CODEWITHSUNDEEP
kubernetes
LDom
LDom

Reputation: 5

A way to communicate to a Pod that it's restarting

I need to communicate to a Pod if it's restarting or not. Because depending of the situation my app is working differently (stateful app). I wouldn't like to create other pod that runs a kind of watchdog and then informs my app if it's restarting or not (after a fault). But maybe there is a way to do it with Kubernetes components (Kubelet,..).

Upvotes: 0

Views: 133

Answers (1)

sulabh chaturvedi
sulabh chaturvedi

Reputation: 3984

Quoting from Kubernetes Docs:

  1. Processes in containers inside pods can also contact the apiserver. When they do, they are authenticated as a particular Service Account (for example, default)

  2. A RoleBinding or ClusterRoleBinding binds a role to subjects. Subjects can be groups, users or ServiceAccounts.

  3. An RBAC Role or ClusterRole contains rules that represent a set of permissions.

    A Role always sets permissions within a particular namespace.

    ClusterRole, by contrast, is a non-namespaced resource

So, In-order to get/watch the status of the other pod, you can call Kubernetes API from the pod running your code by using serviceaccounts. Follow below steps in-order to automatically retrieve other pod status from a given pod without any external dependency (Due to reliability concerns, you shouldn't rely upon nodes)

Create a serviceaccount in your pod's (requestor pod) namespace

kubectl create sa pod-reader

If both pods are in same namespace, create role,rolebinding

Create a role

kubectl create role pod-reader --verb=get,watch --resource=pods

Create a rolebinding

kubectl create rolebinding pod-reader-binding --role=pod-reader --serviceaccount=<NAMESPACE>:pod-reader

Else, i.e the pods are in different namespaces, create clusterrole,clusterrolebinding

Create a clusterrole

kubectl create clusterrole pod-reader --verb=get,watch --resource=pods

Create a rolebinding

kubectl create clusterrolebinding pod-reader-binding --clusterrole=pod-reader --serviceaccount=<NAMESPACE>:pod-reader

Verify the permissions

kubectl auth can-i watch pods --as=system:serviceaccount:<NAMESPACE>:pod-reader

Now deploy your pod/(your app) with this serviceaccount.

kubectl create <MY-POD> --image=<MY-CONTAINER-IMAGE> --serviceaccount=pod-reader

This will mount serviceaccount secret token in your pod, which can be found at /var/run/secrets/kubernetes.io/serviceaccount/token. Your app can use this token to make GET requests to Kubernetes API server in-order to get the status of the pod. See below example (this assumes your pod has curl utility installed. However, you can make a relevant API call from your code, pass the Header by reading the serviceaccount token file mounted in your pod).

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)

curl https://kubernetes.default/api/v1/namespaces/<NAMESPACE>/pods/<NAME_OF_THE_OTHER_POD> -H "Authorization: Bearer ${TOKEN}" -k

curl https://kubernetes.default/api/v1/watch/namespaces/<NAMESPACE>/pods/<NAME_OF_THE_OTHER_POD>?timeoutSeconds=30 -H "Authorization: Bearer ${TOKEN}" -k

References:

  1. Kubernetes API

  2. serviceaccount

Upvotes: 3

Related Questions