wouldn't they just open up all the access right? So a lot of times?

A

That's where some admission, control and validation um has to kind of come in in the acceptance chain of those api objects as they get submitted to clusters. So it's a tricky question. I'm super curious to see how other people solve it. Hey chris great to see you um let's climb soon, it's it's snowing in colorado, so it can't happen out here, but thanks for joining us today uh and hope, the new gig at twilio is going well all right gateway apis with contour.

A

Let's do this thing, so we've got a link in our show notes, uh we're actually gonna start with the gateway, api docs and maybe talk a little bit about these and um yeah just try to try to learn a little bit about it. Okay. So this is a project that I this is from. What little I know, a project that comes from the sig networking community. um Its goal is to give us some networking apis in the kubernetes ecosystem.

A

So, as you probably are very familiar with, where there's some lovely objects we work with daily services, ingresses and so on, and I think you know a lot of what we're going to look at today is largely coming out from our exploration of these apis over time and learning a little bit about some of the gaps that they might have in both their ability to do routing rules and especially the ability to sort of define rules at a higher level that can then be perhaps inherited at lower levels.

A

Kind of like we were talking a bit about with network policy like how it can be kind of complex when you get to the application developer level, where they just care about their singular route. In you know what settings and configuration should kind of be inherited at that at that higher level right um and chris, I'm not going to ice climb with you. I'm sorry. It's only going to be dry rock, but I appreciate your your sentiment with the with the ice tools.

A

um Okay, so let's, let's take a little bit a closer look at these. So um some of the things that they're touting uh well, let's look at the diagram first, so some of the things that we've got going on here, I'm gonna draw some stuff, as as we go as usual, um we'll bring in there their little picture.

A

Okay, so first things. First, it looks like they are targeting different personas inside of here, so infrastructure providers defining a gateway class which is interesting. The cluster operator defining this construct called a gateway. So I think one thing we'll want to figure out today is: what exactly is the relationship between gateway class and gateway?

A

That'll be a really interesting thing, like you think about class, and my mind goes to things like storage classes, right that we're used to in kubernetes, where you can define a storage class and then you can go in and have a pvc, a persistent volume claim reference that class, which will then provision the storage.

A

So I'm curious, if there's somewhat of a similar model here, so we've got gateways and then we've got the actual http routes themselves, which are very likely crds that are going to have layer, 7 rules about path or host evaluation to then route us into specific services which, under the hood typically goes directly to the endpoint ips of of the pods right all right, so I think we're looking pretty good.

A

We've got kind of a layout here, some intuition about what might be going on. Some of the things that we're talking about is how can it improve on the current standards of ingress, so more expressive? This has been one of the big things we've hit with ingress. Constantly right is: how do we make something that can be more expressive in things we want to do at layer, seven like header, based matching traffic weighting, other capabilities.

A

um If you've seen a tgik before where I've talked about ingrass, you might be familiar with uh my work on, or I've talked about my work on what used to be the aws alb ingress controller. I think now it's just like the aws controller back. When I was at coreos, we built this out using and it satisfied ingress apis, and I remember the first thing that we started doing, which was just hideous, is because the api wasn't expressive enough.

A

We just started letting people fill in all these annotations in the ingress object with rules about how the route would work into the service and what ended up happening is we ended up having I'm sad to say it, but we basically like allowed annotations to accept json as their value so that we could have more uh concrete rules injected into the ingress and it was totally crazy and totally chaotic.

A

So this seems like something that's largely gonna solve that um more extensible role oriented um it seems like this is probably what they're getting out with role oriented where some of these pieces can be inherited in generic. So by generic. This isn't an improvement, but rather something that should stay the same. Just as ingress is universal gateway. Apis are designed to be portable to many implementations. So what this means is today we're going to look at contour, but in theory, with the spec being specified by sig networking.

A

We could plug in traffic or any one of the other ingress controllers, to sort of satisfy that so pretty pretty cool stuff. um Okay, I think we're ready to try to get started and play around with this a little bit. um So one of the first things I was wondering is kind of the difference between the gateway class and gateway. Maybe we could take a quick look at that if the api reference tells us anything all right, so gateway class gateway class describes a class of gateways available to the user, creating the gateway resource. Okay.

A

So what kind of stuff do we have inside? The gateway class um looks like we could specify a controller okay, so controller is a domain path. That indicates the controller that is managing the gateway. So I'm guessing that this is going to be pointed at contour in our case, to ensure that the thing satisfying this specific gateway class is an instance of contour. So we can try that out.

A

Okay, parameter, ref um parameter ref is a reference to a resource that contains the configuration parameters for the gateway class. Okay, so basically the the configuration that we'll be putting in okay, so that's gateway class, what's going on with gateway gateway, represents an instantiation of a service traffic handling infrastructure by binding listeners to a set of ip addresses. Okay, so this probably has a reference to the gateway class somewhere. It looks like it's going to.

A

Let us put the listeners in place so probably our ip addresses or specifically, if we're listening on https or http- that all makes sense address is requested for the gateway okay. So this is optional and behavior can depend on the gateway class.

A

Okay, so it looks like we can specify gateway addresses, along with some properties of the listeners. Specifically, so perhaps ports- and you know, weather ports and protocols- I guess more or less okay and then there's the reference to the gateway class name. Interesting, all right seems pretty good. Let's see if we can get this working so first things. First, we've probably got to deploy some of this to a cluster, so I've got a cluster stood up here with some junk. I was testing earlier today, but pretty standard cluster.

A

This is just running on one of my my hosts inside of my lab at home, and the first thing I think we've got to do is install the apis because remember these aren't new first class apis and kubernetes. It seems the approach they're taking is to go forward with crds and then I'm not really sure how kubernetes does it nowadays like? Perhaps these will come like first class supported, crds or perhaps there's a potential they could end up in core. I don't really know how some of that's decided nowadays, but but something like that.

