downward api volume plugin #5093

sdminonne · 2015-03-05T15:02:57Z

This PR implements #560 especially what is discussed here
Dumping info in files is were discussed in #386 as well.

Needs rebasing after #8788 is merged

erictune · 2015-03-05T15:10:07Z

@thockin loves sidecars.

pmorie · 2015-03-05T15:50:18Z

@erictune This PR is hand-crafted to please @thockin

pmorie · 2015-03-05T16:23:06Z

build/pod-info-sidecar/pod-info-sidecar.go

+}
+
+// generateTmpFile writes input parameter 'values' in a temporary file. File descriptor
+// is returned. In case error is returned file descriptor is not meaningfull


Nit: typo: meaningful

thockin · 2015-03-07T05:17:13Z

I do like this! Is this something we think we want to pursue? It seems viable to me...

pmorie · 2015-03-09T16:45:31Z

@thockin If it does the job, I think we can pursue it. One thing that has come up in discussion is concern about the load on the api server as you scale up usage of this sidecar in pods. There's been some concern over making the pod have to use a sidecar container for this in environments where every pod needs to consume this info. @sdminonne @EricMountain-1A do you want to add to that at all?

All that said, this seems like what we will want to go with if we want to move toward all user concerns that use resources happening in a user container. Either way you will have the same amount of disk IO, and if you make the platform provide some baked-in first-class support for this the complexity of the API required to express it starts to approach the API required to fully express a container (as you've mentioned before). I believe the only thing that would change is that you'd have one pod watch per node (once #4777 is implemented) instead of an additional watch per pod.

Any thoughts, @smarterclayton?

sdminonne · 2015-03-09T17:58:28Z

I've a good discussion with @smarterclayton who clarified me some point about re-labeling process (more specifically the fact that a pod is going to be restarted automatically) and the expected load on the master. The latter was my major concern. As soon the load on the master is under control I'm ok with this mechanism (which I finalize anyway) and we may use it.

thockin · 2015-03-10T04:59:30Z

Assuming this uses watch properly, how would the load on the API server be
any different in every pod watches or if kubelet watches on behalf of every
pod? Maybe kubelet could do a single watch for many pods?

If that is an issue, I bet we could do something like watch the kubelet's
API for your own pod, which kubelet would proxy into a group watch on the
API server.

On Mon, Mar 9, 2015 at 10:58 AM, Salvatore Dario Minonne <
notifications@github.com> wrote:

I've a good discussion with @smarterclayton
https://github.com/smarterclayton who clarified me some point about
re-labeling process (more specifically the fact that a pod is going to be
restarted automatically) and the expected load on the master. The latter
was my major concern. As soon the load on the master is under control
I'm ok with this mechanism (which I finalize anyway) and we may use it.

—
Reply to this email directly or view it on GitHub
#5093 (comment)
.

smarterclayton · 2015-03-10T15:24:54Z

Since the kubelet has the labels, and already watches, why can't the pod talk to the kubelet to get this, maybe via the metadata service thing that Rocket has proposed.

----- Original Message -----

Assuming this uses watch properly, how would the load on the API server be
any different in every pod watches or if kubelet watches on behalf of every
pod? Maybe kubelet could do a single watch for many pods?

If that is an issue, I bet we could do something like watch the kubelet's
API for your own pod, which kubelet would proxy into a group watch on the
API server.

On Mon, Mar 9, 2015 at 10:58 AM, Salvatore Dario Minonne <
notifications@github.com> wrote:

I've a good discussion with @smarterclayton
https://github.com/smarterclayton who clarified me some point about
re-labeling process (more specifically the fact that a pod is going to be
restarted automatically) and the expected load on the master. The latter
was my major concern. As soon the load on the master is under control
I'm ok with this mechanism (which I finalize anyway) and we may use it.

—
Reply to this email directly or view it on GitHub
#5093 (comment)
.

Reply to this email directly or view it on GitHub:
#5093 (comment)

thockin · 2015-03-10T15:39:52Z

I think that is more or less what I said :) If you squint.

On Tue, Mar 10, 2015 at 8:25 AM, Clayton Coleman notifications@github.com
wrote:

Since the kubelet has the labels, and already watches, why can't the pod
talk to the kubelet to get this, maybe via the metadata service thing that
Rocket has proposed.

