Kubecon Face to Face Notes

[Shawn Hurley]

Hello All,

During KubeCon NA some folks from the community got together and had a productive meeting about kubebuilder and controller-runtime. We did not record this meeting (sorry about that) but we did take notes. I have tried to break this up into sections.

If anyone there has something that I missed in this list please add it :)

I have tried to bold the action items. I don’t believe there are issues so if you would like to take something please file an issue and start the conversation!

Discussions

1. We talked about the graceful shutdown of a controller. There were many folks with this use case. https://github.com/kubernetes-sigs/controller-runtime/pull/664 talks to this issue and should be the place for folks to look at.

2. We discussed self-registration of the web hooks and why this was removed. It was considered a security concern as you had to grant permissions to the operator to mutate its on configuration. The kubebuilder team attempted to document this in the v2 design doc but it didn’t make it. An action item was to create an FAQ or design doc to describe this.

Feature Requests

1. A feature request for generation of a web hook for a core type was brought up. This was allowed in v1 but it confused folks and so it was removed in v2. I believe the action item was to open an issue to continue discussion on the this, or document the workaround if you need to create a web hook for a core type.

2. Support for multi-cluster inside of controller runtime was discussed. There are folks who are asking for this feature. The action item was for me to ask some folks at RedHat about this. There was discussion fo a shared type to capture the credentials and that kibe-federation may have already completed this. I did not note if someone was looking into this. Are there any takers?

3. A feature request was made for Code generation for union annotations in controller tools.

4. A feature for 1.0 release is ignorable errors and handling these correctly. We discussed having sane defaults but overridable with options. A call for help on writing the design and/or pr for this was made.

5. We discussed the createOrUpdate function being a footgun and how server-side apply might fix this. We currently believe that the server side apply interface is a little clunky and we would like to re-think the server side apply interface. I don’t believe that anyone took this as an action item either.

Decisions

1. We discussed per-controller leader election for a while. We determined that this is useful and that we want to make it so that it has sensible defaults.
   The outcome that I have written down is that we want to force users to specify a unique lock name for per-controller locks. Will default to the manager’s lock name but allow people to override.

2. We discussed TLS defaults and determined that 1.3 should be the default. And some folks from New Relic have offered to submit the PRs to enable this.

3. Passing context down to the cache was discussed. The default timeout is going to be the default client timeout.

Call for Help

1. Controller Runtime should be context aware. If we find parts that are not context aware please file a bug so that we can track it and fix it.
   Side note, should we create a label/milestone or tracking issue to keep track of all of these?

2. There was a call for help around the fake client. There was discussion on want to remove it, but other folks finding it very helpful. The action item was for a design proposal around updating the fake client interface such that it is easier to write tests for certain error conditions while not rewriting core api server behavior.

3. There was a call for folks who have been contributing to become reviewers and approvers of either sub systems or for projects (controller-tools, controller-runtime, kubebuilder). There is a process outlined here: https://github.com/kubernetes-sigs/kubebuilder/blob/master/docs/CONTRIBUTING-ROLES.md

Thanks,

Shawn Hurley