mirror of https://github.com/lukaszraczylo/kubemirror.git synced 2026-10-12 04:35:01 +00:00

Files

T

lukaszraczylo 8988893160 perf(controller): repair mirror drift from watch events instead of resync

Mirror update events were filtered out, so an in-place edit of a
mirrored copy was invisible to the controller. The periodic resync did
not catch it either: NeedsSync only compares the source content hash
with the recorded annotation, and tampered mirror data leaves both
unchanged.

Changes:
- The mirror watch now passes real update events (resourceVersion
  changed, object is a managed mirror) and maps them to the source.
  Informer resync replays keep an unchanged resourceVersion and stay
  filtered.
- reconcileMirror detects in-place drift by rebuilding the expected
  mirror in memory and comparing content hashes. Metadata differences
  never count as drift, so the controller's own writes converge in one
  no-op pass.
- The resync-period default moves from 10m to 1h. Watches now cover
  source changes, mirror deletion, mirror drift, and namespace changes,
  so the resync is only a safety net for missed watch events. The chart
  default moves with it.
- Add predicate and tamper-repair regression tests; drift repair is
  verified to make no direct apiserver reads.

2026-08-29 13:44:57 +01:00

4.0 KiB

Raw Blame History

kubemirror Helm chart

Deploys the kubemirror controller, which mirrors Kubernetes resources (Secrets, ConfigMaps, and other types) across namespaces.

Chart version: 0.1.0
App version: 0.1.0
Image: ghcr.io/lukaszraczylo/kubemirror

Install

helm install kubemirror ./charts/kubemirror -n kubemirror --create-namespace

With a values override:

helm install kubemirror ./charts/kubemirror -n kubemirror --create-namespace \
  -f my-values.yaml

Uninstall

helm uninstall kubemirror -n kubemirror

What it creates

A single-replica Deployment, a ServiceAccount, a cluster-scoped ClusterRole

ClusterRoleBinding (the controller watches resources across all namespaces), and a Service exposing the metrics (8080) and health (8081) ports. The container runs as non-root (uid 65532) with a read-only root filesystem and all Linux capabilities dropped.

Values

Defaults are taken from values.yaml.

Key	Default	Description
`replicaCount`	`1`	Number of controller replicas.
`image.repository`	`ghcr.io/lukaszraczylo/kubemirror`	Controller image.
`image.tag`	`"0.1.0"`	Image tag (falls back to chart `appVersion` if empty).
`image.pullPolicy`	`IfNotPresent`	Image pull policy.
`serviceAccount.create`	`true`	Create a ServiceAccount.
`serviceAccount.name`	`""`	Override the generated ServiceAccount name.
`controller.metricsBindAddress`	`":8080"`	`--metrics-bind-address`.
`controller.healthProbeBindAddress`	`":8081"`	`--health-probe-bind-address`.
`controller.leaderElect`	`true`	Enable leader election (`--leader-elect`).
`controller.leaderElectionID`	`"kubemirror-controller-leader"`	Lease name (`--leader-election-id`).
`controller.resourceTypes`	`[]`	Resource types to mirror (`--resource-types`). Empty enables auto-discovery.
`controller.discoveryInterval`	`"5m"`	Auto-discovery interval (`--discovery-interval`).
`controller.resyncPeriod`	`"1h"`	Cache resync period, safety net only (`--resync-period`).
`controller.maxTargets`	`100`	Max target namespaces per resource (`--max-targets`).
`controller.workerThreads`	`5`	Concurrent reconcile workers (`--worker-threads`).
`controller.rateLimitQPS`	`50.0`	API QPS limit (`--rate-limit-qps`).
`controller.rateLimitBurst`	`100`	API burst limit (`--rate-limit-burst`).
`controller.verifySourceFreshness`	`false`	Verify cache against a direct API read (`--verify-source-freshness`).
`controller.lazyWatcherInit`	`false`	Only watch resource types actually in use (`--lazy-watcher-init`). Lowers memory; recommended for production.
`controller.watcherScanInterval`	`"5m"`	Scan interval for new types in lazy mode (`--watcher-scan-interval`).
`controller.excludedNamespaces`	`""`	Comma-separated namespaces never mirrored to (`--excluded-namespaces`).
`controller.includedNamespaces`	`""`	Comma-separated namespace patterns to include (`--included-namespaces`).
`service.type`	`ClusterIP`	Service type.
`service.metricsPort`	`8080`	Metrics port.
`service.healthPort`	`8081`	Health-probe port.
`resources.requests`	`100m` CPU / `128Mi`	Container requests.
`resources.limits`	`500m` CPU / `512Mi`	Container limits.
`nodeSelector` / `tolerations` / `affinity`	`{}` / `[]` / `{}`	Standard scheduling controls.
`priorityClassName`	`""`	Pod priority class.

Memory tip: setting controller.resourceTypes to the exact types you mirror (e.g. ["Secret.v1", "ConfigMap.v1"]), or enabling controller.lazyWatcherInit, avoids creating watchers for unused resource types and cuts memory use substantially versus full auto-discovery.

Usage

After install, mark a source resource for mirroring and opt a target namespace in. See the project README and examples for the full annotation/label reference and worked scenarios.

4.0 KiB Raw Blame History