kacerrandClaude Opus 5
4114d43e87
Some lines ignored the zap encoder entirely, so `kubectl logs | jq` could
never work:
I0917 19:50:02.580097 1 leaderelection.go:258] "Attempting to acquire
leader lease..." lock="egress-proxies-operator-system/b47711d1..."
That is klog's own stderr writer, not ours. client-go's leader elector
calls klog.FromContext(ctx), and controller-runtime hands the elector a
context with no logr in it -- mgr.Start receives ctrl.SetupSignalHandler(),
which carries no logger. FromContext falls back to Background(), and with
no logger registered that is klog's text sink. Nothing here imported or
configured klog; it was an indirect dependency that around 60 linked
packages use, including client-go/tools/{leaderelection,cache,record} and
client-go/transport. controller-runtime does not route it either -- its
only klog.SetLogger call is in its own test suite.
Plain klog.SetLogger, deliberately not SetLoggerWithOptions with
ContextualLogger(true). The contextual form is what klog's docs recommend
because it skips a klogr round trip, but it also disables klog's verbosity
gate and hands the decision to zap, whose level under Development is Debug
-- so client-go's V(1) chatter, suppressed today by klog's own -v=0, would
have started appearing. Plain SetLogger keeps klog's check in front and
still redirects what it does emit. Same fix to the format, no new volume,
which matters because volume is what prompted this.
The discovery API's http.Server set no ErrorLog, so net/http's own faults
(a failed Accept, a panic escaping a handler) went to the stdlib logger on
stderr. It now drains into logr through logr.ToSlogHandler, the pattern
internal/provider/gcp/wirelog.go already uses for the same purpose.
The deployment gets --zap-encoder=json and --zap-time-encoding=rfc3339.
The flag beats the in-code Development default -- addDefaults fills
NewEncoder only when it is nil -- and the time encoding is not optional,
since the JSON encoder defaults to epoch seconds. Verbosity stays at debug
on purpose; --zap-log-level=info drops the per-RPC lines.
zap.Options{Development: true} stays as the in-code default: flipping it
would change the format for every deployment of this operator, and the
flags get the same result here without that reach.
k8s.io/klog/v2 moves from indirect to direct in go.mod. It was already in
the module graph, so nothing new is downloaded.
No tests: three changes, all wiring, in a file with no test coverage, and
pinning klog.SetLogger means mutating process-global state that leaks into
every other test in the package. Verified in-cluster instead --
`kubectl logs | jq -e -s 'length > 0'` now passes, which fails if any
single line is not JSON.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
188 lines
7.1 KiB
YAML
188 lines
7.1 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
labels:
|
|
control-plane: controller-manager
|
|
app.kubernetes.io/name: egress-proxies-operator
|
|
app.kubernetes.io/managed-by: kustomize
|
|
name: system
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: controller-manager
|
|
namespace: system
|
|
labels:
|
|
control-plane: controller-manager
|
|
app.kubernetes.io/name: egress-proxies-operator
|
|
app.kubernetes.io/managed-by: kustomize
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
control-plane: controller-manager
|
|
app.kubernetes.io/name: egress-proxies-operator
|
|
replicas: 1
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
kubectl.kubernetes.io/default-container: manager
|
|
labels:
|
|
control-plane: controller-manager
|
|
app.kubernetes.io/name: egress-proxies-operator
|
|
spec:
|
|
# TODO(user): Uncomment the following code to configure the nodeAffinity expression
|
|
# according to the platforms which are supported by your solution.
|
|
# It is considered best practice to support multiple architectures. You can
|
|
# build your manager image using the makefile target docker-buildx.
|
|
# affinity:
|
|
# nodeAffinity:
|
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
|
# nodeSelectorTerms:
|
|
# - matchExpressions:
|
|
# - key: kubernetes.io/arch
|
|
# operator: In
|
|
# values:
|
|
# - amd64
|
|
# - arm64
|
|
# - ppc64le
|
|
# - s390x
|
|
# - key: kubernetes.io/os
|
|
# operator: In
|
|
# values:
|
|
# - linux
|
|
securityContext:
|
|
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
|
|
# This ensures that deployments meet the highest security requirements for Kubernetes.
|
|
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- command:
|
|
- /manager
|
|
args:
|
|
- --leader-elect
|
|
- --health-probe-bind-address=:8081
|
|
- --providers-config=/etc/proxy-operator/providers.yaml
|
|
# Structured logs: every line is one JSON object, so `kubectl logs
|
|
# | jq` works. The time encoding is not optional — the JSON encoder
|
|
# defaults to epoch seconds. Verbosity stays at the binary's
|
|
# default (debug, one line per provider API call); add
|
|
# --zap-log-level=info for outcomes only.
|
|
- --zap-encoder=json
|
|
- --zap-time-encoding=rfc3339
|
|
# Add --trace-health-probes to emit one span per health probe
|
|
# (high volume: ~1/s per proxy).
|
|
# Provider health checks (kubectl get providerhealth) run every
|
|
# minute; tune with --provider-check-interval (0 turns them off,
|
|
# otherwise at least 10s) and --provider-check-timeout (15s, or
|
|
# the interval if that is shorter).
|
|
env:
|
|
# Bearer token for the discovery API. Optional: without the
|
|
# Secret the API serves unauthenticated (with a loud warning).
|
|
# Create it with:
|
|
# kubectl -n egress-proxies-operator-system create secret \
|
|
# generic discovery-token --from-literal=token=<your-token>
|
|
- name: DISCOVERY_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: discovery-token
|
|
key: token
|
|
optional: true
|
|
# --- OpenTelemetry tracing ---
|
|
# Tracing is OFF until OTEL_EXPORTER_OTLP_ENDPOINT (or
|
|
# OTEL_TRACES_EXPORTER) is set; without it the operator runs
|
|
# exactly as before. The downward-API vars must stay listed
|
|
# before OTEL_RESOURCE_ATTRIBUTES: $(VAR) expansion only sees
|
|
# earlier-listed vars.
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: OTEL_SERVICE_NAME
|
|
value: egress-proxies-operator
|
|
- name: OTEL_RESOURCE_ATTRIBUTES
|
|
value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(POD_NAMESPACE)
|
|
# Point at an OTLP receiver (Tempo, Jaeger, otel-collector) to
|
|
# enable tracing; http/protobuf (4318) is the default protocol,
|
|
# set OTEL_EXPORTER_OTLP_PROTOCOL=grpc for 4317.
|
|
# - name: OTEL_EXPORTER_OTLP_ENDPOINT
|
|
# value: http://jaeger-collector.observability:4318
|
|
# - name: OTEL_TRACES_SAMPLER
|
|
# value: parentbased_traceidratio
|
|
# - name: OTEL_TRACES_SAMPLER_ARG
|
|
# value: "0.1"
|
|
image: controller:latest
|
|
name: manager
|
|
ports:
|
|
- containerPort: 8081
|
|
name: health
|
|
protocol: TCP
|
|
- containerPort: 8090
|
|
name: discovery
|
|
protocol: TCP
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- "ALL"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8081
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: 8081
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
# TODO(user): Configure the resources accordingly based on the project requirements.
|
|
# More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 10m
|
|
memory: 64Mi
|
|
volumeMounts:
|
|
- name: providers-config
|
|
mountPath: /etc/proxy-operator
|
|
readOnly: true
|
|
# SSH material for the kvm and kvm2 providers (sshKeyFile /
|
|
# knownHostsFile in the providers config point here). One Secret
|
|
# serves both types. Optional: the mount is empty when the Secret
|
|
# does not exist, and only kvm and kvm2 entries need it. Create it with:
|
|
# kubectl -n egress-proxies-operator-system create secret generic kvm-ssh \
|
|
# --from-file=id_ed25519=<private key> \
|
|
# --from-file=known_hosts=<known_hosts with every host's key>
|
|
- name: kvm-ssh
|
|
mountPath: /etc/proxy-operator/kvm
|
|
readOnly: true
|
|
# Scratch space: the root filesystem is read-only, and the kvm
|
|
# provider builds each VM's cloud-init seed ISO through a temp
|
|
# directory (a few hundred KB, deleted right after upload).
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: providers-config
|
|
configMap:
|
|
name: providers-config
|
|
# Shared by the kvm and kvm2 providers; see the mount above.
|
|
- name: kvm-ssh
|
|
secret:
|
|
secretName: kvm-ssh
|
|
optional: true
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 64Mi
|
|
serviceAccountName: controller-manager
|
|
terminationGracePeriodSeconds: 10
|