----- Original Message -----

Assuming this uses watch properly, how would the load on the API server
be
any different in every pod watches or if kubelet watches on behalf of
every
pod? Maybe kubelet could do a single watch for many pods?

If that is an issue, I bet we could do something like watch the kubelet's
API for your own pod, which kubelet would proxy into a group watch on the
API server.

On Mon, Mar 9, 2015 at 10:58 AM, Salvatore Dario Minonne <
notifications@github.com> wrote:

I've a good discussion with @smarterclayton
https://github.com/smarterclayton who clarified me some point about
re-labeling process (more specifically the fact that a pod is going to
be
restarted automatically) and the expected load on the master. The
latter
was my major concern. As soon the load on the master is under control
I'm ok with this mechanism (which I finalize anyway) and we may use it.

—
Reply to this email directly or view it on GitHub
<
#5093 (comment)

.

Reply to this email directly or view it on GitHub:

#5093 (comment)

—
Reply to this email directly or view it on GitHub
#5093 (comment)
.

smarterclayton · 2015-03-10T16:11:51Z

You've proven I actually don't read what anyone else writes. /hangs-head

On Mar 10, 2015, at 11:40 AM, Tim Hockin notifications@github.com wrote:

I think that is more or less what I said :) If you squint.

On Tue, Mar 10, 2015 at 8:25 AM, Clayton Coleman notifications@github.com
wrote:

Since the kubelet has the labels, and already watches, why can't the pod
talk to the kubelet to get this, maybe via the metadata service thing that
Rocket has proposed.

----- Original Message -----

Assuming this uses watch properly, how would the load on the API server
be
any different in every pod watches or if kubelet watches on behalf of
every
pod? Maybe kubelet could do a single watch for many pods?

If that is an issue, I bet we could do something like watch the kubelet's
API for your own pod, which kubelet would proxy into a group watch on the
API server.

On Mon, Mar 9, 2015 at 10:58 AM, Salvatore Dario Minonne <
notifications@github.com> wrote:

I've a good discussion with @smarterclayton
https://github.com/smarterclayton who clarified me some point about
re-labeling process (more specifically the fact that a pod is going to
be
restarted automatically) and the expected load on the master. The
latter
was my major concern. As soon the load on the master is under control
I'm ok with this mechanism (which I finalize anyway) and we may use it.

—
Reply to this email directly or view it on GitHub
<
#5093 (comment)

.

Reply to this email directly or view it on GitHub:

#5093 (comment)

—
Reply to this email directly or view it on GitHub
#5093 (comment)
.

—
Reply to this email directly or view it on GitHub.

bgrant0607 · 2015-03-10T17:08:31Z

How is the name of the pod supposed to get set?

This seems pretty heavyweight and opaque to me.

pmorie · 2015-03-10T19:01:16Z

@thockin @smarterclayton Yep, I had had pod querying kubelet and a single watch from kubelet in mind.

@sdminonne Any opinions on that?

sdminonne · 2015-03-12T13:57:44Z

@thockin, @smarterclayton @pmorie sorry for the dealy on this.
I would be OK to watch kubelet and not api-server but to be honest I cannot answer to @bgrant0607's question.

Clues?

smarterclayton · 2015-03-12T14:49:26Z

Kubelet already has watch

On Mar 10, 2015, at 3:01 PM, Paul Morie notifications@github.com wrote:

@thockin @smarterclayton Yep, I had had pod querying kubelet and a single watch from kubelet in mind.

@sdminonne Any opinions on that?

—
Reply to this email directly or view it on GitHub.

thockin · 2015-03-16T04:04:44Z

Kubelet's API should be a reflection of the API server for things that the
kubelet knows about. I'm sure it's not there yet.

On Thu, Mar 12, 2015 at 7:49 AM, Clayton Coleman notifications@github.com
wrote:

Kubelet already has watch

On Mar 10, 2015, at 3:01 PM, Paul Morie notifications@github.com
wrote:

@thockin @smarterclayton Yep, I had had pod querying kubelet and a
single watch from kubelet in mind.

@sdminonne Any opinions on that?

—
Reply to this email directly or view it on GitHub.