A

Nonetheless, it's incubating as as seemingly a set of a set of crds, so this project requires greater than kubernetes. 116. seems reasonable.

A

Let's see if we can get these deployed all right, so we will just do a quick watch here forget crds, okay and then I will go ahead and apply down here uh and I've been practicing hitting ctrl l on my keyboard to clear by the way, so you all might not have to watch me um type clear and incorrectly like 20 times in this episode. I've been working really hard on that, for you all you're, very welcome, um okay. What do we got going on here? So http routes?

A

Okay, we've got gateways now, we've got gateway classes that all seems kosher. um Okay, so we've got seemingly three new apis. I probably should just double check so get crds for networking.

A

Let's see, if there's anything else, I was missing in there a couple a couple apis, so we've got back end policies, gateway classes, gateways, http routes, tcp routes, tls routes and udp routes all right.

A

So I talked to some of the contour folks and I think I caught wind that specifically http routes or what's working, so it's probably what we'll? What we'll check out today steve says class should give you a configuration of what a gateway should look like so think of class, as your lb specific configurations got it so like internal external load, balance or things like that makes sense. um Maddie says it's super cool, hopefully the nginx ingress controller won't have hundreds of annotations in the future yeah fingers crossed.

A

I, uh oh man. We we packed a lot of things in annotations in the early days of kubernetes, but hey it's kind of all. We had right, I mean I guess we could have done like a config map or something but too complicated too complicated um anyways. I guess a config map would be. It would be a slightly different, slightly different use. So all right we've got those installed sample gateway.

A

Once you have the crds and implementation installed, you're ready to use the gateway api all right, um so it looks like I can set up a gateway class, a gateway and an http route. Now steve gave me a little guide, that's contour specific that I might go to, but I'll tell you what here's? What we'll do to kind of take it step by step? Let's get! uh Let's get the contour instance installed.

A

So we know that that's working and then we'll see if we can plug some of these bits in to get things routing into it. All right so alex had mentioned installing the contour operator. So let's go ahead and check that out. Github, so contour operator is something that manages instances of of contour. So in the operator model this should enable us to have something that can manage the life cycle of contour, but a lot of operators.

A

It kind of gives us flexibility through crds to instantiate instances of of contour right, like a lot of you have probably seen the prometheus operator where, with crds we can instantiate an instance of prometheus and it will bootstrap and kind of life cycle manage that and I'm guessing there's a similar story here with the contour one. So, let's see, if we can do this here and I think steve you had mentioned that there's a flag that I need to use is the contour operator gonna. Let me put that flag in to the contour instances.

A

I don't know if that'll be a problem or not, let's go ahead and let's go ahead and bring this down real, quick, so I'll get the contour operator and then we'll look inside here, operator.yaml, okay, so this will install a contour operator. As expected, um steve says this readme should work: okay, cool cool, alpha namespace, let's see what we got going on here, so there's the crds that it's going to bring in.

A

Okay and just custom resources, custom resources make this a little bit smaller. Here we go okay, so to do all right, lots and lots of custom resources. We'll get past these real quick see. If I can find anything on the uh the deployment itself, let's see kind deployment there we go all right, so we'll be deploying contour operator and then again remember. This is not the instance of contour, but more so the thing that's going to make the instances of contour and it looks like it's going to use.

A

Let's see here, contour operator, envoy, okay, yeah, let's deploy it, I don't know much about the operator so we'll check it out, uh apply, operator.yaml, okay and we'll get all that deployed. So with the operator in place, we'll do a quick, get pods see what we got here and it looks like we've got a contour operator being instantiated in this uh contour operator namespace. So it looks pretty good. Let's watch that real quick and we are now running okay, cool all right, so we've got that installed. We've got the crds in place, um okay.

A

Now this is what I was talking about. So when you have the operators instantiated, you typically are going to use crds to create instances of the thing so contour is not running. The contour operator is running to get the instances of envoy stood up and then the controller that actually translates. You know these apis into envoy and programs them we're going to need to set up a contour custom resource. So, let's start by grabbing one of those real, quick and we'll we'll check it out. So we've got this here.

A

Okay, and this will be committed to github too. If anybody wants to check it out after the fact looks, looks pretty simple, okay, so an instance of contour. It looks like we're not doing any specific configuration in the crd and when we apply this, the operator should see it and then create our instances of of contour from there.

A

So, let's see, if we can, if we can make that work um cool, so we will apply contour, yaml great and then let's get pods here again, okay got a little bit bigger cool, and now you can see in the bottom, we've got in the project. Contour namespace some new instances of contour being created all right, very, very cool uh guami. You said chris nova. When are you back on tgik? I think we should co-host with chris as soon as possible, we'll have to talk joe into it. That'd be really fun.

A

um Oh chris said the same thing below yep, we'll have to talk to joe and get chris on soon, all right cool, so it looks like we've got contour running in this case. uh It looks like these top two are probably the contour controller, which is again going to be looking at the apis and then eventually, programming uh envoy, in this case, to get the traffic routed into the specific workload.

A

All right all seems pretty good, so uh yeah. I guess we could test with ingrass, maybe real quick, just to make sure from like a bare bones standpoint. Things are working before we switch over to the gateway apis, um just because, if something goes wrong with the gateway, apis it'd be hard to know if things work in the more normal setup. So we'll uh we'll do that real, quick, we'll just do a quick, quick apply of this. Okay, put it in place oops.

A

I do not want you in my way: intellij, okay, cool great, so we'll do a cube, cuddle get pods and we've got this little default instance that is supposedly being routed to let's check this out. It probably just did a standard ingress object in this case, so yeah all right. So these are the typical ingress objects that we have with kubernetes um stuff. That's going to. Let us define layer, seven rules. In fact, let's just let's check out this particular one real quick.

