[Airship-discuss] Armada API connectivity to Tiller (proxy problem)

[Evgeny L]

Hi Drew,

Thank you for the response!

>> The Armada API accepts a Tiller hostname as a safeguard in the event
that Armada is unable to find a running Tiller pod

Looking at the code [1] it seems to be that Armada will try to find Tiller
pod in the event Shipyard doesn't find one.
Was there some problem with Armada API not being able to retrieve Tiller
endpoint so it required a fallback? They both seem to use k8s API for that.

>> This can be changed per API request by providing the hostname of a
different Tiller pod.

>From architecture point of view, do we expect it to work with multiple
Tillers within a single Airship installation?

I'm asking these questions to explore the options for resolving GRPC (which
is used by Tiller client) [2] constraints, it does not handle CIDR in
no_proxy environment variables [3]. One of the options is:
1. [high priority] Expose Tiller to create a DNS name for the pod, and use
it when making requests from Armada API to Tiller, in this case Aramada API
POD can have ".cluster.local" in NO_PROXY and everything would work just
fine (i.e. requests to Tiller won't go through the proxy).
2. [low priority] Reduce coupling between Tiller/k8s and Shipyard by
configuring Tiller endpoints in Armada API directly without requiring
Shipyard to pass one.

Prior to submitting any changes I would like to verify with you if this
makes sense or if I should explore other options.

Thanks,

[1]
https://github.com/openstack/airship-armada/blob/307f1318c4e83f247f1e3838478957e7555d6ce0/armada/handlers/tiller.py#L158-L164
[2]
https://review.openstack.org/#/c/624504/2/manifests/dev_minimal/README.rst
[3]
https://github.com/grpc/grpc/blob/9e9cae7839a362936228cf333045e5da877ace40/src/core/ext/filters/client_channel/http_proxy.cc#L146-L149


On Thu, Dec 20, 2018 at 1:42 PM Drew Walters <drewwalters96 at gmail.com>
wrote:

> Hi Eli,
>
> The Armada API accepts a Tiller hostname as a safeguard in the event that
> Armada is unable to find a running Tiller pod. Shipyard uses the Python
> Kubernetes client to retrieve the IP address that it provides to Armada.
>
> 1. It is possible to create a clusterIP with DNS and provide a domain name
> to Armada.
>
> 2. Armada only communicates with one Tiller pod at a time. This can be
> changed per API request by providing the hostname of a different Tiller
> pod. In the event that a Tiller hostname is not provided, Armada selects
> the first running Tiller pod it encounters.
>
> We invite you to join our IRC team meeting (#airshipit on freenode)
> January 8th to help us better understand your desired configuration and
> discuss in more detail. In the meantime, please let us know if you have any
> additional questions!
>
> Best,
> Drew Walters
>
>
> On Wed, Dec 12, 2018 at 3:55 PM Evgeny L <eli at mirantis.com> wrote:
>
>> Hi,
>>
>> I've been working on getting behind the proxy configuration for AIAB to
>> work [1] and I stumbled across a problem related to GRPC [2], which does
>> not support CIDR notation for no_proxy entries, this make Armada API to
>> fail to connect to Tiller, because it tries to use proxy configured with
>> environment variables.
>>
>> While looking for a solution other than doing some manual reconfiguration
>> [2], I started to have the following questions:
>>
>>    1. Why does Shipyard uses [4] Tiller Pod IP? Can we create a
>>    ClusterIP and use a DNS name?
>>    2. Why Shipyard is the one who provides Armada API with Tiller IP
>>    address? If we do 1st we can possibly make endpoint a part of Armada API
>>    configuration. Or is Armada API supposed to work with multiple Tillers at
>>    the same time?
>>
>>
>> Any feedback and historical background would be really helpful!
>>
>> Thanks,
>>
>> [1] https://review.openstack.org/#/c/624122/
>> [2]
>> https://review.openstack.org/#/c/624504/2/manifests/dev_minimal/README.rst
>> [3]
>> https://github.com/grpc/grpc/blob/9e9cae7839a362936228cf333045e5da877ace40/src/core/ext/filters/client_channel/http_proxy.cc#L146-L149
>> [4]
>> https://github.com/openstack/airship-shipyard/blob/a235f8e6db6e791550727e3575e045e26f177252/src/bin/shipyard_airflow/shipyard_airflow/plugins/armada_base_operator.py#L147-L153
>> _______________________________________________
>> Airship-discuss mailing list
>> Airship-discuss at lists.airshipit.org
>> http://lists.airshipit.org/cgi-bin/mailman/listinfo/airship-discuss
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.airshipit.org/pipermail/airship-discuss/attachments/20181226/367cbf0a/attachment.html>