Kubernetes configures two ways of hot update

1 background

Any application needs some specific configuration items , Features used to customize the application . These configurations can generally be divided into two categories ：

• One is non sensitive configuration such as running environment and external dependencies
• One is such as keys and SSH Sensitive configurations such as certificates .

These configurations should not be placed directly in the container image , Instead, it should be configured to be separated from the container , Through data volume 、 Environment variables are dynamically mounted at runtime .

When we use kubernetes In the process of , Usually, the application configuration file will be placed in ConfigMap or / and Secret in , However, we often encounter the problem of how to make the configuration file effective after it is updated .

User defined Kubernetes Resource object （ for example Deployment、Daemonset etc. ）, Profile to configmap Definition , adopt Volumemounts Mount to Pod in , After the configuration file is modified , The service can automatically reload Load update configuration .

2 Solution

2.1 Reloader

• Limiting conditions ：Kubernetes Version in 1.9 And above
• Cluster installation reloader
• By adding comments annotation The way to achieve

kubectl apply -f https://raw.githubusercontent.com/stakater/Reloader/master/deployments/kubernetes/reloader.yaml

2.1.1 overall situation configmap Trigger update

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: log 
  labels:
    k8s-app: filebeat
  annotations:
    reloader.stakater.com/auto: "true"

2.1.2 As specified configmap Changes automatically trigger configuration updates for resource objects

• single ConfigMap to update

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: log 
  labels:
    k8s-app: filebeat
  annotations:
    configmap.reloader.stakater.com/reload: "filebeat-config"

• many configmap, Multiple... With commas configmap In isolation

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: log 
  labels:
    k8s-app: filebeat
  annotations:
    configmap.reloader.stakater.com/reload: "filebeat-config,foo-config"

2.2 checksum annotation

checksum The note is Helm Charts The most commonly used rolling update method in , That is to say Deployment Of annotations Medium plus Secret perhaps ConfigMap Of sha256sum, Such existing Pod Will follow Secret perhaps ConfigMap Update with changes in .

kind: Deployment
spec:
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
[...]

The effect of adding this section is , stay /configmap.yaml Any changes in , Will result in Deployment Of sepc Under the annotation Be updated , And drive reconstruction pod, To achieve the effect we want .