Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Add support for multiple namespaces#107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Closed
blink-so wants to merge8 commits intomainfrommulti-namespace-support
Closed
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 49 additions & 1 deletionREADME.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
# coder-logstream-kube

[![discord](https://img.shields.io/discord/747933592273027093?label=discord)](https://discord.gg/coder)
[![release](https://img.shields.io/github/v/tag/coder/coder-logstream-kube)](https://github.com/coder/envbuilder/pkgs/container/coder-logstream-kube)
[![release](https://img.shields.io/github/v/tag/coder/coder-logstream-kube)](https://github.com/coder/coder-logstream-kube/releases)
[![godoc](https://pkg.go.dev/badge/github.com/coder/coder-logstream-kube.svg)](https://pkg.go.dev/github.com/coder/coder-logstream-kube)
[![license](https://img.shields.io/github/license/coder/coder-logstream-kube)](./LICENSE)

Expand All@@ -10,6 +10,7 @@ Stream Kubernetes Pod events to the Coder startup logs.
- Easily determine the reason for a pod provision failure, or why a pod is stuck in a pending state.
- Visibility into when pods are OOMKilled, or when they are evicted.
- Filter by namespace, field selector, and label selector to reduce Kubernetes API load.
- Support for watching multiple namespaces or all namespaces cluster-wide.

![Log Stream](./scripts/demo.png)

