Skip to content

configuration.md

Latest commit

 

History

History
82 lines (66 loc) · 2.72 KB

configuration.md

File metadata and controls

82 lines (66 loc) · 2.72 KB
Raw

Operator configuration

The operator is intentionally usable with its defaults: leader election and all agent-sandbox extension controllers are enabled, and generated Pods use standard kubelet scheduling.

Runtime and API surface

  • --default-runtime (standard): default backend for newly created Sandbox Pods. Valid values are vk-cocoon and standard.
  • --extensions (true): enable SandboxTemplate, SandboxWarmPool, and SandboxClaim controllers and webhooks.
  • --cluster-domain (cluster.local): suffix used to construct Sandbox Service FQDNs.

An explicit Pod-template runtimeClassName always selects standard kubelet. An explicit sandbox.cocoonstack.io/runtime annotation takes precedence over the default.

Controller concurrency

The defaults are the configuration PERFORMANCE.md was measured with, so an out-of-box install reproduces the published numbers.

  • --sandbox-concurrent-workers (16)
  • --sandbox-claim-concurrent-workers (50)
  • --sandbox-warm-pool-concurrent-workers (8)
  • --sandbox-template-concurrent-workers (1)
  • --sandbox-warm-pool-max-batch-size (300)
  • --enable-warm-pool-eviction (true)
  • --kube-api-qps (200) — a negative value disables client-side rate limiting entirely, which also makes --kube-api-burst meaningless
  • --kube-api-burst (400)

Webhook and leader election

  • --leader-elect (true)
  • --leader-election-namespace (auto-detected when empty)
  • --webhook-port (9443)
  • --webhook-cert-dir (/tmp/k8s-webhook-server/serving-certs)
  • --webhook-service-name (sandbox-webhook-service)
  • --webhook-namespace (sandbox-system)
  • --manage-webhook-certs (true)

When --manage-webhook-certs=true, the operator creates serving certificates and patches conversion-webhook CA bundles. Disable it only when the cluster manages both externally.

Observability

  • --metrics-bind-address (:8080)
  • --health-probe-bind-address (:8081)
  • --enable-tracing (false)
  • --enable-pprof (false)
  • --enable-pprof-debug (false)

Use --enable-pprof-debug only in controlled environments because it exposes process details and enables block/mutex sampling.

Example patch

apiVersion: apps/v1
kind: Deployment
metadata:
  name: sandbox-operator
  namespace: sandbox-system
spec:
  template:
    spec:
      containers:
        - name: sandbox-operator
          args:
            - --leader-elect=true
            - --extensions=true
            - --default-runtime=standard
            - --sandbox-concurrent-workers=32
            - --sandbox-claim-concurrent-workers=40

Helm exposes the common flags under controller.*; use controller.extraArgs for other flags.