A

So this is that with o yaml and we'll do a quick, less okay. So if we look inside of the spec, nothing too crazy, we say: hey here's! The back end service, in this case, it's pointing to this app. uh Now it's pointing to the service name and as we've talked about before in tgik, the thing to know is like it uses the service almost like as a map lookup or or just I guess, a look up to what the endpoints are under the hood.

A

It's not necessarily going to route to the service ip and then rely on ip tables to route out. Most ingress controllers are going to read this understand that this app has three instances with three endpoint ips and then route directly to those pod ips. So really we're kind of using the service as a bit of a reference here, and then it's also saying hey. I want you to do this on port 80 on the back end, all right, cool.

A

All right, so, let's see what we've got here then so we've got that in place. um If I do a quick get pods for uh for contour, let's see here, my instance of envoy is right here. So if I cube cuddle get the service for the namespace project contour for envoy um oops, what am I doing? Services inside of project contour, okay, envoy load, balancer pending, but it does have a node port set up.

A

So I'm running on vsphere I don't have metal b turn metal, lb or anything turned on so I'll, probably just try to push through node ports today to see if I can make that work. So if we do a cube, cuddle get get, pods, wait, sorry get nodes. One of my ips is oh geez. What are my ip addresses? That would be really helpful to know, let's figure that out real quick. So if I go to my ips here, let me just log into my my home lab and get my ips out schrader.

A

Actually I can see it from the kubernetes api. What am I doing so we'll do a cube cuddle describe node here um just like that, and my ip address should be in here.

A

I think it should be in here inside of describe there. It is 192.168. marcos. You said oh wide. ah Does that tell me the ip, probably you're, probably right um get nodes? Oh wide.

A

Let's see I'm curious now that would have done it internal ip, external, ip, okay cool. So uh let's write some things down, because my my crazy brain will not remember so my node ip is this: uh let's get the node port again, so I don't forget. So keep cuddle get service. Namespace project contour, the node port, is 30697.

A

So remember: node ports are ports, we open up effectively on every host and we route into them and they will balance out depending on your cni plug-in, probably through ip tables and eventually get to the workload that underlies them in this case, that workload is envoy right. So in theory, if I curl 192.168.2 201 at 30697, I get some application which might open up in the browser. Let's see so boom boom boom.

A

Hey there, we go cool so step. One complete we have, we know nothing about whether the gateway apis are working, but the good news is contour is working um so we're routing in through envoy again, in my case, I'm going in through a node port into my host down into envoy and then eventually going down into the application itself.

A

Okay, um steve says that operator guide is more generic run contour, but you can reference that contour crd from the gateway class, perfect steve, no problem, uh there's a gateway, specific guide on project contour uh can put in the notes. Yeah. Please put that in the notes. I think if it was the guide you sent me a pr on. I have it in the notes already, but double check.

A

Maybe it's a different guide that you're talking about um and maddie said: can you use keep cuddle port forward instead and maddie is totally right and that would be way easier, but for some reason I like doing it the really really hard way.

A

I always forget about port forward you'd, be amazed by the insane things I've done with like changing my routing tables and things like that. To make this work when in reality I could have just used cube cuddle port forward.

A

The simplest solution is usually the right one right, but sometimes not for me: okay anyways, so we've got that in place. We've gotten this far and we've got contour set up. So, let's, let's do a little bit of clean up just because I don't want to mess things up too much. So we applied this example. Let's go ahead and delete this example and uh cool, we'll get rid of that, and chris says: don't use strong, minus one to route tables yeah. I know it's not good, not not claiming it's good.

A

Okay, I I know it's very, very bad all right, so uh we've got that good um and now we're gonna try to hook in some of these. uh These gateway classes, stuff, uh some of the gateway class stuff. So uh steve you had mentioned putting something in the show notes, I'm guessing that this was the example that you had sent me. So let me uh let me take a quick look at this too and make sure I don't veer too too far off here.

A

Okay, so gateway class gateway routes, we've got contour deployed. um Well, this is the this is the crds for the gateway apis. We've got that deploy contour we're doing the operator, so fingers crossed that doesn't cause us any pain, um and then there are some sample resources for common and uh for the gateway itself. So, let's see if we can, if we can figure some of these bits out right, we'll look at the look at the common one.

A

First, all right, so we'll w get that okay, look at one common, maybe what the heck did it just call it? um huh What happened w get 404? Why do you hate me.

A

Okay use option two for the operator: ah thanks, steve see you you're already you're, already saving me from going down a crazy path and I was getting a 404 anyway, so um using a load balance service using a node port service, okay, cool. Let's look at the let's look at the gateway configuration for the for the node port piece, um so we'll go ahead and w get that okay, that one gave me a 200., um so gateway.

A

Okay. What do we got going on so namespaces here? Namespace project, contour, project, contour, okay, so in this case it's setting up some extra configuration for us inside of the contour crd, so it looks like the contour crd is referencing a gateway class that we're eventually going to deploy up and giving some details about node port service. So we'll check this out in a moment I'll delete my other crd, but my guess is that this is probably going to.

A

You know right now, we're using like cluster ip to uh node port to uh load balancer, and since I don't have a load, balancer hooked up. It'll, probably just stop me here and expose it as a node port. Okay. So gateway class, let's see what we've got going on here: okay, cool, so this is what we were looking for. It looks like there's references in both directions. I suppose right there's a reference on the controller which is probably telling a contour just like you would tell a csi driver or something like hey.

A

This is the storage class or the gateway class you care about like this is yours to satisfy right and then to some degree on the api for a gateway class. It looks like we also reference what controller um actually satisfies this? Now? I wonder I don't know if you know offhand steve or anyone from the contour team, but like does this, have? Does this specification on the gateway class have like a functional purpose like? um Is it doing anything to like scope itself in a weird way?

A

I I would assume not like, I would think any controller could see this gateway class with the right permissions. I don't know if this is more of a piece of metadata or if it has like functional purpose and then some of the parameter stuff. So, as we had mentioned, there's this idea of parameters in the api. So let's, let's go back to that real quick api types, gateway class.

