# Falco Infrastructure WG

## 2020-1-7

- Jonah Jones ([jonahjon](https://github.com/jonahjon))
- Massimiliano Giovagnoli ([maxgio92](https://github.com/maxgio92))
- Lorenzo Fontana ([fntlnz](https://github.com/fntlnz))
- Leonardo Di Donato ([leodido](https://github.com/leodido))

### This week highlights

- Prow didn't break over the holidays!
- https://github.com/falcosecurity/test-infra/blob/master/images/update-maintainers/entrypoint.sh#L27 How we can change autobump to be used from Piona
- Graviton Instances
- - Check Price and see if within budget
- - Multi Cluster Capability

- BuildKit service deployed in Cluster
- - https://github.com/moby/buildkit/tree/master/examples/kubernetes

- Move more jobs from other Falco Orgs to Prow

## 2020-12-10

### Who joined

- Jonah Jones ([jonahjon](https://github.com/jonahjon))
- Massimiliano Giovagnoli ([maxgio92](https://github.com/maxgio92))

### This week highlights

- [Driverkit presubmit build job for Ubuntu-generic](https://github.com/falcosecurity/test-infra/tree/master/config/jobs/build-drivers/build-drivers.yaml#L123) takes more than 12h
- [Driverkit postsumbit/periodic build jobs](https://github.com/falcosecurity/test-infra/tree/master/config/jobs/build-drivers) need publish step

### Agenda

- How to correctly manage driverkit build jobs
- Increase `ProJob` timeout to 24h (workaround)
- Split driverkit build jobs per kernel version per distribution
- Provision tailored VM pool (EKS node pool)
- CPU optimized?
- How to let specific `ProwJob` be able to write to *distribution* S3 bucket
- AWS IAM
- AWS EKS IRSA
- K8s SA per ProwJob

## 2020-12-03

### MC

- Jonah Jones ([jonahjon](https://github.com/jonahjon))

### Who joined

- Massimiliano Giovagnoli ([maxgio92](https://github.com/maxgio92))
- Jonah Jones ([jonahjon](https://github.com/jonahjon))
- POP ([POP](https://github.com/danpopsd))

### This week highlights

### Agenda

- Discuss AWS Public registry steps (https://gallery.ecr.aws/)
- considerations name squatting
- security implacations (3rd party uploads falco with virs/bug and falco is blamed)
- let's put it a vote, and make PR
- Talk about it next week community call
- Prow jobs other repo's

## 2020-11-12

### Who joined

- Massimiliano Giovagnoli ([maxgio92](https://github.com/maxgio92))

### This week highlights

- Jobs migration from CircleCI to Prow
- Prow ChatOps hooks testing (new poiana)
-

### Agenda

- Actual Migration (see the steps below)

#### High level migration steps

- Do the CNAME
- Freeze the contributions
- Downscale the old Prow
- Change the webhooks to the new Prow

## 2020-11-5

- Lorenzo Fontana ([fntlnz](https://github.com/fntlnz))

### Who joined

- Jonah Jones ([jonahjon](https://github.com/jonahjon))
- POP ([POP](https://github.com/danpopsd))
- Thomas Labarussias ([Issif](https://github.com/Issif))
- Massimiliano Giovagnoli ([maxgio92](https://github.com/maxgio92))
- Lorenzo Fontana ([fntlnz](https://github.com/fntlnz))
- Leonardo Grasso ([leogr](https://github.com/leogr))
- Leonardo Di Donato ([leodido](https://github.com/leodido))

### This week highlights
- Discussion - Jonah Jones /@maxgio kicked ass and took names with fantastic prow work
- validated IAM access to test EKS cluster(Lore/Leo)
- Next week we migrate 11/12

### Agenda

- Migrating new Prow
- moving new CNAME
- add ACM certs to TF
- make custom image for Bot DCO signoff message https://github.com/falcosecurity/test-infra/pull/198 via https://github.com/kubernetes/test-infra/blob/6c78c1a6bcd2fca96e656a8ab1dec75f7784637f/prow/plugins/dco/dco_test.go

## 2020-10-22

### MC

- Lorenzo Fontana ([fntlnz](https://github.com/fntlnz))

### Who joined

- Jonah Jones ([jonahjon](https://github.com/jonahjon))
- POP ([POP](https://github.com/danpopsd))
- fahad ([fahad](https://github.com/farshad-hobsons))
- Loris
- Thomas Labarussias ([Issif](https://github.com/Issif))
- Massimiliano Giovagnoli ([maxgio92](https://github.com/maxgio92))

