diff --git a/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/index.md b/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/index.md index fda7be0401..977a65c147 100644 --- a/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/index.md +++ b/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/index.md @@ -67,8 +67,11 @@ As you can see in the above event messages, the affected Pod is not evicted imme For our production clusters, we specify a lower time limit so as to avoid the impacted Pods serving traffic abidingly. The *kube-exec-controller* internally sets and tracks a timer for each Pod that matches the associated TTL. Once the timer is up, the controller evicts that Pod using K8s API. The eviction (rather than deletion) is to ensure service availability, since the cluster respects any configured [PodDisruptionBudget](/docs/concepts/workloads/pods/disruptions/) (PDB). Let's say if a user has defined *x* number of Pods as critical in their PDB, the eviction (as requested by *kube-exec-controller*) does not continue when the target workload has fewer than *x* Pods running. -Here comes a sequence diagram of the entire workflow mentioned above:  -{{< figure src="workflow-diagram.svg" alt="Workflow Diagram" class="diagram-medium" >}} +Here comes a sequence diagram of the entire workflow mentioned above: + + + +![Sequence Diagram](/images/sequence_diagram.svg) ## A new kubectl plugin for better user experience Our admission controller component works great for solving the container drift issue we had on the platform. It is also able to submit all related Events to the target Pod that has been affected. However, K8s clusters don't retain Events very long (the default retention period is one hour). We need to provide other ways for developers to get their Pod interaction activity. A [kubectl plugin](/docs/tasks/extend-kubectl/kubectl-plugins/) is a perfect choice for us to expose this information. We named our plugin `kubectl pi` (short for `pod-interaction`) and provide two subcommands: `get` and `extend`. diff --git a/static/images/sequence_diagram.svg b/static/images/sequence_diagram.svg new file mode 100644 index 0000000000..dd1739b21e --- /dev/null +++ b/static/images/sequence_diagram.svg @@ -0,0 +1 @@ +Developer (service-owner)K8S api-serverAdmission Controller ServiceRun "kubectl exec ..." commandAdmit "exec" request by calling the validating webhookAllow the exec admission requestExecute the exec commandEvict tagged pods after a predefined intervalloopEvictPod()Execute the eviction commandDeveloper (service-owner)K8S api-serverAdmission Controller Service \ No newline at end of file