Chapter 2. Working with pods

Prerequisite

• You must have a directory with files that contain the data you want to populate a config map with.

  The following procedure uses these example files: game.properties and ui.properties:

  $ cat example-files/game.properties

  Example output

  enemies=aliens
  lives=3
  enemies.cheat=true
  enemies.cheat.level=noGoodRotten
  secret.code.passphrase=UUDDLRLRBABAS
  secret.code.allowed=true
  secret.code.lives=30

  $ cat example-files/ui.properties

  Example output

  color.good=purple
  color.bad=yellow
  allow.textmode=true
  how.nice.to.look=fairlyNice

Procedure

• Create a config map holding the content of each file in this directory by entering the following command:

  $ oc create configmap game-config \
      --from-file=example-files/

Verification

• Enter the oc get command for the object with the -o option to see the values of the keys:

  $ oc get configmaps game-config -o yaml

  Example output

  apiVersion: v1
  data:
    game.properties: |-
      enemies=aliens
      lives=3
      enemies.cheat=true
      enemies.cheat.level=noGoodRotten
      secret.code.passphrase=UUDDLRLRBABAS
      secret.code.allowed=true
      secret.code.lives=30
    ui.properties: |
      color.good=purple
      color.bad=yellow
      allow.textmode=true
      how.nice.to.look=fairlyNice
  kind: ConfigMap
  metadata:
    creationTimestamp: 2016-02-18T18:34:05Z
    name: game-config
    namespace: default
    resourceVersion: "407"
    selflink: /api/v1/namespaces/default/configmaps/game-config
    uid: 30944725-d66e-11e5-8cd0-68f728db1985

Prerequisite

• You must have a directory with files that contain the data you want to populate a config map with.

  The following procedure uses these example files: game.properties and ui.properties:

  $ cat example-files/game.properties

  Example output

  enemies=aliens
  lives=3
  enemies.cheat=true
  enemies.cheat.level=noGoodRotten
  secret.code.passphrase=UUDDLRLRBABAS
  secret.code.allowed=true
  secret.code.lives=30

  $ cat example-files/ui.properties

  Example output

  color.good=purple
  color.bad=yellow
  allow.textmode=true
  how.nice.to.look=fairlyNice

Procedure

• Create a config map by specifying a specific file:

  $ oc create configmap game-config-2 \
      --from-file=example-files/game.properties \
      --from-file=example-files/ui.properties

• Create a config map by specifying a key-value pair:

  $ oc create configmap game-config-3 \
      --from-file=game-special-key=example-files/game.properties

Verification

• Enter the oc get command for the object with the -o option to see the values of the keys from the file:

  $ oc get configmaps game-config-2 -o yaml

  Example output

  apiVersion: v1
  data:
    game.properties: |-
      enemies=aliens
      lives=3
      enemies.cheat=true
      enemies.cheat.level=noGoodRotten
      secret.code.passphrase=UUDDLRLRBABAS
      secret.code.allowed=true
      secret.code.lives=30
    ui.properties: |
      color.good=purple
      color.bad=yellow
      allow.textmode=true
      how.nice.to.look=fairlyNice
  kind: ConfigMap
  metadata:
    creationTimestamp: 2016-02-18T18:52:05Z
    name: game-config-2
    namespace: default
    resourceVersion: "516"
    selflink: /api/v1/namespaces/default/configmaps/game-config-2
    uid: b4952dc3-d670-11e5-8cd0-68f728db1985

• Enter the oc get command for the object with the -o option to see the values of the keys from the key-value pair:

  $ oc get configmaps game-config-3 -o yaml

  Example output

  apiVersion: v1
  data:
    game-special-key: |- 1
      enemies=aliens
      lives=3
      enemies.cheat=true
      enemies.cheat.level=noGoodRotten
      secret.code.passphrase=UUDDLRLRBABAS
      secret.code.allowed=true
      secret.code.lives=30
  kind: ConfigMap
  metadata:
    creationTimestamp: 2016-02-18T18:54:22Z
    name: game-config-3
    namespace: default
    resourceVersion: "530"
    selflink: /api/v1/namespaces/default/configmaps/game-config-3
    uid: 05f8da22-d671-11e5-8cd0-68f728db1985

  1

  This is the key that you set in the preceding step.

Procedure

• Create a config map by specifying a literal value:

  $ oc create configmap special-config \
      --from-literal=special.how=very \
      --from-literal=special.type=charm

Verification

• Enter the oc get command for the object with the -o option to see the values of the keys:

  $ oc get configmaps special-config -o yaml

  Example output

  apiVersion: v1
  data:
    special.how: very
    special.type: charm
  kind: ConfigMap
  metadata:
    creationTimestamp: 2016-02-18T19:14:38Z
    name: special-config
    namespace: default
    resourceVersion: "651"
    selflink: /api/v1/namespaces/default/configmaps/special-config
    uid: dadce046-d673-11e5-8cd0-68f728db1985

Procedure

• You can consume the keys of this ConfigMap in a pod using configMapKeyRef sections.

