Chapter 15. Injecting Information into Pods Using Pod Presets

A pod preset is an object that injects user-specified information into pods as they are created.

Using pod preset objects you can inject:

Developers only need make sure the pod labels match the label selector on the PodPreset in order to add all that information to the pod. The label on a pod associates the pod with one or more pod preset objects that have a matching label selectors.

Using pod presets, a developer can provision pods without needing to know the details about the services the pod will consume. An administrator can keep configuration items of a service invisible from a developer without preventing the developer from deploying pods. For example, an administrator can create a pod preset that provides the name, user name, and password for a database through a secret and the database port through environment variables. The pod developer only needs to know the label to use to include all the information in pods. A developer can also create pod presets and perform all the same tasks. For example, the developer can create a preset that injects environment variable automatically into multiple pods.

When a pod preset is applied to a pod, OpenShift Container Platform modifies the pod specification, adding the injectable data and annotating the pod spec to show that it was modified by a pod preset. The annotation is of the form:

podpreset.admission.kubernetes.io/<pod-preset name>: `resource version`

In order to use pod presets in your cluster:

If the pod creation encounters an error, the pod is created without any injected resources from the pod preset.

kind: PodPreset
apiVersion: settings.k8s.io/v1alpha1 1
metadata:
  name: allow-database 2
spec:
  selector:
    matchLabels:
      role: frontend 3
  env:
    - name: DB_PORT 4
      value: "6379" 5
  envFrom:
    - configMapRef: 6
      name: etcd-env-config
    - secretKeyRef: 7
      name: test-secret
  volumeMounts: 8
    - mountPath: /cache
      name: cache-volume
  volumes: 9
    - name: cache-volume
      emptyDir: {}

apiVersion: v1
kind: Pod
metadata:
  name: website
  labels:
    app: website
    role: frontend 1
spec:
  containers:
    - name: website
      image: ecorp/website
      ports:
        - containerPort: 80

apiVersion: v1
kind: Pod
metadata:
  name: website
  labels:
    app: website
    role: frontend
  annotations:
    podpreset.admission.kubernetes.io/allow-database: "resource version" 1
spec:
  containers:
    - name: website
      image: ecorp/website
      volumeMounts: 2
        - mountPath: /cache
          name: cache-volume
      ports:
        - containerPort: 80
      env: 3
        - name: DB_PORT
          value: "6379"
      envFrom: 4
        - configMapRef:
          name: etcd-env-config
        - secretKeyRef:
          name: test-secret
  volumes: 5
    - name: cache-volume
      emptyDir: {}

The following example demonstrates how to create and use pod presets.

admissionConfig:
  pluginConfig:
    PodPreset:
      configuration:
        kind: DefaultAdmissionConfig
        apiVersion: v1
        disable: false

Then, restart the OpenShift Container Platform services:

# systemctl restart atomic-openshift-master-api atomic-openshift-master-controllers

kind: PodPreset
apiVersion: settings.k8s.io/v1alpha1
metadata:
  name: allow-database
spec:
  selector:
    matchLabels:
      role: frontend
  env:
    - name: DB_PORT
      value: "6379"
  volumeMounts:
    - mountPath: /cache
      name: cache-volume
  volumes:
    - name: cache-volume
      emptyDir: {}

You can use multiple pod presets to inject multiple pod injection policies.

You can delete a pod preset using the following command:

$ oc delete podpreset <name>

For example:

$ oc delete podpreset allow-database

podpreset "allow-database" deleted