Selecting the pods you want to run with Deepfactor

With Deepfactor's mutating admission webhook controller you can instrument pods in your Kubernetes cluster without modifying your podspec. If you would like to know how to install and configure the Deepfactor mutating admission webhook in your K8s cluster refer to the following article

Run your Kubernetes workload with Deepfactor

The following article will describe the fine grained options provided by the webhook that allow you to select which pods you would like to instrument with Deepfactor.

The options of importance for this purpose are:

  1. selector
    This option will let you filter the list of pods based on labels.
  2. Exclude options
    These are a set of options you can use to exclude certain pods or container images from being instrumented with Deepfactor.

Selector

This option is available at the global level webhookconfig level and also at each namespace level. Namespace level setting will override the global setting. This option follows the standard Kubernetes label selector syntax. You can read more about it in the following kubernetes documentation article

Labels and Selectors

Example: You want to instrument only the pods that match following criteria

  1. Pods are running in the eng namespace
  2. Pods have the label env=qa
  3. Pods have the label 'release' and the label 'status' is set to either ready_for_qa or ready_for_staging

The following webhook config will match only the pods with the above criteria.

namespaces:
- name: "eng"
selector:
matchLabels:
env: "qa"
matchExpressions:
- {key: release, operator: exists } # Has some label with release
- {key: status, operator: In, values: [ready_for_qa, ready_for_staging]}

Exclude Options

Deepfactor provides the following exclude options

webhookconfig.namespaces[x].excludePodNamePrefixes
webhookconfig.namespaces[x].excludeImageNamePrefixes
webhookconfig.namespaces[x].excludePodNameRegularExpressions
webhookconfig.namespaces[x].excludeImageNameRegularExpressions

These options can be used to exclude certain pods and container images from instrumentation.

Example 1: You want to exclude all containers that have 'istio' in the image path

excludeImageNameRegularExpressions: ["/istio.*/']

Example 2: You want to exclude all container images from a certain repository

excludeImageNamePrefixes: ["internal.corp.acme.org"]

Example 3: You want to exclude all pods that start with 'internal'

excludePodNamePrefixes: ["internal"]

By combining the selector and the exclude options, you can setup fine grained criteria and target only the pods that you wish to instrument with Deepfactor.

Was this article helpful?
0 out of 0 found this helpful

Comments

0 comments

Please sign in to leave a comment.