fix: support for ephemeral container mutation #3560
Conversation
Signed-off-by: Brandt Keller <[email protected]>
✅ Deploy Preview for zarf-docs ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
Codecov ReportAttention: Patch coverage is
🚀 New features to boost your workflow:
|
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
|
Current side-effect - image annotations get updated as a not-entirely-idempotent workflow. Working to address this. |
Signed-off-by: Brandt Keller <[email protected]>
|
@brandtkeller To give some more context, the reason the agent is not fully idemopotent is because of the crchash we append to images, see https://docs.zarf.dev/ref/init-package/#image-mutation-to-unique-hashed-tags. If the agent was to mutate these resources twice, the crchash would no longer be correct. Open to other ways of checking besides a patched label, but I know that confused me when I first saw it |
|
Thanks for the context @AustinAbro321. Agree on multiple mutation side-effects. I do believe that the transform has an early return in the case of the |
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
|
Great point, I thought I remembered running into a gotcha here, maybe it was just the annotations |
There was a problem hiding this comment.
I think we should add to the E2E tests to ensure the kube API server is sending us the information we expect, I.E. an empty sub resource on non ephemeral container requests and responding to the changes in the webhook.yaml properly.
Other than that looks good
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
| stdOut, stdErr, err = e2e.Kubectl(t, "debug", "test-pod", "-n", "test", "--image=busybox:1.36", "--profile", "general") | ||
| require.NoError(t, err, stdOut, stdErr) | ||
|
|
||
| // there is no native 'wait' logic for ephemeral containers |
There was a problem hiding this comment.
This is a bit "cludgy" - if there is a better pattern here - I am open to it. Otherwise there is some race condition between the kubectl debug command and get command such that it returns an empty string (possibly getting information too quickly before the mutation and admission has occurred).
There was a problem hiding this comment.
Looks like should work
kubectl wait --for=condition=Ready pod/my-debug-pod --timeout=10s
There was a problem hiding this comment.
Definitely favor an await-style API over polling and checking 👍
There was a problem hiding this comment.
The issue here being that the pod status never changes and the use of debug is adding a ephemeral container to an existing pod.
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
|
|
||
| // cleanup - should perform cleanup in the event of pass or fail | ||
| t.Cleanup(func() { | ||
| e2e.Zarf(t, "package", "remove", "basic-pod", "--confirm") //nolint:errcheck |
| var ephemeralContainer string | ||
|
|
||
| select { | ||
| case ephemeralContainer = <-resultCh: |
Description
See the related issue - Ephemeral Containers are not explicitly supported by the zarf agent for mutation. This adds support by ensuring the
pods/ephemeralcontainerssubresource is being included in theMutatingWebhookConfiguration.largely this should always be an operation that is being done on a pod that has already been patched - therefore we need to enable an exception for a pre-patched pod to still allow mutation of the ephemeral containers even if previously patched.
Changes
A pod cannot be created or updated with ephemeral containers defined declaratively. The original code for ephemeral containers should not be reachable - therefor moved it out of the primary pod mutation logic and into the ephemeral containers mutation logic.
Related Issue
Fixes #2153
Checklist before merging