You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ops-log-k8s-mutating-wh/README.md
+45-21Lines changed: 45 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,22 +1,32 @@
1
1
# Prysm Kubernetes Mutating Webhook for RADOSGW Sidecar Injection
2
2
3
-
This is a Kubernetes **Mutating Admission Webhook** designed to automatically inject a **Prysm sidecar** into **RADOSGW deployments** managed by Rook-Ceph. The sidecar container scans **RGW operation logs** and exposes **Prometheus metrics**.
3
+
This is a Kubernetes **Mutating Admission Webhook** designed to automatically
4
+
inject a **Prysm sidecar** into **RADOSGW deployments** managed by Rook-Ceph.
5
+
The sidecar container scans **RGW operation logs** and exposes **Prometheus
6
+
metrics**.
4
7
5
8
## Features
6
9
7
-
-**Automatic Sidecar Injection**: Detects `rook-ceph-rgw` deployments and injects a **Prysm sidecar**.
8
-
-**Prometheus Metrics**: Extracts metrics from `rgw-ops-logs` and serves them on port **9090**.
9
-
-**Dynamic Image Configuration**: Supports configuring the sidecar image via the `SIDECAR_IMAGE` environment variable.
10
-
-**Cert-Manager Integration**: Uses `cert-manager` to generate TLS certificates, with **automatic CA bundle injection**.
10
+
-**Automatic Sidecar Injection**: Detects `rook-ceph-rgw` deployments and
11
+
injects a **Prysm sidecar**.
12
+
-**Prometheus Metrics**: Extracts metrics from `rgw-ops-logs` and serves them
13
+
on port **9090**.
14
+
-**Dynamic Image Configuration**: Supports configuring the sidecar image via
15
+
the `SIDECAR_IMAGE` environment variable.
16
+
-**Cert-Manager Integration**: Uses `cert-manager` to generate TLS
17
+
certificates, with **automatic CA bundle injection**.
11
18
-**Secure Webhook**: Runs on port **8443** and validates incoming deployments.
12
19
13
20
---
14
21
15
22
## **Automatic Sidecar Injection**
16
-
The webhook **automatically detects** RADOSGW (`rook-ceph-rgw`) deployments and injects a **Prysm sidecar** container. It ensures that only specific RADOSGW instances are modified by checking **a predefined set of labels**.
23
+
The webhook **automatically detects** RADOSGW (`rook-ceph-rgw`) deployments and
24
+
injects a **Prysm sidecar** container. It ensures that only specific RADOSGW
25
+
instances are modified by checking **a predefined set of labels**.
17
26
18
27
### **Label Requirements**
19
-
To be **eligible for mutation**, a deployment **must have the following labels**:
28
+
To be **eligible for mutation**, a deployment **must have the following
29
+
labels**:
20
30
21
31
| Label | Description |
22
32
|-------|-------------|
@@ -43,9 +53,12 @@ spec:
43
53
If this label is not set, the webhook will not modify the deployment.
44
54
45
55
#### **Sidecar Injection Process**
46
-
1. The webhook listens for CREATE and UPDATE operations on Deployment resources.
47
-
2. When a new or updated deployment matches the required labels, the webhook inspects its pod specification.
48
-
3. If the **Prysm sidecar is missing**, it is **automatically injected** with the following configuration:
56
+
1. The webhook listens for CREATE and UPDATE operations on Deployment
57
+
resources.
58
+
2. When a new or updated deployment matches the required labels, the
59
+
webhook inspects its pod specification.
60
+
3. If the **Prysm sidecar is missing**, it is **automatically injected** with
61
+
the following configuration:
49
62
- **Container Name**: `prysm-sidecar`
50
63
- **Image**: Defined by `SIDECAR_IMAGE` environment variable.
51
64
- **Args**:
@@ -61,16 +74,20 @@ If this label is not set, the webhook will not modify the deployment.
61
74
- `/var/lib/ceph/crash`(Crash logs)
62
75
- **Environment Variables**:
63
76
- `POD_NAME`: Auto-populated with the pod’s name.
64
-
4. If a **Prysm sidecar already exists**, the webhook **updates it** to ensure consistency with the latest configuration.
77
+
4. If a **Prysm sidecar already exists**, the webhook **updates it** to ensure
78
+
consistency with the latest configuration.
