ephemeral storage resources

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 Features:
 * Support for setting [`disable_keep_alives`](https://github.com/hashicorp/vault/pull/16479) in the agent config [GH-376](https://github.com/hashicorp/vault-k8s/pull/376)
+* Added flags, envs and annotations to control ephemeral storage resources for injected containers: [GH-360](https://github.com/hashicorp/vault-k8s/pull/360)
 
 ## 0.17.0 (July 28, 2022)
 

agent-inject/agent/agent.go

@@ -67,6 +67,9 @@ type Agent struct {
 	// LimitsMem is the upper memory limit the sidecar container is allowed to consume.
 	LimitsMem string
 
+	// LimitsEphemeral is the upper ephemeral storage limit the sidecar container is allowed to consume.
+	LimitsEphemeral string
+
 	// Namespace is the Kubernetes namespace the request originated from.
 	Namespace string
 
@@ -97,6 +100,9 @@ type Agent struct {
 	// RequestsMem is the requested minimum memory amount required when being scheduled to deploy.
 	RequestsMem string
 
+	// RequestsEphemeral is the requested minimum ephemeral storage amount required when being scheduled to deploy.
+	RequestsEphemeral string
+
 	// Secrets are all the templates, the path in Vault where the secret can be
 	// found, and the unique name of the secret which will be used for the filename.
 	Secrets []*Secret
@@ -330,12 +336,14 @@ func New(pod *corev1.Pod, patches []*jsonpatch.JsonPatchOperation) (*Agent, erro
 		DefaultTemplate:           pod.Annotations[AnnotationAgentInjectDefaultTemplate],
 		LimitsCPU:                 pod.Annotations[AnnotationAgentLimitsCPU],
 		LimitsMem:                 pod.Annotations[AnnotationAgentLimitsMem],
+		LimitsEphemeral:           pod.Annotations[AnnotationAgentLimitsEphemeral],
 		Namespace:                 pod.Annotations[AnnotationAgentRequestNamespace],
 		Patches:                   patches,
 		Pod:                       pod,
 		Containers:                []string{},
 		RequestsCPU:               pod.Annotations[AnnotationAgentRequestsCPU],
 		RequestsMem:               pod.Annotations[AnnotationAgentRequestsMem],
+		RequestsEphemeral:         pod.Annotations[AnnotationAgentRequestsEphemeral],
 		ServiceAccountTokenVolume: sa,
 		Status:                    pod.Annotations[AnnotationAgentStatus],
 		ExtraSecret:               pod.Annotations[AnnotationAgentExtraSecret],

agent-inject/agent/annotations.go

@@ -113,19 +113,24 @@ const (
 	// AnnotationAgentExtraSecret is the name of a Kubernetes secret that will be mounted
 	// into the Vault agent container so that the agent config can reference secrets.
 	AnnotationAgentExtraSecret = "vault.hashicorp.com/agent-extra-secret"
-
 	// AnnotationAgentLimitsCPU sets the CPU limit on the Vault Agent containers.
 	AnnotationAgentLimitsCPU = "vault.hashicorp.com/agent-limits-cpu"
 
 	// AnnotationAgentLimitsMem sets the memory limit on the Vault Agent containers.
 	AnnotationAgentLimitsMem = "vault.hashicorp.com/agent-limits-mem"
 
+	// AnnotationAgentLimitsEphemeral sets the ephemeral storage limit on the Vault Agent containers.
+	AnnotationAgentLimitsEphemeral = "vault.hashicorp.com/agent-limits-ephemeral"
+
 	// AnnotationAgentRequestsCPU sets the requested CPU amount on the Vault Agent containers.
 	AnnotationAgentRequestsCPU = "vault.hashicorp.com/agent-requests-cpu"
 
 	// AnnotationAgentRequestsMem sets the requested memory amount on the Vault Agent containers.
 	AnnotationAgentRequestsMem = "vault.hashicorp.com/agent-requests-mem"
 
+	// AnnotationAgentRequestsEphemeral sets the ephemeral storage request on the Vault Agent containers.
+	AnnotationAgentRequestsEphemeral = "vault.hashicorp.com/agent-requests-ephemeral"
+
 	// AnnotationAgentRevokeOnShutdown controls whether a sidecar container will revoke its
 	// own Vault token before shutting down. If you are using a custom agent template, you must
 	// make sure it's written to `/home/vault/.vault-token`. Only supported for sidecar containers.
@@ -299,8 +304,10 @@ type AgentConfig struct {
 	DefaultTemplate            string
 	ResourceRequestCPU         string
 	ResourceRequestMem         string
+	ResourceRequestEphemeral   string
 	ResourceLimitCPU           string
 	ResourceLimitMem           string
+	ResourceLimitEphemeral     string
 	ExitOnRetryFailure         bool
 	StaticSecretRenderInterval string
 	AuthMinBackoff             string
@@ -380,6 +387,10 @@ func Init(pod *corev1.Pod, cfg AgentConfig) error {
 		pod.ObjectMeta.Annotations[AnnotationAgentLimitsMem] = cfg.ResourceLimitMem
 	}
 
+	if _, ok := pod.ObjectMeta.Annotations[AnnotationAgentLimitsEphemeral]; !ok {
+		pod.ObjectMeta.Annotations[AnnotationAgentLimitsEphemeral] = cfg.ResourceLimitEphemeral
+	}
+
 	if _, ok := pod.ObjectMeta.Annotations[AnnotationAgentRequestsCPU]; !ok {
 		pod.ObjectMeta.Annotations[AnnotationAgentRequestsCPU] = cfg.ResourceRequestCPU
 	}
@@ -388,6 +399,10 @@ func Init(pod *corev1.Pod, cfg AgentConfig) error {
 		pod.ObjectMeta.Annotations[AnnotationAgentRequestsMem] = cfg.ResourceRequestMem
 	}
 