—
Reply to this email directly or view it on GitHub
#5093 (comment)
.

sdminonne · 2015-03-16T16:29:58Z

@smarterclayton @thockin the problem I'm facing is the way to get the pod name. For the kubelet I can watch or poll

thockin · 2015-03-16T16:37:09Z

Yeah, we've been punting on exposing that information - Clayton doesn't
like the obvious approach (just slap on some env vars) and nobody has
properly proposed and implemented the alternative (pre-process some env var
values to be "special expansions")

On Mon, Mar 16, 2015 at 9:30 AM, Salvatore Dario Minonne <
notifications@github.com> wrote:

@smarterclayton https://github.com/smarterclayton @thockin
https://github.com/thockin the problem I'm facing is the way to get the
pod name. For the kubelet I can watch or poll

—
Reply to this email directly or view it on GitHub
#5093 (comment)
.

smarterclayton · 2015-03-16T16:42:54Z

I'll make it a priority to iterate the current pull request proposal. The upstream change to Docker to resolve env automatically was the latest wrinkle

On Mar 16, 2015, at 12:37 PM, Tim Hockin notifications@github.com wrote:

Yeah, we've been punting on exposing that information - Clayton doesn't
like the obvious approach (just slap on some env vars) and nobody has
properly proposed and implemented the alternative (pre-process some env var
values to be "special expansions")

On Mon, Mar 16, 2015 at 9:30 AM, Salvatore Dario Minonne <
notifications@github.com> wrote:

@smarterclayton https://github.com/smarterclayton @thockin
https://github.com/thockin the problem I'm facing is the way to get the
pod name. For the kubelet I can watch or poll

—
Reply to this email directly or view it on GitHub
#5093 (comment)
.

—
Reply to this email directly or view it on GitHub.

thockin · 2015-08-31T21:58:35Z

pkg/api/validation/validation.go

+			}
+		}
+		if strings.HasPrefix(items[0], "..") && len(items[0]) > 2 {
+			allErrs = append(allErrs, errs.NewFieldForbidden("path", "must not start with \"..\"."))


this should be Invalid

thockin · 2015-08-31T22:00:48Z

Sorry, a bit of imprecision on the last go-around.

k8s-bot · 2015-08-31T22:16:08Z

GCE e2e build/test failed for commit b6255d6503c8e3c7e5f8f3a858bf41014908eb62.

sdminonne · 2015-09-01T07:58:42Z

@thockin many apologizes for the misunderstanding.
I've already squashed but I've modified only validation(_test)?.go.

k8s-bot · 2015-09-01T08:16:30Z

GCE e2e build/test passed for commit fc738559c9560c5e4f11f06ae9863c63227fd486.

pmorie · 2015-09-01T14:57:24Z

docs/user-guide/downward-api.md

+
+## Example
+
+This is an example of a pod that consumes its labels and annotations via the downward API volume, labels and annotations ared dumped rispectively in `/etc/podlabels` and in `/etc/annotations` files:


are dumped in `/etc/podlabels` and `/etc/annotations`, respectively:

@pmorie thanks

Fixed and squashed

k8s-bot · 2015-09-01T15:40:24Z

GCE e2e build/test failed for commit 0eae3e364addf8db810b94ad86373b1189d0ee8f.

sdminonne · 2015-09-01T15:50:00Z

the fail is really strange just modified the docs... :)

k8s-bot · 2015-09-01T20:47:25Z

GCE e2e build/test passed for commit f4dc065.

thockin · 2015-09-02T05:26:31Z

L G T M

sdminonne · 2015-09-02T07:35:09Z

@thockin thanks :)

pmorie · 2015-09-02T13:53:50Z

@sdminonne o/\o ✊

sdminonne · 2015-09-02T14:18:16Z

@pmorie thanks to you (obviously) too

brendandburns · 2015-09-02T16:49:11Z

@sdminonne Sorry this has to be rebased...

I promise we will then immediately merge...

brendandburns · 2015-09-02T16:52:48Z

nm, it's generated code errors, I'll do it manually.

sdminonne · 2015-09-02T22:07:39Z

@brendandburns many thanks!

