VMware Velero Community Meetings, 11 Aug 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Velero Community Meeting / Open Discussion - August 11, 2020

Description

August 11, 2020

Status Updates
carlisia
PTO last week
Reviewing PRs
Back to the last of migrating ServerStatusRequest to kubebuilder
ashish
Community support last week
Got to a bunch of PRs and GH issues.
Restore Hooks:
PR for Init container restore hooks PR 2787
PR to fix API tyes PR 2793
Fix to pass the --default-volumes-to-restic flag from schedules to the backup options. PR 2776
Setup CRD validation CI in GitHub actions PR 2805
Currently setup to run against kubernetes version 1.16.9, 1.17.0 and 1.18.4
AI: Switch to latest of each minor release
Restructuring build broke the EntryPoint for the restic-restore helper. PR 2802
PRs in the CSI plugin repo:
Updating the CI in the repo to push images with latest tag. PR 65
Better handling of restore when VolumeSnapshot resources exist but the associated workloads got deleted PR 64
nrb
Community support this week
Working on DeleteItemAction implementation
Design doc
Trying to get GitHub Actions working to automatically assign reviewers on PRs when opened. (https://github.com/vmware-tanzu/velero/pull/2807)
Aiming to have a 1.5 beta out by August 21st at the latest.
stephanie
We are aiming to have 1.6 release planning start following the 1.5 beta at the end of August
refer to our roadmap for items currently planned for December 2020 which corresponds with the 1.6 release
Velero security policy published

Discussion Topics
Introducing Bridget!
Let us know what Velero code you depend on
Velero-plugin-for-CSI PR 1902 KEP to add validation hooks on the VolumeSnapshot API objects.
Took a look at it and these don’t seem to violate our assumptions/expectations
Would love to have more 👀 on it
What versions of Kubernetes does Velero support?
Alay: Red Hat supports all the way back to Kube v1.7, will bump up to v1.9. Uses Velero v1.3
An LTS

Contributor Shoutouts
@alexcpn: Update minio.md
@bgagnon: Always use groupResource.String() when logging (fixes #2795)
@doughepi: Add the ability to set the allowPrivilegeEscalation property on the Restic restore helper via plugin ConfigMap
@RobReus: Reverting change on 1.4 docs and re-applying to main docs
@skriss: update CI badge on README
@a-mccarthy: update docs to include cpu/memory defaults for restic
@mtritabaugh: Add resource filtering page
@RobReus: Refactor image builds to use buildx for multi arch image building
@cfreemoser: Fixed wrong environment variable in Readme
@sabvente: Remove extra indentation from README

A

Good morning, good afternoon, good evening, everyone and welcome to the valero community meeting today is august, 11th, 2020 and um yeah. We get a bunch of things that we want to go through with you all. So let me share my screen and there we go so for status updates. First off we have carlesia today.

B

Hello, everybody I was on pto last week. That means vacation sort of- um and I am I there are a lot of prs so trying to get through those and there after that, back to the server status request, migration to queue builder.

B

um Excuse me, I had it all done and then I hit a little bit of a snag with it, which was uh I needed, to put a watch on that event. So it goes make a request.

B

Fetches the plugins or any whatever information needs to be processed on the server, and then I get back that information and doing that. With cube builder, I mean there is no because what I'm doing that on the client side, with the command line, um so in other words outside of of a contest of a controller, because, if you're doing a controller, there is a straightforward way to do that, to watch events for either that the corresponding object or even other objects, but doing that outside was not straightforward at all, so um there's no documentation.

B

I was poking around and asking people and finally andy gave me a hand right before I went on pto. He just said do the best he said. Well, if you do it this way.

B

There's this this you're gonna have this problem so the best way and that's anti-goats thing um so the best way to do it is do a create like a bare bone controller.

B

Just so you can add that watch to that resource, so I haven't actually I started doing it, but I haven't actually finished doing that and testing it, but I trust that andy knows and I can always ask him for more help if I need so that's where I am with that. So that's the only thing that is missing. I have the tasks going. I just need to be able to do that event and fetch the the stuff from the server. That's it for me,.

A

Sounds good any questions, comments for kalisia.

C

um Carlysi, I would say if you would like you, can create a draft pr, even if it's not finished, and we can, we can jump in and help too.

B

Okay, cool I'll! Do that I mean I'll, give I'm gonna after I do the pr reviews I'll give this a stab and I'll open after after year.