### This week highlights

- Proposal, artifacts on S3 -> https://docs.google.com/document/d/16zRozdyoyjE86VvicRJAV4-TkNQZkeGQysohCOYe1Ek/edit
- (2.25 storage/transfer) S3 costs $20/tb storage and $90/tb data transfer

### Agenda

- Updates on the cluster setup (PR: https://github.com/falcosecurity/test-infra/pull/198)
- 1password script now works
- Now to get CircleCI setup
- Terraform runs from CircleCI
- Launch prow
- We want to split the vaults on 1password

## 2020-10-16

### MC

- Lorenzo Fontana ([fntlnz](https://github.com/fntlnz))

### Who joined

- Lorenzo Fontana ([fntlnz](https://github.com/fntlnz))
- Spencer Krum ([nibalizer](https://github.com/nibalizer))
- Massimiliano Giovagnoli ([maxgio92](https://github.com/maxgio92))
- POP ([danpopsd](https://github.com/danpopSD/))
- Loris ([ldegio])(https://github.com/ldegio)

### This week highlights

### Agenda

- Previous week activities
- 1password setup
- all users added
- aws account setup
- all users added
- The infra/terraform PR
- https://github.com/falcosecurity/test-infra/pull/197
- Lorenzo will fixup and get this mergable
- https://github.com/falcosecurity/test-infra/pull/188 - close in favor of 197
- Spencer stll can't create an API token

### Closing

- **MC Next Call**:

## 2020-10-08

### MC

- Spencer Krum

### Who Joined

- Leonardo Grasso ([leogr](https://github.com/leogr))
- Umang Vanjara ([vanjara](https://github.com/vanjara))
- Jonah Jones ([jonahjon](https://github.com/jonahjon))
- Spencer Krum ([nibz](https://github.com/nibalizer))

### This week highlights

### Agenda

- Review Jonah's Pr to Max's PR
- - Who launches the EKS clusters and when?
- CircleCI, Github Actions or Atlantis?
- team: circle ci runs terraform
- Investigate CircleCI Terraform
-[umang] https://learn.hashicorp.com/tutorials/terraform/circle-ci

- options for secrets:
- circleci holds secrets, adds to k8s with kubectl in job
- circleci pulls from 1password in job [+1]
- out of band admin applies secrets
- Run both terraform and kube in the build/deploy step
- 1password cli: https://support.1password.com/command-line-getting-started/

#example ci job script
#!/bin/bash
cd prow/config
terraform apply
cd ../..
cd <dir with kube files>
# circlci lays down some secret.yaml files ?
./pull_secrets_1password # implies a secret to 1p from circleci
# note if ^^ script turns out to be hard lwe'll put the secrets in circleci
kubectl apply -f ./prow

- [leodido] CNCF service ticket for *.falco.org subdomains - we need the CNAME
- need a name:
- prow.falco.org [accepted]
- blocked on running terraform and then kubectl apply
- elb would then be created
- eg: adf8xxxxx40a187a848fxxxxxx-xxxxxxxx.us-west-2.elb.amazonaws.com
- [jonah] 1Password blocking migration need to figure it out
- solution is to inject secrets into circleci ?
- Which Region? (Where are the majority of users based from)
- where is the bintray hosted/jfrog hosted? (does this matter if s3 is hosting drivers?)
- us-east-1 (N. Virginia)
- eu-west-1 (Ireland)

- Which instance types
- what nodes for eks clusters
- general purpose type (m) [+1]
- burstable type (t)
- memory heavy types (r)
- cpu heavy types (c)
- plan:
- start with general purpose type (m) and evaluate cpu heavy types (c) for the driver build jobs/nodes
- [jonah] Migration path proposal
- jonah to create migratin plan doc

---

## 2020-10-01

### MC

- Leonardo Di Donato ([leodido](https://github.com/leodido))

### Who joined

- Lorenzo Fontana ([@fntlnz](https://github.com/fntlnz))
- Leonardo Grasso ([@leogr](https://github.com/leogr))
- Jonah Jones ([jonahjon](https://github.com/jonahjon))
- Umang Vanjara ([vanjara](https://github.com/vanjara))
- Massimiliano Giovagnoli ([@maxgio92](https://github.com/maxgio92))