A

Okay, um let's see here, api reference go docs for the package, we'll see if we can see it here, so we've got the gateway class right here: okay and then inside of the gateway class, we've got the spec and then the parameters ref inside of here, which looks like it's giving us the ability to reference in this case some of these different fields in here so group kind, scope, name and name space. So maybe this is where it's actually scoping.

A

Somehow what the kind of functional purpose would be for the for this for satisfying this crd, I'm not really sure, um but the scope uh specifies it that it's going to be namespace scope, probably rather than cluster scope. Let's see if it says that in here, namespace is a field. This field is required, scope to set namespace and ignored when the scope is set to cluster okay.

A

Scope represents if the referent is a cluster or namespace scope, resource the name, the kind and the group. Okay, let's see steve says supposed to tell the controller that it should manage that gateway, contour, watches a single gateway at the moment. Okay got it, got it cool all right cool, so we've got a gateway class. We've got a contour instance.

A

Oh and it looks like they've got a sample gateway in here as well, so maybe we'll maybe we'll bring the sample gateway out um and and bring that in as a second step just for the heck of it. So let's do the actual gateway itself here. I'll put that oops I'll put that right here: cool we'll, go ahead and save that up gateway, node port yml looks good okay. So what do we got going on here? So, okay get contour.

A

We've got a sample contour. Let's get rid of this one, just to make sure it doesn't mess us up so we'll delete the crd contour the instance of that contour sample okay and then, if we watch our pods one more time, we should see that the contour instance is terminating and what I'm going to do is bring in this new crd from the guide. We've got and instantiate another another instance of contour here: okay, almost there terminating terminating.

A

And then steve says the parameter ref and the gateway class reference is the contour operator, specific crd for the contour specific configuration got it. So I guess steve, that's probably what makes it um pluggable per implementation right, wherein what you would point to on uh in traffic might be different depending on what things that they expose in in that crd, or in that configuration, I should say so: cool we've got the contour operator all right. Let's get this thing deployed, then so we're going to apply the gateway, node port here.

A

All right and then we will watch some pods. We've got another instance of contour bootstrapping up and an instance of envoy getting set up as well seems pretty good okay.

A

So, let's see if we can get back to this guide here, okay, node ports in place looks like I'm going to be redeploying the same sample app again as well, so I'll just go ahead and step step ahead and just deploy this uh deploy this piece real, quick, so we'll get rid of that we'll do a quick, apply cool and then let's watch pods one more time here make sure that our um our sample app gets spun up here.

A

A

Some rough error on apply: let's see it's missing the value resources for create yeah. That I think this is just telling me that I should have used um should have used a different command. uh Yes and marco said you removed the gateway. Yes, I do still have the gateway removed, so we'll we'll bring that back in in a second. um Am I missing my uh my app? Am I going? Oh? No, it's at the bottom. There, okay, we're good! So we've got the we've got the app running in the project.

A

Contour namespace, I haven't put the gateway in place, so um let's go ahead and bring let's, let's take a quick look at the gateway and then bring that in real quick. So, oh josh did you not save the gateway yaml? I think you might not have how the heck did you do that?

A

Okay, no big deal, let's go ahead and get the gateway node port, one more time and we'll just look inside of that so gateway node, port yaml and then here's the gateway class that we've got specified and, oh, you know what it brought it down as a second one. One.Yaml there we go. Okay, sorry, hang tight. Here we go one yaml, we're gonna move gateway, node port yml1 to gateway node port yaml.

A

There we go okay back at it gateway, node port, all right, so here's the gateway that I had gotten rid of before so gateway has seemingly some configuration inside of it. That is going to specify, as we had learned our listeners right. um Okay and the listeners are routing in or specifying the protocol in the port, like we talked about earlier, so taking https if available through 443 and then http, and then the only thing that I don't understand- and maybe we'll figure this out in a moment is why are the routes defined here?

A

That seems really weird right, isn't the am I losing my mind or the route objects and the gateway objects separate things right, because I had imagined them as http routes that reference the gateway object, but maybe I'm losing my mind here is the gateway object, one thing that also defines the route itself.

A

I don't know, let's see if we can figure this out, I'm sure it'll tell us a little bit later so I'll do a quick apply for the gateway, node port, again cool, okay and then we'll do a watch which I think, from a pod perspective, probably nothing's going to change here. We've still got this in place. I would imagine it is programming envoy to some extent- um and it looks like oh, it looks like it redeployed the the controllers as well.

A

I wonder if that was something that I mucked with we'll give it a second here, all right cool. So is it routable? Now that's what I'm not too sure about so testing the api gateway or testing the gateway api uh we've got the quick start started. We can probably figure out how to route into it.

A

So let's go ahead and see if we can do that again, if we do a cube, cuddle, namespace project contour for services, we've got the envoy node port at three zero, zero, eight 0 and then, if we just grab this over here, the ip address we'll snag that real, quick, okay and we'll do another curl for this ip at 3, 0, 0, eight, zero, okay and nothing's coming back. So what was the route that I set up in there?

A

The route was matching this on http, on port 80., interesting. Okay, all right so steve says: gateways need to select which routes that a gateway can process, huh interesting, alex, says, gateway and http route will reference each other needs bi-directional bind for it to work. huh It seems really weird to my brain. I can't understand why that would be necessary, but I must be missing something: okay, so we've got this in place and I'll go back to the guide here. Let's see so, we've got um the node port service set up right.

A

um We created project contour. We created a sample application right here. Okay, now uh verify that the resources are available. Okay, I think we've got these available. Let's double check here so yep, those all look healthy, are running, there's a service, fronting them and then there's an oh, the http route got brought in with the app it looks like okay, so that I missed that little detail. Let's check this out real quick. So inside of here it looks like we're, maybe specifying an http route.

