Emissary-ingress: Version 4 and What Comes Next - Flynn, Buoyant

This talk covers the recent updates in Emissary 4.0.1, highlighting the importance of upgrading from the previous version due to known bugs and security flaws in Envoy. The speaker, Flynn from Buoyant, emphasizes the user-friendly design of version 4, which facilitates easier dependency updates and release management. He discusses ongoing improvements in the Emissary project, including plans for version 5 that may simplify the API and eliminate the conversion webhook dependency. The session also underscores the community aspect of the Emissary project, inviting more contributors to participate in its development and maintain security standards. Flynn shares the transition of Emissary's support from Datawire to Ambassador Labs and stresses the significance of maintaining user feedback for future enhancements.

All right, I think we can go ahead and get started because I don't want to be in between anybody in their flight home or anything like that. There are not going to be a lot of people here, I suspect, it being 3:15 p.m. on the last day. So, please feel free, move on up front so I feel a little bit less like I'm just lecturing. Um but

yeah, we'll just go through a couple of things pretty quickly. First question, is there anybody in the room who is new to the concept of Emissary and wants me to go through the whole what the point is and why we're doing things? No? I didn't think so. All right. Um you know who I am, I'm sure. I'm Flynn. I'm at Buoyant these days. This is the most

relevant point in this slide. Emissary 4 is out. It's uh 4.0.1 because we ran into a CID glitch on 4.0.0. If you try to do a Helm install on 4.0.0, it will work. You'll get images that claim to be 4.0.0.rc.2. Um it's the the binaries are identical to the ones for 4.0.1 GA. If you want to use 4.0.0 and understand that the RC will label itself, um

feel free. But otherwise, you can use 4.1 and it should be great and it should call itself 4.0.1 and that will make people happy. If you are still using Emissary, I would really love it if you would upgrade to V4. The reason is that 3.10 is a lot which was the last Emissary 3 that we did is using a version of Envoy that we know has bugs

in it. We know has security flaws and there will not be another Emissary 3 release full stop ever again. So, go to 4, your life will be better. Big thanks to the folks who helped out with this thing, especially Mark S and Phil Pevler. Those are a couple of maintainers of ours. Uh but also Jeremy Dental was extremely helpful on doing some production testing before we actually

rolled everything out and that made a huge difference. That was lovely. this is the other obvious bit that I wanted to encourage here. Uh 4.0 has taken a long time in part because a very small number of people are working on it. So, come and help if you want to keep using this. If you don't want to keep using it, let me know that you don't want

to keep using it and then we can go and turn it off, right? Um I am going to skip all of these just for a moment cuz y'all already know about them. So, let's talk about this stuff instead. The point of Emissary version 4 is in fact getting to a place where it is easy to go and consume new releases of Envoy and easy to do dependency

updates and easy to build new releases so that the project as a whole can do a much better job of tracking the ecosystem under it and making life easier and better for the people who are still using it. we're basically there with one notable exception, which is Emissary's version of controller-gen includes some code from one of the Emissary contributors back when that we realized as part of

getting Emissary 4 out the door had never made it into upstream and probably should. it's honestly kind of fascinating that that bug still exists in controller-gen to me. Um I feel like other people doing CRD APIs would have run into it and not just us. So, uh so, I predict a conversation in my future with some of the API machinery folks and I'm sure it'll be delightful

cuz they love hearing from me. this is a really big deal. Uh V4 pretty much is in a place where, for example, one of the things that I will be doing shortly after leaving the conference is I will upgrade Emissary to the latest version of Envoy and ship that as 4.1 and um that will involve changing one line of source code and letting CI build me a

release. I will then test the release, don't worry. Uh and it would be nice if some of y'all would test it, too. But um yeah, it's so much easier now than it used to be. It's really lovely. Emissary V5 is the place where we could start making improvements like we could switch to using only Go. We could switch all the CRDs to the emissary.ingress.dev API group rather

than sticking with the getambassador.io domain, which we really shouldn't be using anymore. Uh I really don't want to. We can kill the conversion webhook once and for all. we're actually probably going to do that in a 4 Well, I should phrase that I should have phrased that as we will certainly make it simpler to migrate away from needing it. the challenge with the conversion webhook, as always,

