Run Once Duration Override

The Run Once Duration Override mutating admission webhook allows to override activeDeadlineSeconds field for a pod with RestartPolicy set to Never or OnFailure. The so called run-once pods. In case a pod already has activeDeadlineSeconds set, the minimum of currently set and configured by the operand is used.

Deploy the Operator

Quick Development

1. Build and push the operand image to a registry:

   export QUAY_USER=${your_quay_user_id}
   export IMAGE_TAG=${your_image_tag}
   podman build -t quay.io/${QUAY_USER}/run-once-duration-override:${IMAGE_TAG} .
   podman login quay.io -u ${QUAY_USER}
   podman push quay.io/${QUAY_USER}/run-once-duration-override:${IMAGE_TAG}

2. Generate manifests deploying the admission webhook:

   make manifests

3. Update the image spec under .spec.template.spec.containers[0].image field in the _output/manifests/500_deployment.yaml Deployment to point to the newly built image.

4. Deploy the admission webhook:

   oc apply -f _output/manifests

5. Check all DaemonSet pods are running:

   oc get pods -n run-once-duration-override

Example

1. Create or choose a namespace. E.g. test

   $ oc create ns test
   

2. Label the namespace with runoncedurationoverrides.admission.runoncedurationoverride.openshift.io/enabled: "true"

   $ oc label ns test runoncedurationoverrides.admission.runoncedurationoverride.openshift.io/enabled=true
   

3. Create a testing pod in the namespace with RestartPolicy set to Never. E.g.

   $ cat pod.yaml
   apiVersion: v1
   kind: Pod
   metadata:
     name: example
     namespace: test
   spec:
     restartPolicy: Never
     containers:
       - name: busybox
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: ["ALL"]
           runAsNonRoot:
             true
           seccompProfile:
             type: "RuntimeDefault"
         image: busybox:1.25
         command:
           - /bin/sh
           - -ec
           - |
             while sleep 5; do date; done
   

   The manifest is also located under examples/pod.yaml.

   $ oc apply -f pod.yaml

4. Checking the .spec.activeDeadlineSeconds field was set to 3600:

   $ oc get pods -n test -o json | jq '.items[0].spec.activeDeadlineSeconds'
   3600