Expand All@@ -24,6 +25,36 @@ helm install coder-logstream-kube coder-logstream-kube/coder-logstream-kube \
--set url=<your-coder-url-including-http-or-https>
```

### Multi-Namespace Support

By default, `coder-logstream-kube` watches pods in the namespace where it's deployed. You can configure it to watch multiple namespaces or all namespaces:

#### Watch specific namespaces
```console
helm install coder-logstream-kube coder-logstream-kube/coder-logstream-kube \
--namespace coder \
--set url=<your-coder-url> \
--set namespaces="namespace1,namespace2,namespace3"
```

#### Watch all namespaces
```console
helm install coder-logstream-kube coder-logstream-kube/coder-logstream-kube \
--namespace coder \
--set url=<your-coder-url> \
--set namespaces=""
```

When watching multiple namespaces or all namespaces, the chart automatically creates ClusterRole and ClusterRoleBinding resources instead of namespace-scoped Role and RoleBinding.

### Environment Variable Configuration

You can also configure namespaces using the `CODER_NAMESPACE` environment variable:

- Single namespace: `CODER_NAMESPACE=my-namespace`
- Multiple namespaces: `CODER_NAMESPACE=ns1,ns2,ns3`
- All namespaces: `CODER_NAMESPACE=""` (empty string)

> **Note**
> For additional customization (such as customizing the image, pull secrets, annotations, etc.), you can use the
> [values.yaml](helm/values.yaml) file directly.
Expand All@@ -46,7 +77,24 @@ Kubernetes provides an [informers](https://pkg.go.dev/k8s.io/client-go/informers

`coder-logstream-kube` listens for pod creation events with containers that have the `CODER_AGENT_TOKEN` environment variable set. All pod events are streamed as logs to the Coder API using the agent token for authentication.

When configured for multiple namespaces, the application creates separate informers for each specified namespace. When configured to watch all namespaces (empty namespace list), it uses cluster-wide informers.

## Custom Certificates

- [`SSL_CERT_FILE`](https://go.dev/src/crypto/x509/root_unix.go#L19): Specifies the path to an SSL certificate.
- [`SSL_CERT_DIR`](https://go.dev/src/crypto/x509/root_unix.go#L25): Identifies which directory to check for SSL certificate files.

## RBAC Permissions

The required permissions depend on the scope of namespaces being watched:

### Single Namespace (Role/RoleBinding)
When watching a single namespace, the application uses namespace-scoped permissions:
- `pods`: get, watch, list
- `events`: get, watch, list
- `replicasets`: get, watch, list

### Multiple Namespaces or All Namespaces (ClusterRole/ClusterRoleBinding)
When watching multiple namespaces or all namespaces, the application requires cluster-wide permissions with the same resource access but across all namespaces.

The Helm chart automatically determines which type of RBAC resources to create based on your configuration.
Binary file addedcoder-logstream-kube
View file
Open in desktop
Binary file not shown.
60 changes: 52 additions & 8 deletionshelm/templates/service.yaml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,24 @@
{{/*
Determine if cluster-wide permissions are needed.
This happens when:
1. namespaces is explicitly set to empty string (watch all namespaces)
2. namespaces contains multiple comma-separated values
3. rbac.clusterWide is explicitly set to true
*/}}
{{- $namespaces := .Values.namespaces | default .Release.Namespace -}}
{{- $namespacesCount := 0 -}}
{{- if eq $namespaces "" -}}
{{- $namespacesCount = 0 -}}
{{- else -}}
{{- $namespacesCount = len (splitList "," $namespaces) -}}
{{- end -}}
{{- $useClusterWide := or .Values.rbac.clusterWide (eq $namespaces "") (gt $namespacesCount 1) -}}

{{- if $useClusterWide }}
apiVersion: rbac.authorization.k8s.io/v1
kind:Role
kind:ClusterRole
metadata:
name: coder-logstream-kube-role
name:{{ .Release.Name }}-coder-logstream-kube-role
rules:
- apiGroups: [""]
resources: ["pods", "events"]
Expand All@@ -10,12 +27,30 @@ rules:
resources: ["replicasets", "events"]
verbs: ["get", "watch", "list"]
---
apiVersion: v1
kind:ServiceAccount
apiVersion:rbac.authorization.k8s.io/v1
kind:ClusterRoleBinding
metadata:
name: {{ .Release.Name }}-coder-logstream-kube-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ .Release.Name }}-coder-logstream-kube-role
subjects:
- kind: ServiceAccount
name: {{ .Values.serviceAccount.name | quote }}
annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }}
labels: {{ toYaml .Values.serviceAccount.labels | nindent 4 }}
namespace: {{ .Release.Namespace }}
{{- else }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ .Release.Name }}-coder-logstream-kube-role
rules:
- apiGroups: [""]
resources: ["pods", "events"]
verbs: ["get", "watch", "list"]
- apiGroups: ["apps"]
resources: ["replicasets", "events"]
verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
Expand All@@ -24,10 +59,18 @@ metadata:
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: coder-logstream-kube-role
name:{{ .Release.Name }}-coder-logstream-kube-role
subjects:
- kind: ServiceAccount
name: {{ .Values.serviceAccount.name | quote }}
{{- end }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ .Values.serviceAccount.name | quote }}
annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }}
labels: {{ toYaml .Values.serviceAccount.labels | nindent 4 }}
---
apiVersion: apps/v1
kind: Deployment
Expand DownExpand Up@@ -76,7 +119,7 @@ spec:
- name: CODER_URL
value: {{ .Values.url }}
- name: CODER_NAMESPACE
value: {{ .Values.namespace | default .Release.Namespace }}
value: {{$namespaces }}
{{- if .Values.image.sslCertFile }}
- name: SSL_CERT_FILE
value: {{ .Values.image.sslCertFile }}
Expand All@@ -95,3 +138,4 @@ spec:
{{- if .Values.volumes }}
volumes: {{- toYaml .Values.volumes | nindent 8 }}
{{- end }}

20 changes: 9 additions & 11 deletionshelm/values.yaml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
# url -- The URL of your Coder deployment. Must prefix with http or https
url: ""

#namespace --The namespacetosearching for Pods within.
#namespaces --Comma-separated list of namespacestowatch for Pods.
# If unspecified, this defaults to the Helm namespace.
namespace: ""
# If set to empty string (""), watches all namespaces (requires cluster-wide permissions).
namespaces: ""

# volumes -- A list of extra volumes to add to the coder-logstream pod.
volumes:
Expand DownExpand Up@@ -46,6 +46,12 @@ serviceAccount:
# coder.serviceAccount.name -- The service account name
name: coder-logstream-kube

# rbac -- RBAC configuration
rbac:
# rbac.clusterWide -- Whether to use cluster-wide permissions (ClusterRole/ClusterRoleBinding).
# This is automatically set to true when namespaces is empty or contains multiple namespaces.
clusterWide: false

# resources -- The resources to request for the Deployment. These are optional
# and are not set by default.
resources:
Expand DownExpand Up@@ -93,11 +99,3 @@ labels: {}
# securityContext -- Container-level security context
# See: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
securityContext: {}
# allowPrivilegeEscalation: false
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# seccompProfile:
# type: RuntimeDefault
Loading
Loading
[8]ページ先頭
©2009-2025 Movatter.jp