Comments (7)
Hi. By “Vault”, do you mean Kopf’s Vault (an internal class not exposed to users), or some other vault?
If the former (Kopf’s vault), the re-authentication process is already secured and all other API operations are blocked until it is finished, as far as I remember. The existing connections, e.g. watch-streams, will continue working and calling handlers until disconnected.
If the latter (your vault), the global lock, so as global anything (e.g. condition, list, dict, set) can be done via the “global memo” with the global object created in the startup handler and used in all the object handlers. The global (on-startup) “memo” is shallow-copied for each k8s object, so the local keys/attrs remain local, but the initial values and all mutable structures remain shared. See the docs for details and examples.
from kopf.
Cool. Makes sense now.
- Create one of these locks in the operator startup (in
on.startup
is ok?) and store in the memo. - Lock/Unlock where I deal with the token acquisition
- Then I'll store the token itself in a kube secret so it survives operator pod restarts.
from kopf.
Hi,
Thanks for the reply. By "Vault", I mean Hashicorp Vault.
Do you have some links into the docs where this sync mechanism is explained? I basically need to block all threads accessing the piece of code that authenticates with Vault while the Vault token is renewed if needed, so it's basically a mutex operation I need.
The lifetime of the vault token is less than that of the operator, so on entry to the event (it's on on.timer
) I need to check the validity of the token and possibly renew it, then update the kube secret that will store it.
from kopf.
Or are you suggesting that a memo class may be used as the storage for the token - and this will survive evictions, and the value stored may be updated at runtime?
That would save me from having to manage a kube secret myself, however I still need to block during token renewal.
from kopf.
Maybe. I do not know how Hashicorp Vault & its tokens work. The memo's lifecycle is no longer than the operator's lifecycle: when it exits, the memo is lost. If that is okay, then yes, you can use the memo also to store the token.
But mind that you probably want to store it not directly, but in a 1-item list/set/dict or your own mutable object — since you are going to update it from time to time, and other k8s objects should see the updated value.
What I meant originally is storing an asyncio.Lock
/threading.Lock
object there, which is then used to prevent multiple handlers from refreshing the token in parallel at once.
from kopf.
Hi @nolar
One last thing. I'd like to expose Prometheus metrics. I found #289, however have you thought any further on this since then?
from kopf.
I was overly busy with work & life & German bureaucracy in the past couple of years, but I am slowly getting back to Kopf (not full-time of course). A long sequence of refactorings and improvements is being prepared, after which I will be able to look at new features. No timeline though.
from kopf.
Related Issues (20)
- Flakey behavior of on.create handler not reacting to CRO creation event. HOT 1
- Automating Kopf Operator Code Updates: Seeking a Convenient Solution to Avoid Tedious Run Commands HOT 1
- Controlling Kopf Operator Behavior to Prevent Unwanted Object Creation HOT 8
- Using named import in kopf
- Handle large resource spec being annotated to `last-handled-configuration` HOT 3
- Namespace deletion is stuck when using namespace selector startup mode HOT 1
- Infinite watch-streams stopping immediately with no obvious reasons why. The watched resources do then spin up.
- Liveness probe stops working HOT 2
- Kubernetes client not configured in startup handler HOT 3
- Admission Controller Path
- `FieldSpec` and `resolve` does not support list access
- Attach to container start event
- Behaviour of timer with finalizer
- Finalisers race condition
- Finalizers from other controllers conflicting with kopf finalizer
- Kopf does not restart after 429 too many requests error HOT 3
- How to avoid Errors accessing metrics API and CRDs HOT 1
- add cwd to sys.path HOT 4
- Allow kopf.adopt to Communicate Resource Readiness to ArgoCD HOT 4
- Object stuck in loop with inconsistent status updates and handler failure HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kopf.