D

A

All right awesome, thank you. Kilicia! uh Next up we have ashish.

E

So for me I was on community support last week, so I got a bunch of uh triaging github issues and looking at pr's open, I don't think I have a pr that I haven't looked at. If there is one feel free to ping me on it.

E

Other than that I have a few p. I have a couple of pr's open for the restore hooks uh one implementing the api types, uh one fixing the api types, which is a pretty small change. uh So if you want to look at that, that would be great and then the other pr that I have is for implementing the init container restore hooks.

E

So I know uh andrew reed has been basing his work out of this pr, so it would be great to get this one merged so that he can work off of master uh kind of gives him a more stable ground to work on other than that, I have a few other pr's open one to fix. Passing the uh the default volume statistic flag from the schedules to the backup uh I realized. I don't have a link out to that.

E

I'm going to add that, as as soon as I finish here and then I have um then, when we restructured the build setup that we have, we kind of broke the entry point for the rustic restore helper docker image.

E

So I have a pr to fix that and then I also added a validation or a crd jaw, crd verification job in github actions. This is basically to test or ensure that our crds can be created on various kubernetes versions. So the motivation for that was with the restore hooks api types. uh There is a bug which prevents the crds from being created in kubernetes 1.18, and the intention here with these github actions is to catch such errors before prs get merged.

E

So um that's another thing that I got to take care of and other than that I also have a few pr's on the csi repo one is fixing our github actions, uh fixing ci to push like the images with the latest tag on it and then there's another bug fix that was stated for slotted in for 1.5, which is like better handling of restores when the volume snapshot, api objects already exists, but the associated workloads got deleted.

E

So I have a pr out to fix that as well. So that's pretty much been what I did last week this week, I'm I'm hoping to get all of the pr's that I have open merged and also do do some more pr reviews.

A

Awesome any questions, comments for ashish.

A

So one thing that me and ashish talked about yesterday is also starting up valero office hours so um as part of the community support portion, so we'll be looking at that and setting up a schedule and agenda and so forth within the next coming weeks. Here and we'll, let you all know when we have the the first one scheduled.

A

All right uh next up, we have nolan.

C

So this week I am on community support. um I have also started diving in on the delete item, action implementation, but I have that first pr um in draft until we get the design dock merged. I think I'm just waiting on one more approval um that first pr is just putting in the um kind of the the plumbing to have delete item actions that pr does not actually invoke any plugins or anything. Yet um that will be a follow-up pr.

C

um I've also been looking at some of our github actions for improving some of our our just overall process. So I've been toying around with a github action that automatically assigns reviewers on pr's, but I've been kind of bouncing off of the.

C

The github permissions with pull requests so uh when you have pull requests from forex, uh that does not give you permissions to actually assign reviewers or assignees on the pr's. So I've been going back and forth with the github api there, um and I just got a review today, uh letting me know my proposed fix. There wasn't going to work so um still trying to figure out uh the best way to kind of uh automate. These things.

C

Last late last week was taken up by um some scheduling exercises within vmware and I think stephanie's going to hit on that and also.

C

General interest is I'm aiming to have 1.5 beta out by next friday august 21st at the latest. Ideally we would have it out this week, but um we'll see how things go um so yeah. um If we can get restore item actions in there. That would be awesome, um but just to be clear with our priorities um we're looking to get the delete item actions in there um but restore item actions, uh we may not be able to get them all in depending on what what things are ready.

C

So um just we're just gonna, be just gonna, be upfront with that. um So.

E

We can always cut our patch release after.

C

Yep yep, we can do a do a follow-up and get the remaining features in uh or the remaining um restore item action work that needs to go in afterwards, so um that's more or less what I've got.

E

Nolan on the github actions for pr reviewers, would it be just straightforward to assign all of us, like all the maintainers, for pr reviews straight away? Instead of I don't know if there is some like, if you are like choosing some people to be assigned.

C

No, it's not it the the get up action it can like it. It can do it can do a lot more stuff than what I'm having it do, but I'm just having it assign everyone.

C

Okay, okay, it's it's really just so we don't have to go in and click every time, um yeah yeah, it's so whenever uh a um a pr is opened.

C

If, especially, if we use this pull request target, then we should be able to.

C

Add an assignee and add reviewers and I have more to say about the reviewer topic and the discussions. So um any questions any other questions.

A

All right, thank you. Nolan!

A

um Next up we have stephanie.

