Admission Controller: Enhance PodPreset to inject containers and init containers

[andraxylia]

This is a feature request to add support in PodPreset for injecting containers and init containers.

Usecase: as a cluster admin, I need the ability to to inject an init container and a proxy sidecar container into a pod, to enable Istio microservices mesh functionality:
https://github.com/istio/istio

kubernetes/enhancements#162
kubernetes/community#254
kubernetes/community#132

[therc]

Another use case: I want a PodPreset to add optionally an init container that fetches gdb/pprof and/or symbols before running the main container (which of course will have hooks to detect if the additional binaries/directories are present and act accordingly).

[ddysher]

Use case: before kubernetes supports logging volume, one option to collect log file is to add a fluentd side car container.

[mikecico]

Use case: Need to make a BCI jar and proxy agent available to containers via sidecar and shared volume, without modifying the target service containers.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[mikecico]

/remove-lifecycle stale

[skurunji85]

This feature is exactly what i was looking for my work. I want to inject init container into POD spec based on some other setting during deployment. Can anyone tell me where to look to find the status of this feature.

[andraxylia]

We wanted to use this feature in Istio (istio.io), but we ended up using admission controllers (initializer and now dynamic webhooks).

I am afraid nobody is working on it.

[skurunji85]

Thanks andraxylia! I will look into initializer and now dynamic webhooks.

[scottrigby]

I don't want to change the lifecycle tag on #55410 so I'm linking to it from this direction.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[mitar]

/reopen /remove-lifecycle rotten

[Alger7w]

So I should write and deploy webhook callback services for every functionality I want to inject into a Pod ?

[timothysc]

Please use mutating web-hooks for this type of behavior -

https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/
https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks
https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook

[mingfang]

PodPresets are declarative and an order of magnitude easier to use than webhooks. I don't see why this can't be done since I'm already using it to inject env variables.

[mikecico]

It does seem like a natural fit. Is there a reason why this shouldn't be allowed from a PodPreset?

[MaxFlanders]

This would be a major benefit. It fits extremely neatly into the skillset that new kubernetes users and operators have been learning to use, only requiring knowledge of label selectors and yaml pod definitions. Mutating webhooks require an entirely new skillset making them much harder to use for new kubernetes adopters.

[iwilltry42]

This project might be interesting for you: https://github.com/tumblr/k8s-sidecar-injector
I admit, that using PodPresets for this would be even better, but I think this also does a good job 👍

[rcreasey]

I, too, would be interested in seeing this be possible in a PodPreset.

/reopen
/remove-lifecycle rotten

[k8s-ci-robot]

@rcreasey: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

I, too, would be interested in seeing this be possible in a PodPreset.

/reopen
/remove-lifecycle rotten

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.