Add option to restrict opensearch operator to watch a desired namespace #158
Conversation
| @@ -29,6 +29,7 @@ spec: | |||
| - --health-probe-bind-address=:8081 | |||
| - --metrics-bind-address=127.0.0.1:8080 | |||
| - --leader-elect | |||
| - --watch-namespace={{ .Values.manager.watchNamespace }} | |||
There was a problem hiding this comment.
If we don't want to show this env setting when watchNamespace is not set in values.yaml, we can add an if statement around this line.
{{- if . Values.manager.watchNamespace }}
- --watch-namespace={{ .Values.manager.watchNamespace }}
{{- end }}
There was a problem hiding this comment.
I agree. Please wrap it in the if block so the option is only added when a namespace is set.
There was a problem hiding this comment.
Sounds good.
Will add and test it out when I get a chance.
Thanks for reviewing this MR.
There was a problem hiding this comment.
Addressed the comment in latest push.
aarontams
force-pushed
the
add-restricted-watch-namespace-support
branch
from
2728e63
to
1267884
Compare
There was a problem hiding this comment.
Hi @aarontams. Thank you for this PR. Please have a look at my review comments.
| @@ -29,6 +29,7 @@ spec: | |||
| - --health-probe-bind-address=:8081 | |||
| - --metrics-bind-address=127.0.0.1:8080 | |||
| - --leader-elect | |||
| - --watch-namespace={{ .Values.manager.watchNamespace }} | |||
There was a problem hiding this comment.
I agree. Please wrap it in the if block so the option is only added when a namespace is set.
| @@ -24,3 +24,4 @@ spec: | |||
| - "--health-probe-bind-address=:8081" | |||
| - "--metrics-bind-address=127.0.0.1:8080" | |||
| - "--leader-elect" | |||
| - "--watch-namespace" | |||
There was a problem hiding this comment.
Will remove it in next commit.
| @@ -11,3 +11,4 @@ manager: | |||
| image: | |||
| repository: public.ecr.aws/opsterio/opensearch-operator | |||
| tag: latest | |||
| watchNamespace: | |||
There was a problem hiding this comment.
Could you add a comment here to explain that an empty watchNamespace means all namespaces are watched. Just so we have it documented somewhere.
For the future I think we will need a section in the user guide to explain the available helm values.
There was a problem hiding this comment.
Addressed the comment in latest push.
Signed-off-by: aaron.tam <aaron.tam@oracle.com>
aarontams
force-pushed
the
add-restricted-watch-namespace-support
branch
from
1267884
to
b926aca
Compare
|
Thanks @swoehrl-mw |
Task Optionally restrict the opensearch operator to watch a specific namespace.
Scenarios 1 When a k8s cluster has 100 namespaces and each namespace holds one opensearch cluster. If there is only one opensearch operator to manager all 100 opensearch clusters, it will take a lot time to sync all of them.
Scenarios 2 With a single operator to control all the opensearch clusters within the same k8s cluster, you won't have the flexibility to upgrade, downgrade, or pin down certain opensearch clusters.
In production, sometimes users need to run opensearch clusters with different favors - stable, canary, and long term support images within a k8s cluster.
Solution To solve the issues from both scenarios, we can deploy a opensearch operator to each namespace and each operator will be restricted to only manager the opensearch cluster within the same namespace.
When each namespace contains it's own opensearch operator and opensearch cluster, we can selectively upgrade/downgrade some of the namespaces with different opensearch opertor and cluster images. Or even pin down certain namespaces with current older version and upgrade the rest to latest.
watchNamespace
The watchNamespace can be set during helm deployment in values.yaml
manager.watchNamespace, and past to the operator as env variable--watch-namespace={{ .Values.manager.watchNamespace }}, then has the operator to start the controller manager withNamespaceoption.Note In our production system, our operator used to watch all the CRs from all namespaces. After we grew our CRs/namespaces to few tens, we got hit really hard by the performance. We decided to change our design and used local (namespaced) operator few years ago. With that solution, we have been syncing of our applications every 30s and running different image favors on all our k8s fleets.