optional pod selector labels

This allows enabling core-dump-handler only on pods that match a configured selector pod-label. Useful if we need core-dump-handler only for a subset of our workload. The composer checks for the pod label and only prepares the upload only if the pod matches the selector configured. The default (empty selector label) is to have no selectors and enable collection for all. Only the existence of the label is checked for.

The selector can be configured via `daemonSet.podSelectorLabel` in `values.yaml`, which translates to the `POD_SELECTOR_LABEL` environment variable in the daemonset.

charts/core-dump-handler/README.md

@@ -209,6 +209,7 @@ The agent pod has the following environment variables and these are all set by t
 * INTERVAL - The amount of time in milliseconds between each check of the core dump folder for files to upload.
 * SCHEDULE - A CRON formatted string [See cron library](https://github.com/mvniekerk/tokio-cron-scheduler#usage).
 * USE_INOTIFY - Set a listener for the coredump folder can be used in conjunction with SCHEDULE
+* POD_SELECTOR_LABEL - Optional selector label to filter pods that have core dump collection enabled. Default (empty) disables filter.
 
 ### Secrets
 

charts/core-dump-handler/ci/inotify-manage-store.yaml

@@ -32,6 +32,7 @@ daemonset:
   label: "core-dump-ds"
   hostDirectory: "/var/mnt/core-dump-handler"
   coreDirectory: "/var/mnt/core-dump-handler/cores"
+  podSelectorLabel: ""
   suidDumpable: 2
   vendor: default
   # interval: 60000

charts/core-dump-handler/ci/interval-manage-store.yaml

@@ -32,6 +32,7 @@ daemonset:
   label: "core-dump-ds"
   hostDirectory: "/var/mnt/core-dump-handler"
   coreDirectory: "/var/mnt/core-dump-handler/cores"
+  podSelectorLabel: ""
   suidDumpable: 2
   vendor: default
   interval: 60000

charts/core-dump-handler/ci/schedule-no-manage-store.yaml

@@ -32,6 +32,7 @@ daemonset:
   label: "core-dump-ds"
   hostDirectory: "/var/mnt/core-dump-handler"
   coreDirectory: "/var/mnt/core-dump-handler/cores"
+  podSelectorLabel: ""
   suidDumpable: 2
   vendor: default
   schedule: "1/60 * * * * *"

charts/core-dump-handler/ci/tolerations.yaml

@@ -33,6 +33,7 @@ daemonset:
   label: "core-dump-ds"
   hostDirectory: "/var/mnt/core-dump-handler"
   coreDirectory: "/var/mnt/core-dump-handler/cores"
+  podSelectorLabel: ""
   suidDumpable: 2
   vendor: default
   # interval: 60000

charts/core-dump-handler/templates/daemonset.yaml

@@ -43,6 +43,8 @@ spec:
             value:  {{ .Values.composer.crioImageCmd }}
           - name: DEPLOY_CRIO_CONFIG
             value:  {{ .Values.daemonset.deployCrioConfig | quote }}
+          - name: POD_SELECTOR_LABEL
+            value:  {{ .Values.daemonset.podSelectorLabel }}
           - name: HOST_DIR
             value: {{ .Values.daemonset.hostDirectory }}
           - name: CORE_DIR

charts/core-dump-handler/values.schema.json

@@ -202,6 +202,9 @@
                 "deployCrioConfig": {
                     "type": "boolean"
                 },
+                "podSelectorLabel": {
+                    "type": "string"
+                },
                 "includeCrioExe": {
                     "type": "boolean"
                 },

charts/core-dump-handler/values.yaml

@@ -32,6 +32,7 @@ daemonset:
   label: "core-dump-ds"
   hostDirectory: "/var/mnt/core-dump-handler"
   coreDirectory: "/var/mnt/core-dump-handler/cores"
+  podSelectorLabel: ""
   suidDumpable: 2
   vendor: default
   # interval: 60000

core-dump-agent/src/main.rs

@@ -470,11 +470,12 @@ fn create_env_file(host_location: &str) -> Result<(), std::io::Error> {
         "{uuid}-dump-{timestamp}-{hostname}-{exe_name}-{pid}-{signal}".to_string()
     });
     let log_length = env::var("LOG_LENGTH").unwrap_or_else(|_| "500".to_string());
+    let pod_selector_label = env::var("POD_SELECTOR_LABEL").unwrap_or_default();
     info!("Creating {} file with LOG_LEVEL={}", destination, loglevel);
     let mut env_file = File::create(destination)?;
     let text = format!(
-        "LOG_LEVEL={}\nIGNORE_CRIO={}\nCRIO_IMAGE_CMD={}\nUSE_CRIO_CONF={}\nFILENAME_TEMPLATE={}\nLOG_LENGTH={}\n",
-        loglevel, ignore_crio, crio_image, use_crio_config, filename_template, log_length
+        "LOG_LEVEL={}\nIGNORE_CRIO={}\nCRIO_IMAGE_CMD={}\nUSE_CRIO_CONF={}\nFILENAME_TEMPLATE={}\nLOG_LENGTH={}\nPOD_SELECTOR_LABEL={}\n",
+        loglevel, ignore_crio, crio_image, use_crio_config, filename_template, log_length, pod_selector_label
     );
     info!("Writing composer .env \n{}", text);
     env_file.write_all(text.as_bytes())?;

core-dump-composer/src/config.rs

@@ -18,6 +18,7 @@ pub struct CoreConfig {
     pub crictl_config_path: PathBuf,
     pub log_level: String,
     pub log_length: u32,
+    pub pod_selector_label: String,
     pub use_crio_config: bool,
     pub ignore_crio: bool,
     pub image_command: ImageCommand,
@@ -85,6 +86,7 @@ impl CoreConfig {
         let mut base_path = env::current_exe()?;
         base_path.pop();
 
+        let pod_selector_label = env::var("POD_SELECTOR_LABEL").unwrap_or_default();
         let log_level = env::var("LOG_LEVEL").unwrap_or_default();
         let ignore_crio = env::var("IGNORE_CRIO")
             .unwrap_or_else(|_| "false".to_string())
@@ -122,6 +124,7 @@ impl CoreConfig {
 
         Ok(CoreConfig {
             log_level,
+            pod_selector_label,
             ignore_crio,
             dot_env_path,
             image_command,

core-dump-composer/src/main.rs

@@ -58,6 +58,19 @@ fn main() -> Result<(), anyhow::Error> {
         }
     };
 
+    // match the label filter if there's one, and skip the whole process if it doesn't match
+    if !cc.pod_selector_label.is_empty() {
+        debug!("Pod selector specified. Will record only if pod has label {}", &cc.pod_selector_label);
+        let pod_labels = pod_object["metadata"]["labels"].as_object().unwrap();
+        // check if pod_labels has pod_selector_label
+        if pod_labels.get(&cc.pod_selector_label).is_none() {
+            info!("Skipping pod as it did not match selector label {}", &cc.pod_selector_label);
+            process::exit(0);
+        }
+    } else {
+        debug!("No pod selector specified, selecting all pods");
+    }
+
     let namespace = pod_object["metadata"]["namespace"]
         .as_str()
         .unwrap_or("unknown");