Skip to content

Commit 701aa95

Browse files
authored
Update README.md
Corrected typos and wording Signed-off-by: BarbaraW-PM <barbara@vabarbara.de>
1 parent 2509525 commit 701aa95

1 file changed

Lines changed: 45 additions & 21 deletions

File tree

ops-log-k8s-mutating-wh/README.md

Lines changed: 45 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,32 @@
11
# Prysm Kubernetes Mutating Webhook for RADOSGW Sidecar Injection
22

3-
This is a Kubernetes **Mutating Admission Webhook** designed to automatically inject a **Prysm sidecar** into **RADOSGW deployments** managed by Rook-Ceph. The sidecar container scans **RGW operation logs** and exposes **Prometheus metrics**.
3+
This is a Kubernetes **Mutating Admission Webhook** designed to automatically
4+
inject a **Prysm sidecar** into **RADOSGW deployments** managed by Rook-Ceph.
5+
The sidecar container scans **RGW operation logs** and exposes **Prometheus
6+
metrics**.
47

58
## Features
69

7-
- **Automatic Sidecar Injection**: Detects `rook-ceph-rgw` deployments and injects a **Prysm sidecar**.
8-
- **Prometheus Metrics**: Extracts metrics from `rgw-ops-logs` and serves them on port **9090**.
9-
- **Dynamic Image Configuration**: Supports configuring the sidecar image via the `SIDECAR_IMAGE` environment variable.
10-
- **Cert-Manager Integration**: Uses `cert-manager` to generate TLS certificates, with **automatic CA bundle injection**.
10+
- **Automatic Sidecar Injection**: Detects `rook-ceph-rgw` deployments and
11+
injects a **Prysm sidecar**.
12+
- **Prometheus Metrics**: Extracts metrics from `rgw-ops-logs` and serves them
13+
on port **9090**.
14+
- **Dynamic Image Configuration**: Supports configuring the sidecar image via
15+
the `SIDECAR_IMAGE` environment variable.
16+
- **Cert-Manager Integration**: Uses `cert-manager` to generate TLS
17+
certificates, with **automatic CA bundle injection**.
1118
- **Secure Webhook**: Runs on port **8443** and validates incoming deployments.
1219

1320
---
1421

1522
## **Automatic Sidecar Injection**
16-
The webhook **automatically detects** RADOSGW (`rook-ceph-rgw`) deployments and injects a **Prysm sidecar** container. It ensures that only specific RADOSGW instances are modified by checking **a predefined set of labels**.
23+
The webhook **automatically detects** RADOSGW (`rook-ceph-rgw`) deployments and
24+
injects a **Prysm sidecar** container. It ensures that only specific RADOSGW
25+
instances are modified by checking **a predefined set of labels**.
1726

1827
### **Label Requirements**
19-
To be **eligible for mutation**, a deployment **must have the following labels**:
28+
To be **eligible for mutation**, a deployment **must have the following
29+
labels**:
2030

2131
| Label | Description |
2232
|-------|-------------|
@@ -43,9 +53,12 @@ spec:
4353
If this label is not set, the webhook will not modify the deployment.
4454
4555
#### **Sidecar Injection Process**
46-
1. The webhook listens for CREATE and UPDATE operations on Deployment resources.
47-
2. When a new or updated deployment matches the required labels, the webhook inspects its pod specification.
48-
3. If the **Prysm sidecar is missing**, it is **automatically injected** with the following configuration:
56+
1. The webhook listens for CREATE and UPDATE operations on Deployment
57+
resources.
58+
2. When a new or updated deployment matches the required labels, the
59+
webhook inspects its pod specification.
60+
3. If the **Prysm sidecar is missing**, it is **automatically injected** with
61+
the following configuration:
4962
- **Container Name**: `prysm-sidecar`
5063
- **Image**: Defined by `SIDECAR_IMAGE` environment variable.
5164
- **Args**:
@@ -61,16 +74,20 @@ If this label is not set, the webhook will not modify the deployment.
6174
- `/var/lib/ceph/crash` (Crash logs)
6275
- **Environment Variables**:
6376
- `POD_NAME`: Auto-populated with the pod’s name.
64-
4. If a **Prysm sidecar already exists**, the webhook **updates it** to ensure consistency with the latest configuration.
77+
4. If a **Prysm sidecar already exists**, the webhook **updates it** to ensure
78+
consistency with the latest configuration.
6579
5. The modified deployment is then approved and applied to the cluster.
6680

