Add an env var that allows excluding containers by name (#466)

Useful for containers that have memory spike that is too fast to be
captured by krr (prometheus)

Author: arikalon1

enforcer/README.md

@@ -97,6 +97,20 @@ helm install krr-enforcer robusta/krr-enforcer -f enforcer-values.yaml
 | `resources.requests.cpu` | CPU request for the enforcer pod                                    | `100m` |
 | `resources.requests.memory` | Memory request for the enforcer pod                                                     | `256Mi` |
 
+### Additional settings
+
+On some scenarios, you might want to exclude a specific container from `enforcement`, across all Deployments/Pods.
+For example, if you have some init container, that you'd like to be excluded. 
+
+You can do that by adding an environment variable named `EXCLUDED_CONTAINERS`, with a list of comma separated container names that should be excluded.
+For example:
+
+```yaml
+additionalEnvVars:
+  ...
+  - name: EXCLUDED_CONTAINERS
+    value: my-spiky-container, java-init-container
+```
 
 ## Running Locally
 

enforcer/env_vars.py

@@ -21,4 +21,7 @@
 SCAN_AGE_HOURS_THRESHOLD = int(os.environ.get("SCAN_AGE_HOURS_THRESHOLD", 360)) # 15 days
 
 ENFORCER_SSL_KEY_FILE = os.environ.get("ENFORCER_SSL_KEY_FILE", "")
-ENFORCER_SSL_CERT_FILE = os.environ.get("ENFORCER_SSL_CERT_FILE", "")
+ENFORCER_SSL_CERT_FILE = os.environ.get("ENFORCER_SSL_CERT_FILE", "")
+
+EXCLUDED_CONTAINERS = [container_name.strip() for container_name
+                       in os.environ.get("EXCLUDED_CONTAINERS", "").split(",") if container_name.strip()]

enforcer/patch_manager.py

@@ -2,7 +2,8 @@
 import logging
 from typing import Dict, Any, List, Optional
 from enforcer.model import ContainerRecommendation
-from enforcer.env_vars import UPDATE_THRESHOLD
+from enforcer.env_vars import UPDATE_THRESHOLD, EXCLUDED_CONTAINERS
+
 logger = logging.getLogger()
 
 REQ = "requests"
@@ -241,6 +242,11 @@ def patch_container_resources(
     if not recommendation:
         return patches
 
+    container_name = container.get("name")
+    if container_name and container_name in EXCLUDED_CONTAINERS:
+        logging.info(f"Skipping excluded container {container_name}")
+        return patches
+
     had_resources = "resources" in container
     resources = copy.deepcopy(container.get('resources', {}))
     updated_resources = get_updated_resources(container.get('resources', {}), recommendation)