Skip to content

chart, salt: Add annotations to fluent-bit pod #4834

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bert-e merged 2 commits into from
Mar 26, 2026
+41 −9
Merged

chart, salt: Add annotations to fluent-bit pod #4834

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a3534e7
chart, salt: Add annotations to fluent-bit pod
eg-ayoub Mar 23, 2026
fa59b39
allow empty object digest generation for annotations
eg-ayoub Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,9 @@
- Implement ability to add certificates to fluent-bit by mounting a fluent-bit-certs secret
(PR[#4812](https://github.com/scality/metalk8s/pull/4812))

- Ensure fluent-bit pods are restarted when its configmap or secret is modified
(PR[#4834](https://github.com/scality/metalk8s/pull/4834))

### Bug Fixes

- Fix a bug where part of the upgrade process would silently be skipped
Expand Down
5 changes: 2 additions & 3 deletions charts/fluent-bit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,8 @@ image:
existingConfigMap: fluent-bit

podAnnotations:
prometheus.io/scrape: "true"
prometheus.io/port: "2020"
prometheus.io/path: /api/v1/metrics/prometheus
checksum/config: '__slot__:salt:metalk8s_kubernetes.get_object_digest(kind="ConfigMap", apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit", path="data:fluent-bit.conf")'
checksum/secret: '__slot__:salt:metalk8s_kubernetes.get_object_digest(kind="Secret", apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit-certs", path="data", ignore_not_found=True)'

resources: '__var__(fluent_bit.spec.deployment.resources)'

Expand Down
10 changes: 8 additions & 2 deletions salt/_modules/metalk8s_kubernetes.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -410,7 +410,9 @@ def list_objects(
return result.to_dict()["items"]


def get_object_digest(path=None, checksum="sha256", *args, **kwargs):
def get_object_digest(
path=None, checksum="sha256", ignore_not_found=False, *args, **kwargs
Copy link
Copy Markdown

@claude claude bot Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

`ignore_not_found` only guards against the path not being found within an existing object. If the Secret itself does not exist (`get_object` returns `None`), line 431 still raises `CommandExecutionError("Unable to find the object")` regardless of `ignore_not_found`.

This works today because Salt include ordering in `init.sls` ensures `.secret` runs before `.chart`. But the parameter name is misleading — consider either:
1. Also applying `ignore_not_found` to the object-level check (line 430-431), or
2. Renaming the parameter to something like `ignore_empty_path` to clarify its scope.

— Claude Code

):
"""
Helper to get the digest of one kubernetes object or from a specific key
of this object using a path
Expand All @@ -432,7 +434,11 @@ def get_object_digest(path=None, checksum="sha256", *args, **kwargs):
obj = salt.utils.data.traverse_dict_and_list(obj, path, delimiter=":")

if not obj:
raise CommandExecutionError(f'Unable to find key "{path}" in the object')
if not ignore_not_found:
raise CommandExecutionError(
f'Unable to find key "{path}" in the object'
)
return ""

if isinstance(obj, dict):
obj = json.dumps(obj, sort_keys=True)
Expand Down
9 changes: 5 additions & 4 deletions salt/metalk8s/addons/logging/fluent-bit/deployed/chart.sls
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1694,10 +1694,11 @@ spec:
template:
metadata:
annotations:
checksum/config: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
prometheus.io/path: /api/v1/metrics/prometheus
prometheus.io/port: '2020'
prometheus.io/scrape: 'true'
checksum/config: __slot__:salt:metalk8s_kubernetes.get_object_digest(kind="ConfigMap",
apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit", path="data:fluent-bit.conf")
checksum/secret: __slot__:salt:metalk8s_kubernetes.get_object_digest(kind="Secret",
apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit-certs",
path="data", ignore_not_found=True)
labels:
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/name: fluent-bit
Expand Down
1 change: 1 addition & 0 deletions salt/metalk8s/addons/logging/fluent-bit/deployed/secret.sls
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ Create metalk8s-fluent-bit-certs Secret:
metadata:
name: fluent-bit-certs
namespace: metalk8s-logging
data: {}

{%- else %}

Expand Down
22 changes: 22 additions & 0 deletions salt/tests/unit/modules/files/test_metalk8s_kubernetes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -702,6 +702,28 @@ get_object_digest:
raises: True
result: 'Unable to find key "metadata:invalid:path" in the object'

# ignore_not_found = true and path points to an empty dict
- obj:
apiVersion: v1
kind: Secret
metadata:
name: my_secret
data: {}
path: 'data'
ignore_not_found: True
result: ''

# ignore_not_found = true but there is a typo in the path
- obj:
apiVersion: v1
kind: Secret
metadata:
name: my_secret
data: {}
path: 'daat'
ignore_not_found: True
result: ''
Copy link
Copy Markdown

@claude claude bot Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tests cover `ignore_not_found=True` when the path is empty or wrong, but there is no test for `ignore_not_found=True` when the object itself is `None` (`obj: null`). Adding one would document the current behavior (raises error) and protect against unintended changes.

— Claude Code


check_object_ready:
# Simple Pod Ready
- obj:
Expand Down
Loading