A

I assumed it was just deploying the application so we'll grab that and we'll see if there's an http.

A

There it is http route, okay, cool, okay. This is kind of what yeah okay. This makes more sense. So this is what I was expecting from. Like a routing rule perspective, I'm still a little confused. Oh, this is probably why I didn't route by the way. It's it's specifying a host name here, so I can just mock the hostname and trick it um yeah, the okay, so the http route.

A

This makes sense to me. I I still don't grok the relationship with the gateway specifying the route, though, for some reason. uh Let's, let's see if we can get this to work, real, quick and then we'll we'll brainstorm as to how exactly this is working. So I'm guessing, it probably just needs this host name, which is totally fair. If that's the case, so we'll grab that we'll do the curl again wherever the curl was curl. This and let's see, if I can remember my curl stuff um hostname, no, no, no, no, not what I wanted.

A

Okay, curl h, hostname, local.project, contour, dot, io, oh geez josh come on come on there we go. We got this. We're gonna! We're gonna find our way through this. Okay, there we go, we've got 92192.

A

um Do I have my headers right? Hostname, let's see gateway, jsonpath hostname, oh host jeez, uh it's friday, everybody it's friday. Come me. Cut me cut me some slack there we go. That looks a lot better. Okay! So now now we're hitting it with the with the right host header, yeah uh marcos, yeah, you're, exactly right! Okay, let me let me read what you all are saying in chat here, because you're probably trying to explain to me why?

A

So let me let me bring up where I'm confused. Why does let's get rid of this and this? Let's do a quick split and let's look at gateway, node, port, okay, here's what I'm confused about in the bottom here. I've got the gateway and it specifies listeners with the routes, and then these seem to reference or be implied to reference this particular route. So why do both of these need to exist? Okay, so looking at the bottom one here, the gateway is matching the app it looks like right, so the gateway is actually saying.

A

I'm going to resolve the http route against this specific app and then the okay. I think I'm starting to grok it. So it's decoupled in the sense that, like this, is actually going to have the rules about.

A

Oh no, it says forward too it's still resolving against the service name. What the heck! Okay, I'll I'll read, chat before you all uh before I drive you all crazy um marco says the route in the gateway is not the definition, but just a reference to that http route. That's what I'm thinking um uh steve says. Multiple gateways can select the same routes.

A

Interesting. Okay, the example has label selectors to find which ah okay, this is where I'm getting confused. So what you're saying here steve is that the selector right, the selector right here the selector, is actually selecting the route object. Does that make sense everyone? So, where I was getting confused is I was like well why the hell is the.

A

Why is the gateway, selecting the app service, because wouldn't the route do that and the route seems to do that right here? um But in reality I think. What's if I'm grocking, what steve's saying is you can have multiple.

A

Multiple routes resolve against the gateway- maybe I'm saying that wrong, but effectively. This selector here is selecting against this specific http route. That is that is set right here, that seems to be seems to be the relationship um I'm still trying to work through in my head.

A

What the value add is with that. So if I have another http route that resolves against this service, I could tie it to a different gateway. I guess which would be kind of interesting on a unique path, and things like that interesting, okay, dennis said, the gateway class has a reference to http routes, but it's not a list. So there's a one-to-one relation single gateway, yeah, I wonder, dennis if the label matching.

A

I don't know if the label matching could be used, generically enough to match against two routes that share the same label. Perhaps yeah. It's interesting, it's kind of it's kind of hard to hard to wrap my head around honestly, um hmm okay, okay! So let's, let's see if we can map this out and if I, if I just make it more confusing, then I'll just give up but okay, so we've got uh okay from an api standpoint right and we'll keep we'll keep their diagram around here, too right.

A

So from an api standpoint, we know that there is the ingress class piece right, ingress, class, okay, and we know that the ingress class sorry address class, geez gateway class. All right.

A

We know that the gateway class defines some configuration and specifies a reference to a gateway. So here's our gateway class right- and we know that the gateway class references, this specific controller- and we know that it's looking at specifically the contour configuration and where it could, where it can find that contour configuration.

A

So it references the contour gateway sample um contour operator, which we can see down here, is the uh contour sample gateway and then down here wait: where did my gateway go gateway? Gateway name is contour namespace contour operator interesting. huh That mapping doesn't make sense to me, okay, so, okay, so anyways going with going off of their diagram here, oops. What the heck just happened. There we go going off their diagram, we've got the gateway class, we've got the gateway itself.

A

Okay, all right and this seems to have a mapping into the gateway. Somehow, okay gateway class is mapping into the gateway, so parameter. Ref is looking at operator, contour, namespace, contour operator, okay, cool. So, let's see here.

A

Okay, alex says he has to hop out thanks for joining us today, alex we appreciate it. um Do okay, alex says um the http route mirrors contours, existing http proxy virtual host stanza. Essentially, it's application routing, the gateway has a bunch more stuff in it. It represents the load. Balancer config, so multiple contours deployed can reference the same route resource. I believe, although not sure, if that's been tested, okay, interesting, all right, so we've got the gateway and then basically, I guess really based on their diagram. I guess I'm kind of recreating it here.

A

We can have multiple http routes that reference that same gateway or it can be. I guess I should say can be selected by that same gateway. So maybe we'll try that out to see if we can kind of prove this out and understand it a little bit better. So in theory, I can have this http route that goes down to uh this app that we're using right and then I can have maybe another http route that goes down to the same app.

A

I guess in a way if it's routed against the same service name, but maybe this one is saying something like hello there and the listener maybe could be configured to do something different, and this one is obviously just routing against forward slash and they could have different listener declarations so like what protocols and protocols and ports they're listening on, I suppose could be- could be unique.

A

So, let's see if I can make that work just for the hell of it, um so we'll go into here, real quick and let's look at the uh the sample app, which has this hdp route real, quick, all right. So we will do a gateway2.yaml here. Okay,.