65
79
5. The modified deployment is then approved and applied to the cluster.
66
80
67
-
This ensures consistent, automated sidecar injection into selected rook-ceph-rgw instances, allowing **real-time monitoring of RGW operations**.
81
+
This ensures consistent, automated sidecar injection into selected
82
+
rook-ceph-rgw instances, allowing **real-time monitoring of RGW operations**.
68
83
69
84
---
70
85
71
86
## Configure Sidecar via Secret or ConfigMap
72
87
73
-
The webhook supports injecting **environment variables** into the Prysm sidecar using either a **Secret** or a **ConfigMap**. This allows each RADOSGW deployment to customize the sidecar's behavior independently.
88
+
The webhook supports injecting **environment variables** into the Prysm sidecar
89
+
using either a **Secret** or a **ConfigMap**. This allows each RADOSGW
90
+
deployment to customize the sidecar's behavior independently.
74
91
75
92
### Option 1: Use a Secret
76
93
@@ -134,11 +151,13 @@ data:
134
151
```
135
152
### You Can Use Both
136
153
137
-
If both annotations are set, the sidecar will receive **both** sources via envFrom, in the order:
154
+
If both annotations are set, the sidecar will receive **both** sources via
155
+
envFrom, in the order:
138
156
1. Secret (if specified)
139
157
2. ConfigMap (if specified)
140
158
141
-
This allows sensitive data to be stored in Secrets, while general config can go in a ConfigMap.
159
+
This allows sensitive data to be stored in Secrets, while general config can go
160
+
in a ConfigMap.
142
161
143
162
### Benefits
144
163
@@ -148,7 +167,8 @@ This allows sensitive data to be stored in Secrets, while general config can go
148
167
149
168
---
150
169
### Important Notes
151
-
> The referenced Secret or ConfigMap must exist before the deployment is created, or pod startup may fail.
170
+
> The referenced Secret or ConfigMap must exist before the deployment is
171
+
> created, or pod startup may fail.
152
172
153
173
---
154
174
@@ -160,8 +180,10 @@ This allows sensitive data to be stored in Secrets, while general config can go
160
180
| `SIDECAR_IMAGE` | The Prysm sidecar image (use a specific version tag) | _None_ |
161
181
162
182
### **Best Practice: Use Explicit Version Tags**
163
-
It is **strongly recommended** to use a **specific version tag** instead of `latest` to ensure:
164
-
- **Predictability**: Prevents unexpected changes due to automatic image updates.
183
+
It is **strongly recommended** to use a **specific version tag** instead of
184
+
`latest`. This ensures:
185
+
- **Predictability**: Prevents unexpected changes due to automatic image
186
+
updates.
165
187
- **Security**: Avoids potential vulnerabilities in newly pushed images.
166
188
- **Stability**: Ensures compatibility with the webhook’s configuration.
167
189
@@ -172,15 +194,17 @@ env:
172
194
value: "ghcr.io/cobaltcore-dev/prysm:v1.2.3"
173
195
```
174
196
175
-
This ensures that **every deployment uses the same tested and verified version** of the Prysm sidecar.
197
+
This ensures that **every deployment uses the same tested and verified
198
+
version** of the Prysm sidecar.
176
199
177
200
⸻
178
201
179
202
## **Deployment**
180
203
181
204
#### **Deploy cert-manager Resources**
182
205
183
-
The webhook **uses cert-manager** to **generate TLS certificates** and **automatically inject the CA bundle** into the MutatingWebhookConfiguration.
206
+
The webhook **uses cert-manager** to **generate TLS certificates** and
207
+
**automatically inject the CA bundle** into the MutatingWebhookConfiguration.
184
208
```yaml
185
209
apiVersion: cert-manager.io/v1
186
210
kind: Issuer
@@ -268,4 +292,4 @@ webhooks:
268
292
apiVersions: ["v1"]
269
293
resources: ["deployments"]
270
294
```
271
-
For more information, visit the [Prysm ops-log local-producer](https://github.com/cobaltcore-dev/prysm/blob/main/pkg/producers/opslog/README.md) documentation.
295
+
For more information, visit the [Prysm ops-log local-producer](https://github.com/cobaltcore-dev/prysm/blob/main/pkg/producers/opslog/README.md) documentation.
0 commit comments