Package io.hekate.cluster.seed.kubernetes

Class KubernetesSeedNodeProvider

  • All Implemented Interfaces:
    SeedNodeProvider, ConfigReportSupport
    public class KubernetesSeedNodeProvider
extends Object
implements SeedNodeProvider, ConfigReportSupport
    Kubernetes-based implementation of SeedNodeProvider interface.

    Overview

    This provider uses Kubernetes API server to search for all Pods that have a specially named port (Hekate cluster port). Name of that port can be specified via the KubernetesSeedNodeProviderConfig.setContainerPortName(String) configuration property (default value is defined by KubernetesSeedNodeProviderConfig.DEFAULT_CONTAINER_PORT_NAME).

    Example of Pod definition: 

    
---
apiVersion: v1
kind: Pod
metadata:
  name: my-hekate-app
spec:
  containers:
  - image: my-hekate-app:v1
    name: my-hekate-app
    ports:
    - name: hekate   # <--- This (Hekate cluster port)
      containerPort: 10012
    - name: http     # ...some other ports...
      containerPort: 8080

    Note that Pods can have different containers of different types that run different applications, but if such applications must form a single Hekate cluster then all of them should use the same name of Hekate cluster port.

    Configuration

    Please see the documentation of KubernetesSeedNodeProviderConfig class for details about the available configuration options.

    Kubernetes Role-based Access Control (RBAC)

    If Kubernetes cluster is running with Role-based Access Control enabled then it is important to make sure that Pod has permissions to read information about other Pods from Kubernetes API server. It can be done by creating an RBAC Role and binding it to the Pod's Service Account.

    The following example provides a basic example of granting permissions for a Service Account to read information about other Pods: 

    
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: read-pods
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - list
  - get

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: hekate
roleRef:
  kind: Role
  name: read-pods
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: default # Notice! This overrides permissions of 'default' Service Account.

    See Also:
    ClusterServiceFactory.setSeedNodeProvider(SeedNodeProvider), SeedNodeProvider