A

Great we've got that okay cool, so I guess okay, so in theory like when we think about how the selection works. If I screw with this- and I say, foo right- um and I put this in place with a different header- let's say the header we'll make the header unique- maybe oh no same header and then we'll do a value of what did. I say: hello there: okay, hello, there cool, so that's the prefix and then it's going to route into the same app.

A

Now, if I'm understanding the relationship of how this all resolves, I think this shouldn't get picked up because the http route set up in the gateway doesn't have a selector oops, I'm looking in the wrong file here, let's go back to the uh the gateway node port, because the selector inside of here is only matching against things that are. um Are that have this app label, so in theory this would probably be like an orphaned http route that doesn't actually get satisfied by the ingress controller. That's that's kind of my thinking in this new model.

A

I'm trying to tease it apart here a little bit. So if we just apply.

A

uh What the heck, if we just apply gateway, 2, so cube cuddle, apply gateway, 2, okay, oh josh! Why did you just do that? You didn't change the name, not good gateway to okay, we're gonna, we're gonna go back so two all right. Let's, let's apply this again so apply the example.

A

Yep okay dennis says, with the current setup. The second test will return the first http route, prefix matching, let's see okay, so I will apply again route. Two okay.

A

Apply gateway to which is really an http route: okay, cool so now inside of default, I've got two http routes, I'm pretty sure, or I've got them somewhere inside of project contour. Okay, so inside of project contour, we've got two routes: same host name one's on a different path.

A

Now my theory here with the selection is again. This gateway is using label selection to determine which routes it should satisfy, and then the gateway is tied to the gateway class which has tied to the ingress controller that should satisfy it. So I think I'm maybe I'm definitely not grocking all the implications, but I think we might be starting to get somewhere with how this all resolves. So if this theory is correct, if we curl back to our original address, this still works just fine right. So that's all good.

A

um Now ah the other one was on a forward. Slash, though, wasn't it? um Okay, let's, let's play it safe, real, quick, we're gonna, go back to the example and change this to goodbye. Okay, then, let's apply this here, so cube cuddle apply this app again, all right cool. So, let's hit that doesn't work. That's what we'd expect, but if we go to goodbye now, does it work uh-oh?

A

Why does it not work um goodbye.

A

huh Is that what needs to happen? Let's see.

A

A

huh Oh right, the app doesn't have a path for that duh and it's I'm not doing url rewriting here. Yeah that makes sense hmm darn it hostname will work right. I can do hostname. I should have started with that. I didn't even think about not doing. I didn't even think that I'm not doing uh uh path rewrites here. Okay, so let's go with hostname uh forward slash. This will be uh test one test, one: okay and then this one over here for this will drive me crazy. It's not a gateway gateway.

A

Two should actually be called httprout2.yaml. Okay, so we'll do http route2.yaml, we'll call this uh tgik and then we will get rid of all this junk here cool. Let me check that out one more time that all looks good. Okay, so we've got test, one we've got tgik.

A

So will this work now that I'm realizing that I'm not just rewriting the path at the ingress level that I was actually passing that path down to the app? Let's see so we'll do a curl again. This obviously won't work, but I mean we're getting a 404. So if the 404 was coming from the app, then that's a that's a good sign. Local doesn't work, that's good and then um wow josh. Did you already forget? What did I call it? Everyone was a test.

A

A

I need to write things down. uh It was test one of course, because why just call it test you might as well put a number at the end. You know just in case uh that doesn't work either darn it. hmm You can swap card k, art out for which shows path, echo server tgik.

A

Why does my host not work.

A

What did I do? Did I screw up? Don't want to change too much on you, though yeah I hear you steve. I think the host should work. What did I? What did I do? Did I do something stupid? Did I redeploy the app and change the enough if it was the if it was the node port that was broken now, I would think it. Wouldn't let me route at all um so interesting, okay, so get service, and then the service name here for envoy is this: it's three zero: zero, eight, zero?

A

Okay, so that still works. Okay, okay, changed the changed label selector for the gateway dennis says. I think I don't think I changed the label selector on the gateway, so this is still the original route and then, if we look at the gateway real quick, let's open that up. So if we open up the gateway which was in gateway, node port, it's still selecting against that route.

A

Interesting what the heck is going on? Okay, I'll tell you what here's, what we should try, because I think we're really close to figuring out how all this mapping works, I'm going to redeploy the sample app again make sure I can route to it. Then we'll change the host name and make sure that doesn't break anything and then we'll try to introduce another http route to show how this this resolution works.

A

um uh Khazrow, you said: did you apply the recent changes? I think I did, but now that you're saying that I have no idea. So, let's just try it again: okay! So here's what we're going to do. Let's go back to the example and let's grab this one more time and I'm even going to be so careful that I'm going to just go ahead and bring this file down again.

A

Okay and then we're gonna move this into what this is now: okay, we're going to delete f, probably something I should have done before- get rid of all that we will delete f the uh gate, http route, 2. yeah great, all right!

A

Let's try to wire this all back up again, one more time so inside of this I'm going to bring the http route out. Okay and we're going to put this inside of http route1.yaml.

A

We'll put the gs, we'll put this right here. Okay, so now we've got http route 1 and then eventually, we'll have http route 2 and we're going to redeploy the entire app stack on top of that. So if we do a cube, cuddle get http routes, nothing we're starting fresh here right, so we'll apply the app cool um cool cool, oh and ilco. You said you can use paths like ready, api, okay, cool, so that it has some extra endpoints. We can.

A

We can check that out too or not endpoints, but paths that it can resolve against. Okay, so we've got that applied, get pods a okay, it is running lovely. So now, if we apply http route 1 does everything work the way it used to work, so we will do a cube cuddle get service. Let's just do it for all make. This smaller envoy has not changed its node port, which is good.