googlebot added the cla: yes label Mar 5, 2015

sdminonne mentioned this pull request Mar 5, 2015

Pass pod labels to containers and to lifecycle hooks #560

Closed

erictune assigned erictune and thockin and unassigned erictune Mar 5, 2015

sdminonne changed the title ~~WIP for https://github.com/GoogleCloudPlatform/kubernetes/issues/560~~ WIP: pod info sidecar Mar 5, 2015

pmorie reviewed Mar 5, 2015
View reviewed changes

bgrant0607 mentioned this pull request Mar 7, 2015

WIP: pod preconditions #4245

Closed

This was referenced Mar 18, 2015

add a special container that enables easy access to pod API objects #5553

Closed

Add Kubernetes-specific headers in apiserver proxy. #4440

Closed

sdminonne force-pushed the container_sidecar branch 2 times, most recently from 78547ff to d017361 Compare March 20, 2015 11:32

sdminonne referenced this pull request in sdminonne/kubernetes Mar 20, 2015

WIP 2nd step: start to work

d017361

thockin reviewed Aug 31, 2015
View reviewed changes

sdminonne force-pushed the container_sidecar branch from b6255d6 to fc73855 Compare September 1, 2015 07:54

pmorie reviewed Sep 1, 2015
View reviewed changes

sdminonne force-pushed the container_sidecar branch from fc73855 to 0eae3e3 Compare September 1, 2015 15:17

adding downward api volume plugin

f4dc065

sdminonne force-pushed the container_sidecar branch from 0eae3e3 to f4dc065 Compare September 1, 2015 20:23

thockin added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 2, 2015

brendandburns merged commit f4dc065 into kubernetes:master Sep 2, 2015

sdminonne deleted the container_sidecar branch September 29, 2015 09:30

piascikj mentioned this pull request Nov 3, 2017

add test-webserver example as pointed out in https://github.com/kubernetes/kubernetes/pull/5093#discussion-diff-37606771 imdone/kubernetes#2153

Open

tanjunchen mentioned this pull request Jan 1, 2020

/test: resolve pending TODOs #86756

Closed

snyk-bot mentioned this pull request Apr 17, 2020

[Snyk] Security upgrade protractor from 5.4.4 to 6.0.0 Deckhandfirststar01/kubernetes#20

Open

snyk-bot mentioned this pull request Nov 18, 2020

[Snyk] Security upgrade protractor from 5.4.4 to 6.0.0 Deckhandfirststar01/kubernetes#26

Open

snyk-bot mentioned this pull request Sep 16, 2021

[Snyk] Security upgrade protractor from 5.4.4 to 6.0.0 Deckhandfirststar01/kubernetes#47

Open

snyk-bot mentioned this pull request Apr 2, 2023

[Snyk] Fix for 6 vulnerabilities Deckhandfirststar01/kubernetes#113

Open


		## Example

		This is an example of a pod that consumes its labels and annotations via the downward API volume, labels and annotations ared dumped rispectively in `/etc/podlabels` and in `/etc/annotations` files:

downward api volume plugin #5093

downward api volume plugin #5093

Conversation

sdminonne commented Mar 5, 2015

erictune commented Mar 5, 2015

pmorie commented Mar 5, 2015

pmorie Mar 5, 2015

Choose a reason for hiding this comment

thockin commented Mar 7, 2015

pmorie commented Mar 9, 2015

sdminonne commented Mar 9, 2015

thockin commented Mar 10, 2015

smarterclayton commented Mar 10, 2015

thockin commented Mar 10, 2015

smarterclayton commented Mar 10, 2015

bgrant0607 commented Mar 10, 2015

pmorie commented Mar 10, 2015

sdminonne commented Mar 12, 2015

smarterclayton commented Mar 12, 2015

thockin commented Mar 16, 2015

sdminonne commented Mar 16, 2015

thockin commented Mar 16, 2015

smarterclayton commented Mar 16, 2015

thockin Aug 31, 2015

Choose a reason for hiding this comment

sdminonne Sep 1, 2015

Choose a reason for hiding this comment

thockin commented Aug 31, 2015

k8s-bot commented Aug 31, 2015

sdminonne commented Sep 1, 2015

k8s-bot commented Sep 1, 2015

pmorie Sep 1, 2015

Choose a reason for hiding this comment

sdminonne Sep 1, 2015

Choose a reason for hiding this comment

sdminonne Sep 1, 2015

Choose a reason for hiding this comment

k8s-bot commented Sep 1, 2015

sdminonne commented Sep 1, 2015

k8s-bot commented Sep 1, 2015

thockin commented Sep 2, 2015

sdminonne commented Sep 2, 2015

pmorie commented Sep 2, 2015

sdminonne commented Sep 2, 2015

brendandburns commented Sep 2, 2015

brendandburns commented Sep 2, 2015

sdminonne commented Sep 2, 2015