F

Hey everyone I'm a little under the weather today, so I'm just staying off camera, but um I did want to provide a few updates, so we're aiming to have, uh as nolan mentioned, you know, we're getting headed into the 1.5 beta release to kind of coincide with that. We also want to do some of the 1 6 release planning um following the 1 5 beta release towards the end of august.

F

Everyone can refer to our roadmap. The link is provided here in the hackmd again for reference for all of the items that are planned for december 2020 and that corresponds to what we're planning to include in the 1 6 release.

F

um Subject should change slightly if we, you know, have to make a few accommodations for the new release plan.

F

uh We have also recently published a valero security policy um that that is planning to be merged now, but we do have a security policy in place for valero, so that document describes uh the process that you know we'd like for the alero maintainers and contributors to follow um how you can work through security issues with the bolero team and how we will publish any vulnerabilities that have been identified on the valero code base.

F

So we're planning on getting that merged this week. And if anyone has any comments, please feel free to include those as well. That's it. For my end,.

A

Thank you, stephanie yeah. The the security policy here is uh vital for the other project as a whole. We want to make sure that we have a proper policy in place, even though we haven't had any any cvs or anything like that reported. Yet we want to make sure that we have this process in place. If such a thing happens, so you you all, will get um notified um when things happen. There is one part in here. That's really important to point out. We do have a new valero distributors mailing list.

A

This one is described down here, but it is essentially four people who package or utilize bolero in a a product fashion. So if you are a distributor of valero, please let us know and join the distributor's main mailing list. You can see the membership criteria here. We want to limit this, of course, to um just the focused individuals on this on this mailing list here. So please, let us know if you want to be included there and we'll go through the membership criteria with you.

E

We should also probably announce the distribution distributors mailing list on the google groups.

A

Yes, one once this is merged, we'll make an announcement out to the the rest of the mailing list, talking about the security policy and pointing this piece out absolutely.

A

um The reason for this distributors list- I I think I missed that is so you get advanced notice.

A

So you uh you are aware of these issues if future issues, um if they come up before we, we announce it to the.

A

A

Right any questions, comments on the security policy here or anything else that stephanie talked about.

A

All right, then, we are going into discussion topics.

C

Yeah, so um I wanted to introduce bridget. um So in the next couple weeks uh we will be having a new team member so bridgette. If you want to go ahead and say hello,.

D

Hi everyone, um so yes, I'm bridgette, I'm currently a country on the song boy project, but um over uh yeah. As someone said over the next few weeks, I'm going to be getting up to speed on valero and looking forward to getting more involved in the project.

A

Fantastic super happy to have you, brittany. I'm super happy to be here.

A

Does anyone have any questions for bridgette.

A

Nothing yet all right! um Next up we have the standing topic uh from carlesia.

B

Yes, so every week we're trying to let everybody know that we have a lot of our code, that is external, so a it could be utilized as library by anyone. However, there is, there are only a few packages that we intentionally want to expose and we listed them here if you are using the little codes from any package- that's not listed here, please let us know so. We know uh we are intentionally moving things uh into an internal directory structure, so we we hide what we don't want to be used as libraries.

B

So if you are using code, that's not belonging that don't belong to one of these packages. Please let us know we don't want to break your codes, so we'll work with.

A

You you kalisia any questions, comments.

A

All right, then, we are moving into this pr here.

E

So this is a pr that is upstream, uh that's related to upstream volume snapshot apis. This is describing this is describing adding validation hooks to the volume snapshot, api objects.

E

I took a quick look at it and it doesn't seem to violate our assumptions or expectations with the csi plug-in that we have for palero, but uh I would like to have more eyes on it to catch anything that I might have missed or yeah just just so that we don't have. We don't end up with a hair on fire work item to take care of things, so I just wanted to let everyone know.

C

Yeah, I read the summary, but I didn't, I haven't, read it in in depth. My understanding of it is that this is more or less.

C

Fixing up the validation that exists in the csi um controllers, as they are, is, is that an accurate summary.

E

Fixing validation and also making certain fields immutable uh and also having opinions on uh like what can be uh in what scenarios do you have to create a new object and not use an existing one got it. So I I read the validation.

E

Validations that was proposed in this cap and I didn't find them violating our assumptions, so I just ignored the rest of the document about how they plan to roll this out and enforce it. And then, when versions of communities should we expect the start nation.