A

So in theory, if I curl against uh whatever the original one was local, do we get a page back? Thank goodness, okay, we are in a known good state. That's that's! That's the important thing here so now that we're in this known, good state- and this works. Let's just change the host name of the http route and make sure that's all cool, so we'll go ahead and do this oops sorry of http route 1 and we're just going to change this, to say hello, tgik great, and we will go ahead and apply this.

A

It has been configured.

A

Okay, so now check me here: everyone, if I screw this up but hello, tgik, lovely okay, who knows what the heck I screwed up last time, but now local should not work great and then hello, tgik should work lovely. Now to remind you of the point we were at before that all happened, it seems like as we're starting to tease out the relationship.

A

This thing is resolving what controller and what configuration to reference. This thing is providing then selection into which http routes it's willing to satisfy based on a label selector. So in short, if we take one more look at the http route 2 here, I change the label to foo. So in theory, I think that this http route right here number two, which is now just tgik dot right.

A

This should not work because the label selection from gateway should not come down, and thus the route to this should not be satisfied from the ingress controller, because remember, what's really happening here is like the cascading of these apis and the selection of these things is at the end of the day, something that the contour controller is picking up and then programming envoy to set up the routing rules.

A

So in effect by this relationship not being here I'd, imagine there's not going to be a route that contour, then programs envoy to route into for for tgik. But let's see if that theory holds true, so we've got labels foo here we'll go ahead and bring it over and we will apply http route, 2, dot, yaml, okay and then, if we curl again for hello tgik, this seems to work great now. If we do just tgik.

A

Does not work so so far our theory is correct, but to rewire this back up, then, if we just either I mean I guess we could change the gateway selector in here, which I don't think the gateway selector took an array which is what was it? Who said that earlier? Was it dennis that said that somebody had said it in chat?

A

I don't think the gateway takes an array, um so I think the label probably needs to be the same um on both of the objects, but let's just double check that real, quick, so gateway, node, port um cool, so routes, http route. um So this like lets us select the actual kind. um So these would also be plugable it's. It would appear at least, which is great so like if we have a different api we want to use here.

A

Maybe and then the selector is going down to this label, and I don't see it as well. Could I do this, though I mean the whole thing is technically an array right. Can I do this and say um what did I put? Did I put foo?

A

I wonder if that'll work, I'm probably changing too much. Now, let's, let's see just well, could it would it be allowed to have two listeners on the same port? Is that just like a meta concept that it'll know? Okay, sorry, I'm jumping the gun here we're not going to take this much risk just yet.

A

Let's keep that commented out and let's just make sure that if we go in and change http route 2 to say uh this, instead that it will route into itself, so we'll apply http, route2 great and now, if we curl into hello or no just tgik, which is our second one there we go so now because of that selection, it knows hey, I want to go in and I want to resolve.

A

Okay, I want to resolve routes that use this kind of object, so this particular crd, which is another way that this in theory could be extensible and pluggable, and I only want to resolve route objects that match this label. So I think this is actually starting to make a lot of sense in regards to how it could be extensible as we go in and reference certain apis and what they resolve against and then remember.

A

Since this is then tied to the gateway class, which then is tied to the ingress controller, we've now got this full-on relationship. Now, I'm not gonna, I guess we could try it but like in theory, you might even be able to do something like this.

A

I don't know like it seems like you could plug in a different kind. Perhaps I don't really know if that would work, but um I'm curious if this will work if we did http uh as an array here. I wonder if this is like a meta thing that we'll just kind of know that this is not a problem, but no, no, let's try it. Who cares so we'll say that this is foo? Let's go ahead and apply this again, um so you know I really want to take that out, actually gateway, node port.

A

Let's, let's grab this real quick, so we'll take this whole chunk out. Okay and then we'll call this gateway, config.yml right and then we'll paste that in great um perfect, all right cool, so get rid of that cube. Cuddle, apply gateway, config.yml, okay, contour configured.

A

So now, if all goes well with this gateway configuration we've got in theory, I could match against labels foo, I suppose, for any of the http route objects and then put it up against port 80. now how it would handle conflicts and stuff. If there were two http routes with the same rules and stuff, I have no idea how that would work. Maybe that's, I guess that's something, maybe on the ingress controller's responsibilities to resolve if there are conflicts against two things that it selects and resolves against.

A

I have no idea, but anyways um seems like we've got that in place. If we go back to http route 2 here and then we change this to say foo, I wonder if this will work, so we will go ahead and apply this http route, it's been configured and then, if we curl against okay, so this one we'll start with hello tgik, just to make sure I didn't blow anything up all right, so hello, tgik is seemingly still healthy.

A

um Now, if we go in and do tgik, does it select against that it does okay, so in short, we were able to make multiple selections inside of here against. Potentially multiple label sets um for the http routes that we want to use, and you know this will probably be honestly not too uncommon of a configuration where you know. Maybe there are multiple labels we want to include in here, um but we still want both of them to resolve against port 80 when it when it comes in right, um so that could be.

A

That could be a common thing all right. I kind of think this is starting to make a little bit more sense. What do you all think is it? Is it more confusing less confusing, um so it seems like in short, uh we've got again the gateway class. Okay, we'll go we'll go api by api, real quick, so um we've got the gateway class here, which is gateway, node, port, okay, we'll look at this first all right. So what do we know about the gateway class?

A

Well, the gateway class ties itself to a controller. It would seem so in this case we're resolving ourselves against this. uh This contour operator contour gateway sample. So if we look at this in kind of like a really quick thing, so uh namespace contour operator get pods in the namespace contour operator.

A

Okay, so we've got the contour operator. What's the? What are the actual pod names? Actually now that I think about it: contour cert manager, where's the contour controller.

A

Oh there, it is right there, okay, so project contour, all right cool, um so we're resolving it against contour operator uh contour gateway sample as the name. I think this is maybe one part that I don't quite understand what the name of what, because it doesn't seem to be the contour instance- and it doesn't seem to be obviously like the contour operator. So I'm not quite sure what the name is referring to, but none it says kind contours. Was it actually referencing? The crd?