+	if _, ok := pod.ObjectMeta.Annotations[AnnotationAgentRequestsEphemeral]; !ok {
+		pod.ObjectMeta.Annotations[AnnotationAgentRequestsEphemeral] = cfg.ResourceRequestEphemeral
+	}
+
 	if _, ok := pod.ObjectMeta.Annotations[AnnotationVaultSecretVolumePath]; !ok {
 		pod.ObjectMeta.Annotations[AnnotationVaultSecretVolumePath] = secretVolumePath
 	}

agent-inject/agent/annotations_test.go

@@ -18,23 +18,25 @@ import (
 
 func basicAgentConfig() AgentConfig {
 	return AgentConfig{
-		Image:              "foobar-image",
-		Address:            "http://foobar:8200",
-		AuthType:           DefaultVaultAuthType,
-		AuthPath:           "test",
-		Namespace:          "test",
-		RevokeOnShutdown:   true,
-		UserID:             "100",
-		GroupID:            "1000",
-		SameID:             DefaultAgentRunAsSameUser,
-		SetSecurityContext: DefaultAgentSetSecurityContext,
-		ProxyAddress:       "http://proxy:3128",
-		DefaultTemplate:    DefaultTemplateType,
-		ResourceRequestCPU: DefaultResourceRequestCPU,
-		ResourceRequestMem: DefaultResourceRequestMem,
-		ResourceLimitCPU:   DefaultResourceLimitCPU,
-		ResourceLimitMem:   DefaultResourceLimitMem,
-		ExitOnRetryFailure: DefaultTemplateConfigExitOnRetryFailure,
+		Image:                    "foobar-image",
+		Address:                  "http://foobar:8200",
+		AuthType:                 DefaultVaultAuthType,
+		AuthPath:                 "test",
+		Namespace:                "test",
+		RevokeOnShutdown:         true,
+		UserID:                   "100",
+		GroupID:                  "1000",
+		SameID:                   DefaultAgentRunAsSameUser,
+		SetSecurityContext:       DefaultAgentSetSecurityContext,
+		ProxyAddress:             "http://proxy:3128",
+		DefaultTemplate:          DefaultTemplateType,
+		ResourceRequestCPU:       DefaultResourceRequestCPU,
+		ResourceRequestMem:       DefaultResourceRequestMem,
+		ResourceRequestEphemeral: DefaultResourceRequestEphemeral,
+		ResourceLimitCPU:         DefaultResourceLimitCPU,
+		ResourceLimitMem:         DefaultResourceLimitMem,
+		ResourceLimitEphemeral:   DefaultResourceLimitEphemeral,
+		ExitOnRetryFailure:       DefaultTemplateConfigExitOnRetryFailure,
 	}
 }
 

agent-inject/agent/container_sidecar.go

@@ -11,14 +11,16 @@ import (
 
 const (
 	// https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
-	DefaultResourceLimitCPU   = "500m"
-	DefaultResourceLimitMem   = "128Mi"
-	DefaultResourceRequestCPU = "250m"
-	DefaultResourceRequestMem = "64Mi"
-	DefaultContainerArg       = "echo ${VAULT_CONFIG?} | base64 -d > /home/vault/config.json && vault agent -config=/home/vault/config.json"
-	DefaultRevokeGrace        = 5
-	DefaultAgentLogLevel      = "info"
-	DefaultAgentLogFormat     = "standard"
+	DefaultResourceLimitCPU         = "500m"
+	DefaultResourceLimitMem         = "128Mi"
+	DefaultResourceLimitEphemeral   = "128Mi"
+	DefaultResourceRequestCPU       = "250m"
+	DefaultResourceRequestMem       = "64Mi"
+	DefaultResourceRequestEphemeral = "64Mi"
+	DefaultContainerArg             = "echo ${VAULT_CONFIG?} | base64 -d > /home/vault/config.json && vault agent -config=/home/vault/config.json"
+	DefaultRevokeGrace              = 5
+	DefaultAgentLogLevel            = "info"
+	DefaultAgentLogFormat           = "standard"
 )
 
 // ContainerSidecar creates a new container to be added
@@ -133,6 +135,14 @@ func (a *Agent) parseResources() (corev1.ResourceRequirements, error) {
 		limits[corev1.ResourceMemory] = mem
 	}
 
+	if a.LimitsEphemeral != "" {
+		ephemeral, err := parseQuantity(a.LimitsEphemeral)
+		if err != nil {
+			return resources, err
+		}
+		limits[corev1.ResourceEphemeralStorage] = ephemeral
+	}
+
 	resources.Limits = limits
 
 	// Requests
@@ -152,6 +162,14 @@ func (a *Agent) parseResources() (corev1.ResourceRequirements, error) {
 		requests[corev1.ResourceMemory] = mem
 	}
 
+	if a.RequestsEphemeral != "" {
+		ephemeral, err := parseQuantity(a.RequestsEphemeral)
+		if err != nil {
+			return resources, err
+		}
+		requests[corev1.ResourceEphemeralStorage] = ephemeral
+	}
+
 	resources.Requests = requests
 
 	return resources, nil