Comments (8)
No worries that's enough to start with, thanks!
I dove into some of the code yesterday when trying to track down exactly what the management container was doing so I'm familiar enough that I can start with that I think. If you had some specifics that would be great but I spend most of my day in Go so I can dig around. Pointers to those tests is useful though!
from kube-mgmt.
Hi @opalmer, I guess you are working on this issue. we are also waiting for this fix.
from kube-mgmt.
Hello @opalmer
I would like to propose a different view on the solution of the issue you've described.
It is my personal preference because I assume it's easier to implement.
- The solution is introducing a new operational mode for kube-mgmt binary, let's call it "one-shot#.
- Currently kube-mgmt works as a daemon, listening to kis events and calling OPA REST API.
- In one-shot mode, enabled by new command line options, kube-mgmt instead will execute one time query against k8s API to get all data / policy config maps as well as other k8s resources that have to be replicated, serializing them to a directory in file system as OPA bundle. And then exit.
- So, this new mode can be later used as an init container to OPA container. Via shared volume and OPA container configuration that will load OPA from the volume's bundle we can guarantee tht OPA container will start with pre populated data.
- OPA container should be configured not to reload data from the file system, and the readiness probe should be configured to not allow traffik until init container completes.
from kube-mgmt.
That's pretty much exactly what I was going for, only difference would be a step 6:
kube-mgmt
side car will start but not run thekube-mgmt
binary until opa is up and has been loaded with policies.
This could be maybe be accomplished by sharing a volume between the two containers and having kube-mgmt
in the opa container writing out a file after the rules are loaded. Or kube-mgmt
could simply attempt to POST to rules to opa until it's ready (all the while kube-mgmt
's health check would fail until that's successful).
from kube-mgmt.
That's pretty much exactly what I was going for, only difference would be a step 6:
kube-mgmt
side car will start but not run thekube-mgmt
binary until opa is up and has been loaded with policies.This could be maybe be accomplished by sharing a volume between the two containers and having
kube-mgmt
in the opa container writing out a file after the rules are loaded. Orkube-mgmt
could simply attempt to POST to rules to opa until it's ready (all the whilekube-mgmt
's health check would fail until that's successful).
This is already implemented in #210
I.e. kube-mgmt is not started until OPA readiness check passed.
from kube-mgmt.
@opalmer are you able / willing to contribute ?
from kube-mgmt.
I can try and give it a shot yeah, may not be immediate but given this is an issue I've come across in production I should be able to make time for it.
I'll dig into the code base and see if I've got questions about where to start. If you have any pointers though in terms of the bits I'll want to look at first, that would be helpful.
from kube-mgmt.
I can try and give it a shot yeah, may not be immediate but given this is an issue I've come across in production I should be able to make time for it.
I'll dig into the code base and see if I've got questions about where to start. If you have any pointers though in terms of the bits I'll want to look at first, that would be helpful.
Hello
I 'll be very appreciated if you can try to address this.
I am not golang dev, so wont suggest any useful, I am usually doing in trial and error mode.
From testing perspective - take a look at justfile, you can find command there to setup local k8s cluster, build and test project.
Also, from Helm side you will need to create unit tests for chart rendering (test/unit) and e2e tests (test/e2e),we can discuss scenarios later.
from kube-mgmt.
Related Issues (20)
- When OPA container restarted kube-mgmt is not re-syncing the policies HOT 2
- opa-kube-mgmt Helm Chart config can't use existing Cert-Manager Issuer or an existing Secret created from Cert-Manager HOT 4
- CVE Vulnerabilities HOT 1
- Add startup probe to kube-mgmt container HOT 12
- Add liveness probe to kube-mgmt container HOT 5
- Do not use ClusterRole and ClusterRoleBinding when .Values.mgmt.namespaces list is empty
- {"code":"undefined_document","message":"document missing: data.system.main"} HOT 4
- OPA, Kubernetes role/rolebinding and strimzi HOT 2
- Breaking change on 6.0.0 or greater HOT 4
- Fix CVEs for golang.org/x/net CVE-2023-39325, CVE-2023-3978, CVE-2023-44487 HOT 2
- Upgrading Issues HOT 8
- High Severity Vulnerability Found in Snyk Scan in v8.5.4 or below HOT 1
- Kube-mgmt syncing issue with ConfigMap kube-root-ca.crt and unexpected logs HOT 4
- Alpine 3.16 is running out of support by May 2023 HOT 1
- Bug: extraVolumes not working if bootstrapPolicies is not enabled HOT 4
- High Vulnerability Found in version `8.5.7` with Snyk scan for the latest image of kube-mgmt
- help to build kube-mgmt locally. HOT 5
- Not possible to add extra container ports HOT 3
- High Risk Vulnerability found in 8.5.7 image HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kube-mgmt.