C

Yeah, I think we're we're more concerned about the the rules rather than the implementation, yep and- and I know we- we ran into some of the some of the immutable fields already so yeah yeah. We can double check this just make sure we're we're following the constraints, um because as long as we play by those, then we should be okay, yep, so yeah. I can add this to my list.

C

Let's double check.

E

The other thing that I forgot to mention during uh for the crd validation, github jobs that I added was um currently I have this setup running against 116 9, 117 and 118.4, but if there are other versions, we should be running this against.

E

I'm happy to update that the.

D

E

Like this will be like a moving window of three versions uh or more, maybe that we constantly keep check ourselves against.

A

So are you? um Are you using? The latest version of every miner is that the plan.

E

uh That wasn't the intention, uh but I think I think, there's a there's something more recent than 118.4 no.

A

I was just wondering so you got 1.16.9 and then you got 1.17.0. I was just wondering if we wanted to run the latest patch release of each.

E

I I think we could we could set that thing I mean that would.

C

Yeah that would be ideal. I I don't think, there's a I don't know of a tag in in kind for that to say, like 117 latest but yeah um yeah. Ideally we would. We would grab the latest of the series.

E

Yeah I I chose these because this is what I had in my local yeah, fair enough.

C

Sure there's there's more 17 117s.

A

I was just thinking because then it's it's easy to say. Yes, we're running on the latest about each miner.

A

So for for this- and this is a a question that comes up every now and then um so- we're testing against 1.16, 1.17 and 1.18 as the plan for valero to support the latest three versions of kubernetes.

E

I think that's up for discussion.

C

Yeah this is this comes up a lot and I think um the latest three is probably too few. In my estimation, um just because, as an enterprise tool, enterprises mov tend to move kind of slowly um open, open source tools, especially um kubernetes on a three month roughly three month. What is it three month or six yeah yeah, roughly three, roughly quarterly yeah, I'm thinking openstack even openstack on its six-month release cycle was tough to keep up with, so um I'm fairly sure there's a lot of installs still on 115 and earlier.

C

So I think it is.

C

We've historically been cagey on answering this, but it's uh it's gonna be tougher to continue being kg here uh because of some some uh frankly product inclusions on vmware side. So um I think it's going to have to be broader than the latest three, but also we don't want to get too far like we. We don't want it to be super wide because that's just going to make our life really hard yeah.

C

um So I I also don't want to give an answer off the cuff, because I don't want to box ourselves into too much totally.

A

Fine, I just wanted to bring it out because I I know the question comes up every now and then and yeah thoughts, not not necessarily answers, but.

C

Right, I I think um in terms of crds 116 and above that's a decent cut line, because it makes supporting v1 of the custom resource definition type itself easier going below.

C

You have to do the v1 beta 1 version of the custom resource definition type, but that in itself, I think, makes it worthwhile in testing on 115, uh because we have that split so um that.

E

Will also be my thought, I think it'll also be interesting to know what everybody else is running on this call.

A

If anyone wants to voice their concern and say hey, I'm running on 1.11, that's perfectly fine.

E

G

So when we say last three versions of kubernetes, what does that? Does that equate to time-wise? At this point.

C

um Three quarters.

E

C

Than a year yeah, so that's that's super aggressive and in an enterprise world, that's.

E

C

E

Not right so 116 was when 116 116 9 was a while ago. It wasn't it wasn't until uh it was. It was not less than a year ago. Is it.

C

uh 116 9 for a kind was three updated. uh Three months ago, I'm looking at the docker hub image right now: okay,.

A

Other one dot: sixteen dot, zero, zero.

C

Yeah that was 118 was delayed a little bit by 118 according to docker hub was five months ago, because 119 should be pretty soon yep yeah. I know things got shifted with coronavirus and things, but um because 119 was delayed, but still the normal cadence is about every three months.

E

But if you try to do anything for longer than look back window longer than a year or so we will have like a huge support, matrix, which I I because this is automated. It should be fine and then just trying to put that out. There.

G

Yeah I mean we could also look at different things like having branches that are like long-term support, valero branches, for example. um So we say yeah we support 1.15, but it's only you know valero, you know what one six or whatever and we're not gonna you're, not gonna get the latest valero features on 115, for example. That's that's another thing to.

C

Consider yeah, that's absolutely. I think we may end up getting into a position where um we'll we will have multiple lines right, like a long-term support branch that will get certain features um or won't get certain features, but we'll get security fixes or something like that.