### This week highlights

### Agenda

- [Lorenzo] AWS credentials, everyone has what they need?
- Please enable MFA
- [Spencer] Update on governance
- https://github.com/falcosecurity/test-infra/pull/183/
- [Lore] Prefers pragmatica approach for credentials/secrets storage/sharing
- [Leo] Study this -> https://github.com/1Password/1password-teams-open-source - Can/should we apply?
- [Jonah] Should we setup billing alerts?
- 2nd phase
- [Leo] colorscheme for deck customization [branding guidelines](https://github.com/falcosecurity/falco/tree/master/brand#colors)
- [Everyone] Debate on
- How do we want to deploy EKS?
- Terraform?
- Cloudformation?
- eksctl?
- [Max] Deploy'd EKS via terraform
- Proposes to commit manifests
- [Jonah] Deploy'd with eksctl
- Q: Does terraform have the ability to create serviceaccount?
- Pro: some k8s automation
- How do we proceed to implement the [Proposal](https://github.com/falcosecurity/test-infra/blob/master/proposals/20200915-prow.md)
- [Leo] Add the person/s to falcosecurity organization (done)
- [Leo] Add the person/s to OWNERS file in test-infra (done)
- Jonah
- MaxGio92
- [Leo] Add the person/s to falcosecurity/test-infra-maintainers github team (done)
- [Lore] Volunteers for asking an opensource account to 1Password and setup it (done)
- [Leo] Change the poiana account email
- [Lore] Add the creds and share with the person/s (or with all the Falco Infra maintainers) the poiana's credentials?
- [Jonah] + [MaxGio92] create the EKS clusters
- Invite Umang too
- Invite LeoGr too
- How to migrate poiana without experiencing downtime?
- Current poiana is stateless
- Freeze organisation/repos

### Closing

- **MC Next Call**:

## 2020-09-24

### MC

- Lorenzo Fontana ([fntlnz](https://github.com/fntlnz))
- Leonardo Di Donato ([leodido](https://github.com/leodido))

### Who joined

- Jonah Jones ([jonahjon](https://github.com/jonahjon))
- Leonardo Grasso ([leogr](https://github.com/leogr))
- Spencer Krum([nibalizer](https://github.com/nibalizer))
- Massimiliano Giovagnoli ([maxgio92](https://github.com/maxgio92))
- Umang

### This week highlights

- Introduction and context
- AWS account created (for Falco community only, tied as sub-account to the CNCF AWS main account)
- Who else to add to the account?
- See below
- Currently only Leo and Lore have access
- Cost estimate
- [aws price calculator](https://calculator.s3.amazonaws.com/index.html#r=MXP&key=files/calc-df37178d65d697429fa6aeb5da832e7a67e7e91e&v=ver20200916q9) + 80USD/mo for EKS usage = ~260USD/mo
- We also considered cost for 300GB S3 (drivers storage, a driver version = ~3GB of artifacts at the moment), this accounts for ~80USD/y (already considered)
- CNCF creating an AWS account for the Falco community
- We'll apply free credits on this account
- Credits are applied
- We need to decide who goes to the AWS account (those who will operate to install everything on it)
- Explore Tekton for centralizing our CI/CD

### Agenda

- Extract the action items from the google doc and decide what to do next
- https://docs.google.com/document/d/1CWh_sqVDv9PLkVue5rdOeF09EQZXNaSgAhKkNWp_YNA/edit
- [Jonah] Blog and documentation by Jonah on how to get Prow running on EKS (Falco is the pilot)
- Draft link -> https://hackmd.io/b_taR8j0QqmV8l5AoEDCrg?both <- REVIEW THIS
- Branding guidelines https://github.com/falcosecurity/falco/tree/master/brand
- Favicon https://falco.org/images/favicon.png
- Who wants to be in the AWS account?
- Spencer [email](nibz@spencerkrum.c0m)
- Lore (already have access)
- Leo (alredy have access)
- Jonah ([e-mail])
- Max [email]([e-mail])
- LeoGrasso [email]([e-mail])
- Governance Document for Infrastructure Team
- put this in some repo (community? test-infra?)
- [Leo] test-infra: i'd tie the governance/accounts to OWNERS
- [Spencer] can draft it
- Password/secret maintenance
- must share between maintainers
- no clear system for how to do this
- example of how Spencer did this with the VoxPupuli open source group https://github.com/voxpupuli/plumbing/#gpg
- Create EKS cluster(s)
- prow cluster
- build cluster (2nd phase or from day one? who will do the task, they will decide)
- Jonah's proposal: https://github.com/falcosecurity/test-infra/pull/177/files (ACCEPTED)
- Apply the current test-infra manifests (through test-infra repo's makefile)
- Secrets (unsplash, hmac, etc...)?

### Closing

- Homeworks for everyone
- Test the Jonah's blog on aws
- Form an opinion on the various way to deploy eks and prow on it, and on all the components
- Lorenzo to rollout AWS credentials
- Leo to update the mailing list
- Leo to document Falco color scheme for future Prow Deck customisation (https://github.com/falcosecurity/falco/pull/1414)
- Spencer to start looking at Governance
- Lorenzo/Leo to ask CNCF for CNAME (prow.falco.org or prow.falco.io?)
- **MC Next Call**: Leo Di Donato