A

Is it that simple um get contour and namespace uh contour operator? Let's see? Oh okay, that's, okay, cool cool, oh and then gateway class admitted okay, great the relationship's starting to make sense. So sorry, it's the operator model in this gateway thing. That's really kind of racking, my brain here, okay. So what do we know? We know that the gateway class is attaching itself to an instance of contour which, in the case of the operator, it would make sense for it to be a crd, because the contour operator is not an instance of contour.

A

The contour crds that it will then satisfy is what's going to represent these instances of contour. So we've got the contour crd here, and this is referencing it and scoping it, and then this in short kind of references, many instances, one or many instances of contour right contour and then we know the thing about contour is when contour is instantiated. The underlying proxy is envoy right and effectively. What we know is that contour goes into envoy's little brain and it's like hey.

A

I know all these things about the kubernetes like apis, like here's, how you're gonna work and then envoy's like cool like I actually know how to send traffic um into this into this particular application.

A

Now, as we go layers down in the selection, we know that the gateway will reference a specific gateway class. So let's go back up to that and see if we can bring this full circle, so we know that the gateway configuration whatever I saved it as which is gateway, config, dot, yaml, okay, we know that the gateway configuration references, the gateway class and then these two are sort of bound together.

A

So if we do k get gateway right here, you can see that relationship, one up so gateway uh the gateway class, is attach this contour operator. The gateway is attached to the gateway class, so it has that resolution and that tie right there. So as the gateway then selects routes, those will belong to this instance of contour, which is which is starting to sort of make sense.

A

So we've got the gateway in place and then, as we've played with, we can set up many listeners that will specify the protocol, the port and then the potential apis.

A

We want to resolve again so, like I said um no idea like what's plugable here. If you can even do something like this, but in this case it's saying hey any instances of http route that resolve with this label selector I'm going to satisfy those inside of the contour which I'm attached to through my gateway class.

A

So then we go into the actual http routes themselves that the gateway is looking to select on and as long as one of them is selecting on this name right and then in this case one of them is selecting on this name.

A

These two http routes that a developer will put in will then be able to be resolved by this instance of envoy in the second we screw around and do something like tggik right. We then break that link um away because the gateway is. I guess I should probably break the link on this end right, because there's the gateway is not selecting on that.

A

So since that relationship's, not there envoy, is not going to get configured with that lower level um with that lower level application routing right, I think that is what's going on here, so uh contour team and others. You can tell me if that definition is wrong.

A

It's probably still a little bit spacey and chaotic, but that is very roughly what I think we've got going on here and if you, if you take a moment and really think about this kind of inheritance model and the selection and references it's going to give us the level of plugability that I think ingress has needed for such a long amount of time and the plugability will give us a ton of different ways to have certain ingress controllers.

A

That can perhaps satisfy certain configurations and thus have certain types of load balancing, but also that aside, just the ability, as like a platform operator to be able to go in and basically set up this higher level gateway construct.

A

Where we can, then perhaps let developers self-service their own http routes and as long as they match the label that goes against the gateway. I would imagine that whatever the proxy is, it should be able to eat it up and shoot the configuration into that ingress controller proxy that underlies it. And then the routing will just work. So we've got something: that's extremely extensible and pluggable, and we've also got something that really hones in on these different operational models that we have in most organizations, especially in big shops.

A

It's pretty darn rare that the developers that run the app in kubernetes own the stack from top to bottom, especially in like these multi-tenant systems, so a lot of times or even just multi-team systems a lot of times you need inheritance, constructs like this to enable there to be a singular api level that you can hand off to developer folks and really let them kind of uh kind of plug into it.

A

Okay, so steve says that's about right, it's way more configurable! I totally believe it steve, there's probably a lot more in here that you can. You can mess with and in tune with, but hopefully this gives you all a pretty good introduction to kind of how some of those how some of these resources work together and, at least for me, um I definitely understand a little bit more about how all these kind of apis linked together, because before it was uh at the initial onset, it was a little little confusing.

A

For me, I'm not gonna lie so yeah. Overall, pretty cool stuff it'll be it'll, be super interesting I mean steve, can tell us more but to see how this api develops further.

A

How quickly contour will actually go in, and you know, implement a lot of these pieces, and you know, aside from the apis being new and everyone giving feedback and all that stuff, there's obviously going to be some amount of runway where all the ingress controllers are slowly going to have to you know re-platform into this model, I guess in a way, or at least just comply with it, so that they can resolve a lot of these new apis that were that we're sort of looking at right now, so very, very cool, um yep and use.

A

If you said ingress route and traffic kind of looks like http route yep- and I think I think that's probably what blew up a lot of this need right is just you had traffic making their own crd. We had contour having their own crd, and it was largely to solve kind of problems like this, so it'll be really interesting. It'll be a good test to see.

A

Does this new model give us the extensibility to be generic enough, while also giving the plug ability to be specific enough when it comes down to some of the rules and capabilities of different load balancers, because all load, balancers or proxies really aren't made equal right? A lot of them have extremely different features that then merit or demand their own specific configuration and stuff like that, so pretty cool stuff, okay!

A

Well, this was really fun, um I'm gonna be sure to put the diagram and all the crazy yaml files that I've played with if anyone's watching this in the github repo. In case you wanna you wanna play around, um but as always thanks so much for hanging out everyone, um steve gave some resources for where we can give feedback um steve thanks so much and alex, and the other folks from the contour team. Thank you so much for hanging out today and answering questions really really appreciate it. I hope you all learned something today.

A

I know I definitely did and have an awesome weekend. Everyone hope you spend some time away from your computers and and do some cool stuff all right thanks. Everybody have an awesome weekend and we will catch you next week with what I'm sure will be. A super super interesting topic, all right, I'll catch you next week.

A

A