  Sample Pod specification configured to inject specific environment variables

  apiVersion: v1
  kind: Pod
  metadata:
    name: dapi-test-pod
  spec:
    securityContext:
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
    containers:
      - name: test-container
        image: gcr.io/google_containers/busybox
        command: [ "/bin/sh", "-c", "env" ]
        env: 1
          - name: SPECIAL_LEVEL_KEY 2
            valueFrom:
              configMapKeyRef:
                name: special-config 3
                key: special.how 4
          - name: SPECIAL_TYPE_KEY
            valueFrom:
              configMapKeyRef:
                name: special-config 5
                key: special.type 6
                optional: true 7
        envFrom: 8
          - configMapRef:
              name: env-config 9
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
    restartPolicy: Never

  1

  Stanza to pull the specified environment variables from a ConfigMap.

  2

  Name of a pod environment variable that you are injecting a key’s value into.

  3 5

  Name of the ConfigMap to pull specific environment variables from.

  4 6

  Environment variable to pull from the ConfigMap.

  7

  Makes the environment variable optional. As optional, the pod will be started even if the specified ConfigMap and keys do not exist.

  8

  Stanza to pull all environment variables from a ConfigMap.

  9

  Name of the ConfigMap to pull all environment variables from.

  When this pod is run, the pod logs will include the following output:

  SPECIAL_LEVEL_KEY=very
  log_level=INFO

Procedure

• To inject values into a command in a container, you must consume the keys you want to use as environment variables. Then you can refer to them in a container’s command using the $(VAR_NAME) syntax.

  Sample pod specification configured to inject specific environment variables

  apiVersion: v1
  kind: Pod
  metadata:
    name: dapi-test-pod
  spec:
    securityContext:
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
    containers:
      - name: test-container
        image: gcr.io/google_containers/busybox
        command: [ "/bin/sh", "-c", "echo $(SPECIAL_LEVEL_KEY) $(SPECIAL_TYPE_KEY)" ] 1
        env:
          - name: SPECIAL_LEVEL_KEY
            valueFrom:
              configMapKeyRef:
                name: special-config
                key: special.how
          - name: SPECIAL_TYPE_KEY
            valueFrom:
              configMapKeyRef:
                name: special-config
                key: special.type
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
    restartPolicy: Never

  1

  Inject the values into a command in a container using the keys you want to use as environment variables.

  When this pod is run, the output from the echo command run in the test-container container is as follows:

  very charm

• The most basic way to inject content into a volume by using a config map is to populate the volume with files where the key is the file name and the content of the file is the value of the key:

  apiVersion: v1
  kind: Pod
  metadata:
    name: dapi-test-pod
  spec:
    securityContext:
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
    containers:
      - name: test-container
        image: gcr.io/google_containers/busybox
        command: [ "/bin/sh", "-c", "cat", "/etc/config/special.how" ]
        volumeMounts:
        - name: config-volume
          mountPath: /etc/config
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
    volumes:
      - name: config-volume
        configMap:
          name: special-config 1
    restartPolicy: Never

  1

  File containing key.

  When this pod is run, the output of the cat command will be:

  very

• You can also control the paths within the volume where config map keys are projected:

  apiVersion: v1
  kind: Pod
  metadata:
    name: dapi-test-pod
  spec:
    securityContext:
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
    containers:
      - name: test-container
        image: gcr.io/google_containers/busybox
        command: [ "/bin/sh", "-c", "cat", "/etc/config/path/to/special-key" ]
        volumeMounts:
        - name: config-volume
          mountPath: /etc/config
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
    volumes:
      - name: config-volume
        configMap:
          name: special-config
          items:
          - key: special.how
            path: path/to/special-key 1
    restartPolicy: Never

  1

  Path to config map key.

  When this pod is run, the output of the cat command will be:

  very

• system-node-critical - This priority class has a value of 2000001000 and is used for all pods that should never be evicted from a node. Examples of pods that have this priority class are ovnkube-node, and so forth. A number of critical components include the system-node-critical priority class by default, for example:

  • master-api
  • master-controller
  • master-etcd
  • ovn-kubernetes
  • sync

• system-cluster-critical - This priority class has a value of 2000000000 (two billion) and is used with pods that are important for the cluster. Pods with this priority class can be evicted from a node in certain circumstances. For example, pods configured with the system-node-critical priority class can take priority. However, this priority class does ensure guaranteed scheduling. Examples of pods that can have this priority class are fluentd, add-on components like descheduler, and so forth. A number of critical components include the system-cluster-critical priority class by default, for example:

  • fluentd
  • metrics-server
  • descheduler
• openshift-user-critical - You can use the priorityClassName field with important pods that cannot bind their resource consumption and do not have predictable resource consumption behavior. Prometheus pods under the openshift-monitoring and openshift-user-workload-monitoring namespaces use the openshift-user-critical priorityClassName. Monitoring workloads use system-critical as their first priorityClass, but this causes problems when monitoring uses excessive memory and the nodes cannot evict them. As a result, monitoring drops priority to give the scheduler flexibility, moving heavy workloads around to keep critical nodes operating.
• cluster-logging - This priority is used by Fluentd to make sure Fluentd pods are scheduled to nodes over other apps.