Skip to content
This repository has been archived by the owner on Mar 31, 2024. It is now read-only.

An implementation of k8s-sidecar using k8s operators via kopf

License

Notifications You must be signed in to change notification settings

riptano/kopf-k8s-sidecar

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

kopf-k8s-sidecar

What is this?

An implementation of k8s-sidecar using kopf, an Python-based framework for kubernetes operators.

Why?

UPDATE:

The issue with the kiwigrid k8s-sidecar hanging is no longer present as of version 1.15.0.

The WATCH_CLIENT_TIMEOUT and WATCH_SERVER_TIMEOUT settings that were introduced in this fork to fix the issue, have now been ported there.

Thus, I advise users of this repo to switch back to the kiwigrid k8s-sidecar at this point.

Thank you.


Initial description

At the moment of writing this documentation, there is an issue with k8s-sidecar where it will "hang" after a short amount of time while watching for resources.

Upon inspecting the codebase for the issue, I soon concluded that much of the logic could be drastically simplified by using an operator framework.

Initially, I considered using operator-sdk but I'm not a huge fan of Go.

Additionally, I hope to contribute this rewrite to k8s-sidecar at some point and I figured that keeping things in Python would ease that transition significantly.

How does it work?

In essence, it works the same way as the original k8s-sidecar does.

In its most minimal form, it will look for a defined LABEL in a ConfigMap and/or Secret and write the contents defined in their data field to a given FOLDER in a file.

Quickstart

To see kopf-k8s-sidecar in action, I recommend deploying the resources located in /examples to your k8s cluster.

Once that's done, you can view the sidecar container logs to view events happen as you create, delete or update ConfigMaps or Secrets.

Similarly, you can view the bash container logs to see how the files defined by your ConfigMaps and Secrets are populated there.

Dockerhub

All tags are automatically built and pushed to Dockerhub.

Grafana Helm Chart users

If you are looking to use this image with the Grafana Helm chart, then this is the section for you.

Sidecar image

  • Set .Values.sidecar.image.repository to omegavveapon/kopf-k8s-sidecar
  • Set .Values.sidecar.image.tag to the latest tag in Releases

Healthcheck

The sidecar offers a simple healthcheck endpoint for use in a liveness probe (don't use it for readiness is it makes no sense for an operator).

Should this port conflict with other containers in your pod, you can change it via the HEALTHCHECK_PORT env var.

livenessProbe:
  httpGet:
    path: /healthz
    port: 8181

Configuration Environment Variables

Variable Required? Default Description
LABEL Yes None Label that should be used for filtering
FOLDER Yes None Folder where the files should be placed.
FOLDER_ANNOTATION No k8s-sidecar-target-directory The annotation the sidecar will look for in ConfigMaps and/or Secrets to override the destination folder for files. If the value is a relative path, it will relative to FOLDER
LABEL_VALUE No None The value for the label you want to filter your resources on.
Don't set a value to filter by any value
NAMESPACE No ALL The Namespace(s) from which resources will be watched.
For multiple namespaces, use a comma-separated string like "default,test".
If not set or set to ALL, it will watch all Namespaces.
RESOURCE No configmap The resource type that the operator will filter for. Can be configmap, secret or both
METHOD No WATCH Determines how kopf-k8s-sidecar will run. If WATCH it will run like like a normal operator forever.
If LIST it will gather the matching configmaps and secrets currently present, write those files to the destination directory and die
DEFAULT_FILE_MODE No None The default file system permission for every file. Use three digits (e.g. '500', '440', ...)
DEBUG No False A value of true will enable the kopf debug logs
WATCH_CLIENT_TIMEOUT No 660 (seconds) is how long the session with a watching request will exist before closing it from the client side. This includes the connection establishing and event streaming.
WATCH_SERVER_TIMEOUT No 600 (seconds) is how long the session with a watching request will exist before closing it from the server side. This value is passed to the server side in a query string, and the server decides on how to follow it. The watch-stream is then gracefully closed.
UNIQUE_FILENAMES No (but recommended!) False A value of true will produce unique filenames to avoid issues when duplicate data keys exist between ConfigMaps and/or Secrets within the same or multiple Namespaces.
HEALTHCHECK_PORT No 8181 Port on which the /healthz endpoint will be listening on

Gotchas

Namespaces

Contrary to the original k8s-sidecar, we will look in ALL namespaces by default as documented in the Configuration Environment Variables section.

If you only want to look for resources in the namespace where the sidecar is installed, feel free to specify it.

About

An implementation of k8s-sidecar using k8s operators via kopf

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 89.5%
  • Dockerfile 5.8%
  • Shell 4.7%