Inject sidecars in other controllers

[ptescher]

For instance, on OpenShift if we are using DeploymentConfigs instead of Deployments we cant auto inject jaeger sidecars. With the latest Istio setup on OpenShift daemonsets are deprecated, so this becomes more important.

Places I can think of where sidecars could be injected:

• Deployments
• StatefulSets
• DaemonSets
• DeploymentConfigs (OpenShift)
• CronJobs

I think #171 would solve this for all controllers (as well as pods without a controller).

[jpkrohling]

One of the motivations behind #171 is indeed to be able to inject sidecars into any workload that is backed by pods, but it adds some complexity to the setup. Unfortunately, this can't be currently covered by OLM (to the best of our knowledge), so, it's currently a blocker for us.

If you absolutely require support for DeploymentConfigs, we could discuss about adding it to the current mechanism, but it will bring quite some maintenance burden.

[jpkrohling]

I'm marking as "duplicate", as I'm sure we talked about this in the past.

[ptescher]

I just added the sidecars manually for now, which works for small deployments. Not a blocker.

[ptescher]

I just added the sidecars manually for now, which works for small deployments. Not a blocker. While #171 can't be dealt with purely on OLM, it looks like the actual complexity of the webhook (the ca bundle, etc) can be. The actual injector is relatively simple and could be run as its own service.

[jpkrohling]

Apparently, support for mutating webhook is coming to the operator SDK in the future. Once it is there, we should certainly re-evaluate this!

[chevalier-m]

It is a blocker for some usages, we like to deploy our artifcats the same way, using one single "rule them all" pipeline, which makes it impossible for us, as of today, to unify completely, because our periodic jobs do not receive their associated sidecar. We have to rely on a DaemonSet "ring" of agents to which our workloads connects.
I am sure we are not the only ones trying to unify their workloads deployment strategies in terms of labels, annotations, URLs and such, that's why I believe this can be a very valuable feature.

Maybe regular one off Job(s) could benefit from this feature eventually?

[chevalier-m]

Oh I might add, I'm now programatically adding the sidecar agent when generating the cronjob, using my conventionnal --reporter.grpc.host-port=dns://my-jaeger-collector-headless.ns-jaeger:14250.

Worth noting, when the job finishes, the jaeger-agent doesn't exit and thus the job doesn't complete because of the sidecar nature of the agent (discussed more widely over there: kubernetes/kubernetes#25908 .

I am just giving this as a sidenote to be kept in mind, I'll fall back to another mode of functionning for .my jobs

[sergeyshaykhullin]

Can operator start supporting inject in ArgoCD Rollouts? https://argoproj.github.io/argo-rollouts/

[jpkrohling]

As I understood, ArgoCD Rollouts create ReplicaSets. As such, it should work once #171 is there.