{"action":"created","issue":{"url":"https://api.github.com/repos/kubeflow/kubeflow/issues/903","repository_url":"https://api.github.com/repos/kubeflow/kubeflow","labels_url":"https://api.github.com/repos/kubeflow/kubeflow/issues/903/labels{/name}","comments_url":"https://api.github.com/repos/kubeflow/kubeflow/issues/903/comments","events_url":"https://api.github.com/repos/kubeflow/kubeflow/issues/903/events","html_url":"https://github.com/kubeflow/kubeflow/issues/903","id":328411289,"node_id":"MDU6SXNzdWUzMjg0MTEyODk=","number":903,"title":"Deadlocks configuring envoy for IAP","user":{"login":"jlewi","id":777219,"node_id":"MDQ6VXNlcjc3NzIxOQ==","avatar_url":"https://avatars3.githubusercontent.com/u/777219?v=4","gravatar_id":"","url":"https://api.github.com/users/jlewi","html_url":"https://github.com/jlewi","followers_url":"https://api.github.com/users/jlewi/followers","following_url":"https://api.github.com/users/jlewi/following{/other_user}","gists_url":"https://api.github.com/users/jlewi/gists{/gist_id}","starred_url":"https://api.github.com/users/jlewi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlewi/subscriptions","organizations_url":"https://api.github.com/users/jlewi/orgs","repos_url":"https://api.github.com/users/jlewi/repos","events_url":"https://api.github.com/users/jlewi/events{/privacy}","received_events_url":"https://api.github.com/users/jlewi/received_events","type":"User","site_admin":false},"labels":[{"id":939893779,"node_id":"MDU6TGFiZWw5Mzk4OTM3Nzk=","url":"https://api.github.com/repos/kubeflow/kubeflow/labels/area/bootstrap","name":"area/bootstrap","color":"b60205","default":false},{"id":813796132,"node_id":"MDU6TGFiZWw4MTM3OTYxMzI=","url":"https://api.github.com/repos/kubeflow/kubeflow/labels/area/front-end","name":"area/front-end","color":"d2b48c","default":false},{"id":810949496,"node_id":"MDU6TGFiZWw4MTA5NDk0OTY=","url":"https://api.github.com/repos/kubeflow/kubeflow/labels/platform/gcp","name":"platform/gcp","color":"2515fc","default":false},{"id":806984230,"node_id":"MDU6TGFiZWw4MDY5ODQyMzA=","url":"https://api.github.com/repos/kubeflow/kubeflow/labels/priority/p1","name":"priority/p1","color":"db03cc","default":false},{"id":955587428,"node_id":"MDU6TGFiZWw5NTU1ODc0Mjg=","url":"https://api.github.com/repos/kubeflow/kubeflow/labels/release/0.2.0","name":"release/0.2.0","color":"ef1ad6","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-01T07:31:53Z","updated_at":"2018-06-05T23:47:47Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"I'm noticing deadlocks and other problems configuring envoy using the IAP script. Some of the problems I observe\r\n\r\n1. iap.sh is never able to acquire the lock and therefore able to write the envoy-config.json\r\n1. envoy container is crash looping - prevents GCP loadbalancer from detecting the backend is heathy\r\n\r\nI think we should make the following changes\r\n\r\n1. There should be a single pod responsible for enabling IAP and updating the envoy-config map as needed\r\n   \r\n    * We should move this out of the sidecar and into a separate deployment\r\n    * Locking should be less important because there won't be contention\r\n\r\n1. The envoy sidecars are now just responsible for updating envoy config based on the config map\r\n    * They no longer need to acquire a lock\r\n    * They can periodically check the config map and compute a hash to know when it changes\r\n\r\n1. We should provide a default config that will allow envoy to startup but ensure non secure traffic is blocked \r\n    * This way we can avoid the problems with the ingress thinking the backend is unhealthy."},"comment":{"url":"https://api.github.com/repos/kubeflow/kubeflow/issues/comments/394895688","html_url":"https://github.com/kubeflow/kubeflow/issues/903#issuecomment-394895688","issue_url":"https://api.github.com/repos/kubeflow/kubeflow/issues/903","id":394895688,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NDg5NTY4OA==","user":{"login":"jlewi","id":777219,"node_id":"MDQ6VXNlcjc3NzIxOQ==","avatar_url":"https://avatars3.githubusercontent.com/u/777219?v=4","gravatar_id":"","url":"https://api.github.com/users/jlewi","html_url":"https://github.com/jlewi","followers_url":"https://api.github.com/users/jlewi/followers","following_url":"https://api.github.com/users/jlewi/following{/other_user}","gists_url":"https://api.github.com/users/jlewi/gists{/gist_id}","starred_url":"https://api.github.com/users/jlewi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlewi/subscriptions","organizations_url":"https://api.github.com/users/jlewi/orgs","repos_url":"https://api.github.com/users/jlewi/repos","events_url":"https://api.github.com/users/jlewi/events{/privacy}","received_events_url":"https://api.github.com/users/jlewi/received_events","type":"User","site_admin":false},"created_at":"2018-06-05T23:47:47Z","updated_at":"2018-06-05T23:47:47Z","author_association":"CONTRIBUTOR","body":"/assign @jlewi\r\n"}}
{"actor":{"display_login":"jlewi"}}