E

Hey kubernetes itself doesn't have long-term long-term support.

C

C

I know I know, and um just just because kubernetes doesn't have, it doesn't mean we can't like try to do stuff.

C

I realize it makes it awkward. I realize it makes it tough, um but for a data protection product, um the whole idea is you have continuity, um so I I don't have a great answer for that, but I think it's a good ongoing discussion um because yeah, like you, don't want your your data to disappear, just because we have that rolling window to make our lives easier.

C

H

Oh hey guys earlier, someone was asking: um what versions do we support um or do people use? uh I know that we from uh migration took it at reddit. um We support all the way back to one.

H

Seven uh chances are that it will get pushed up to one nine or something, but uh we use valero one three and support all the way up to one seven, I think so uh having this uh long-term support kind of branches would be awesome for our standpoint, uh I think that would keep um things insanity uh in order to pick stuff or bring in bug fixes stuff like that.

A

That makes sense thank.

A

You anyone else have any comments or or thoughts regarding versions and.

A

Lts all right, I think that was the uh last discussion topic here, uh so we are ready to dive into the contributor shout outs. Let me share my screen again.

A

There we go got a bunch today.

A

Nolan, do you want to drive this.

C

Yep, just typing notes.

C

So, let's see here um so I generated these and I don't know exactly where all of these are um whether what reposies are in. But um let's see here so first we've got alex punin, um oh yes, this was an update to the miniodox that um that documented the snapshot location um on uh the minion documentation to reflect the aws plug-in options. um There was some required stuff there that was not reflected in our minio docs. So thank you alex for clarifying that.

C

um Next uh we had um some logging clarifications from benoit. um This was super useful for um making log messages more standard, so benoit noticed in the issue they filed that uh not all of his vlog messages were consistent and this made them far more consistent.

C

So thank you benoit um this next one um was uh from piper. um This was related to some security context, changes that came in for the rustic restore helper. um There were some earlier changes that allowed for setting privilege escalation on the rustic restore helper. This made some changes that allowed.

C

For further tweaking of that for the open policy agent um to meet their needs, so thank you to piper for catching that and bringing in a fix.

C

um So this looks like these were created in reverse order, but this is from rob uh rhys risk. um This was cleaning up uh some docs changes um that were made. Thank you rob for catching that and changing it.

C

um We have one from a familiar familiar face: uh steve caught um a badge uh typo on the uh main, readme and corrected it.

C

Abby mccarthy, here at vmware um included, uh was extremely patient with us and uh created some documentation for updating uh the cpu and memory limits and and requests for rustic and the valero deployment in case uh you need that, so we've got documentation on how to update the rustic timeout and the she also helped update the rest of documentation overall.

C

So thank you very much abby. This is very helpful, um mike tribal, I hope I'm pronouncing all these names correctly um added a very helpful page to the documentation about how our resource filtering works. um So this is this is an explanation of like all the the options that come with valero backup create- and this is explanations that we've long sent we've needed for a long time, and we finally have so thank you very much mike for taking the time to go through and document all these in their relationships.

C

um Here's rob again and rob went through and and refactored our docker build process so that our build or our darker file is now one docker file instead of spread through several and we use the docker build x. I think this is from the mobi or container d. I forget exactly which project comes from, but now we use build x to build our manifest and uh it's super neat.

C

uh The dockerfire is much cleaner and our multi-flat multi-platform builds on the main repository are much more concise and in one place now, and that is super awesome, and hopefully we can move this over to the rest of the the repos for the plugins and such and then I think we have one or two more.

C

uh Yes, I think this is on the azure yep, um so sem cam, uh I'm sorry, I'm not very good with german. um uh So the this was a correction of the readme um on azure um looks like we have the wrong variable name in the readme, so this just corrected that. Thank you very much for that clarification and then, uh finally, from levante, uh levinte um we had some cleanup in the azure uh scripted portions, um removing some unnecessary indentation.

C

So thank you very much to all these contributors um really appreciate that uh it's all help a lot and and thank you to everyone- who's reported issues and things like that too- that these all help make the project better for everybody. So thanks.

A

Awesome, thank you nolan. Thank you. Everyone who has helped out in the in the past couple of weeks here, making the project even better. Does anyone have any last questions or comments or topics that they want to bring up.

A

Today, all right, then we're closing it out. uh Thank you. Everyone for joining today hope you have a fantastic rest of the week and see you all next week have a good one.

C