is that the API server is fairly unhappy if you try to delete old stored versions before you know that those versions are no longer stored. >> [sighs] >> Raise your hand if you've taken a look at the storage version migrator at any point? Yeah, I didn't think so. Um the storage version migrator is a controller that's supposed to run and migrate storage versions for you. Something like

four or five years ago, it was killed as a separate repo and brought into Kubernetes core and you it is not stable in any version of Kubernetes yet. So, it's not been functionally possible to run it for several years now. so, one of the big questions is can we in fact release something much simpler that can do the job of that as a tool that you can

just deploy as a job, watch it run and then go, "Okay, I'm good to go." And I think we're going to be able to do that because oh man, would I really love to give everybody who's currently relying on the conversion webhook a way to not rely on the conversion webhook. Uh it's already the case that V4 defaults to not installing it. So, be careful with that

if you're upgrading. That's in the docs, don't worry. Or as I mentioned before, we can also listen to people saying, "No, it's not necessary. Just don't bother. Keep rolling out V4s for a while and then turn the project off." And this is a great topic for conversation. I would love to hear people's thoughts on Every time I talk to people about it, the feedback I generally get

is uh no, we actually kind of like the input language simplicity and we kind of like things about the way this is set up for developers, which on the one hand is a great piece of validation for me as a person, so thank you. Um and on the other hand is kind of like, "Wow, how do we arrange it so that there are more people helping out

with this?" Because that is the most critical thing in terms of having the project keep going and in terms of having us able to make real improvements to it. this slide is unchanged from the last with the exception that I swapped the last two points. Uh we have in fact completely migrated everything to the CNCF Slack. The old Datawire Slack is no For um for anybody who

doesn't know the history there, Emissary started life as a project while I was at Datawire, the company. It was supported by Datawire. Datawire eventually renamed to Ambassador Labs. Ambassador Labs much more recently was acquired by Gravity and um that's where things stand there. So, just as a random piece of interest. Uh and as always, you can reach me on all the Slacks as Flynn, which again, probably

everybody already knows. So, with that, talk to me. What questions do you have? What comments do you have? Do you just want me to turn the mic off so we can all leave and go home? I mean, you know, what's on your minds? >> [clears throat] >> I saw you open your mouth. You can't escape. I'm I'm actually pretty We've been running in Emissary uh at my

company for a while a lot of my coworkers have very strong feelings about it, but none of them happen to be here today, so I said I would come to the Well, I hope they're strong positive feelings instead of strong negative feelings. In general, they are. That's good. The main concern they have is security updates. Yeah. uh I'll just let you repeat all of that. Um no,

yeah, okay. So, the question was basically or the comment was that uh this gentleman has been they've been using Emissary at the company um at his company, people seem seem to like it and have concerns about security updates. Yeah, that is literally the point of V4. Uh like almost all of the point. Um uh a bit of context around that going with the history that I just

rattled a substantial part of the last couple of years has been figuring out, "Okay, how do you take a project that was previously funded by a company operating under the aegis of the company, how do you return that to the community and get into a place where you can put a tag on something and get a release out the other end and get images. This is considerably

more difficult than it sounds. Less I don't want to imply that the company was making it difficult. They were not. It's just the number of small details that you don't think about until you suddenly have to go and move all of them is very large. But building a new emissary used to be days of work. I'm being I'm exaggerating a little bit. We you know, we were

eventually down to the point where we could start a release in the morning and be pretty confident that it would succeed in the evening, right? By the evening. But at this point 4.0.1 was literally me pushing a get tag I think I went to dinner. And then I came back and went oh yeah, look. It all went fine. It went fine. That action was green. Everything's great.

And yeah, so hello. This is a much better place to be at. And like I said also on my list for probably the next week or so is yeah, it's it's time to go and do an Envoy upgrade. I would have actually done it before 4.1 went out except that I didn't want to take the time to try to Basically, I was not in a position where

I could go through and properly test an Envoy change. So, I decided to hold it Anybody else? I'm happy to answer questions, but I am also happy to go ahead and give you all some extra time and not keep everybody in a room when they have other things to do. So, All right, I think we're going to call it then. Thank you very much. I appreciate it.

I hope KubeCon was good. Enjoy yourselves.