67-
This ensures consistent, automated sidecar injection into selected rook-ceph-rgw instances, allowing **real-time monitoring of RGW operations**.
81+
This ensures consistent, automated sidecar injection into selected
82+
rook-ceph-rgw instances, allowing **real-time monitoring of RGW operations**.
6883

6984
---
7085

7186
## Configure Sidecar via Secret or ConfigMap
7287

73-
The webhook supports injecting **environment variables** into the Prysm sidecar using either a **Secret** or a **ConfigMap**. This allows each RADOSGW deployment to customize the sidecar's behavior independently.
88+
The webhook supports injecting **environment variables** into the Prysm sidecar
89+
using either a **Secret** or a **ConfigMap**. This allows each RADOSGW
90+
deployment to customize the sidecar's behavior independently.
7491

7592
### Option 1: Use a Secret
7693

@@ -134,11 +151,13 @@ data:
134151
```
135152
### You Can Use Both
136153

137-
If both annotations are set, the sidecar will receive **both** sources via envFrom, in the order:
154+
If both annotations are set, the sidecar will receive **both** sources via
155+
envFrom, in the order:
138156
1. Secret (if specified)
139157
2. ConfigMap (if specified)
140158

141-
This allows sensitive data to be stored in Secrets, while general config can go in a ConfigMap.
159+
This allows sensitive data to be stored in Secrets, while general config can go
160+
in a ConfigMap.
142161

143162
### Benefits
144163

@@ -148,7 +167,8 @@ This allows sensitive data to be stored in Secrets, while general config can go
148167

149168
---
150169
### Important Notes
151-
> The referenced Secret or ConfigMap must exist before the deployment is created, or pod startup may fail.
170+
> The referenced Secret or ConfigMap must exist before the deployment is
171+
> created, or pod startup may fail.
152172

153173
---
154174

@@ -160,8 +180,10 @@ This allows sensitive data to be stored in Secrets, while general config can go
160180
| `SIDECAR_IMAGE` | The Prysm sidecar image (use a specific version tag) | _None_ |
161181

162182
### **Best Practice: Use Explicit Version Tags**
163-
It is **strongly recommended** to use a **specific version tag** instead of `latest` to ensure:
164-
- **Predictability**: Prevents unexpected changes due to automatic image updates.
183+
It is **strongly recommended** to use a **specific version tag** instead of
184+
`latest`. This ensures:
185+
- **Predictability**: Prevents unexpected changes due to automatic image
186+
updates.
165187
- **Security**: Avoids potential vulnerabilities in newly pushed images.
166188
- **Stability**: Ensures compatibility with the webhook’s configuration.
167189

@@ -172,15 +194,17 @@ env:
172194
value: "ghcr.io/cobaltcore-dev/prysm:v1.2.3"
173195
```
174196

175-
This ensures that **every deployment uses the same tested and verified version** of the Prysm sidecar.
197+
This ensures that **every deployment uses the same tested and verified
198+
version** of the Prysm sidecar.
176199

177200
178201

179202
## **Deployment**
180203

181204
#### **Deploy cert-manager Resources**
182205

183-
The webhook **uses cert-manager** to **generate TLS certificates** and **automatically inject the CA bundle** into the MutatingWebhookConfiguration.
206+
The webhook **uses cert-manager** to **generate TLS certificates** and
207+
**automatically inject the CA bundle** into the MutatingWebhookConfiguration.
184208
```yaml
185209
apiVersion: cert-manager.io/v1
186210
kind: Issuer
@@ -268,4 +292,4 @@ webhooks:
268292
apiVersions: ["v1"]
269293
resources: ["deployments"]
270294
```
271-
For more information, visit the [Prysm ops-log local-producer](https://github.com/cobaltcore-dev/prysm/blob/main/pkg/producers/opslog/README.md) documentation.
295+
For more information, visit the [Prysm ops-log local-producer](https://github.com/cobaltcore-dev/prysm/blob/main/pkg/producers/opslog/README.md) documentation.

0 commit comments

Comments
 (0)