All Products
Search

This Product

    Container Compute Service:Inject sidecar containers into pods on virtual nodes

    Document Center

    Container Compute Service:Inject sidecar containers into pods on virtual nodes

    Last Updated:Jun 02, 2026

    Use ACK Virtual Node to automatically inject sidecar containers into pods on virtual nodes for observability and security. Combine with OpenKruise SidecarSet to customize injection rules and update sidecars independently.

    How it works

    ACK deploys observability and security agents as DaemonSets on physical nodes. Virtual nodes (ACS) do not support DaemonSets, so agents must run as sidecars. A SidecarSet injects a sidecar container into pods matching specific labels. Because a pod's destination node is unknown at creation, standard SidecarSet rules cannot target only virtual-node pods. ACK Virtual Node solves this by injecting sidecars after pods are scheduled to a virtual node, decoupling the sidecar lifecycle from the business container.

    Key concepts

    • Sidecar container: A container added to a pod to extend the primary container without modifying it. Configure sidecar containers in ACS clusters as described in Feature description.

    • SidecarSet: A feature of OpenKruise, an open-source cloud-native application automation engine from Alibaba Cloud. SidecarSet automatically injects sidecar containers (such as monitoring or log collection agents) into matching pods, decoupling sidecar lifecycle from business containers.

    Using SidecarSet with virtual nodes

    Add the label serverless.alibabacloud.com/virtual-node: "true" to your SidecarSet to match all pods scheduled to a virtual node. This label is automatically added after scheduling. By default, elastic container instances are prioritized. Use a label like alibabacloud.com/compute-class: general-purpose to target a specific ACS compute class.

    DaemonSet containers often depend on a ConfigMap. When the business pod and ConfigMap are in different namespaces, reference the ConfigMap in the sidecar volume using the namespace/name format. Cross-namespace access requires a SidecarSetResourceBinding.

    Note

    The serverless.alibabacloud.com/virtual-node: "true" label is required only when you use ACS compute resources on virtual nodes in an ACK cluster. This label is not required in an ACK Serverless cluster.

    Inject sidecar containers into specific pods

    By default, a SidecarSet targets every pod on a virtual node. To target specific pods, modify the .spec.selector field:

    apiVersion: apps.kruise.io/v1alpha1
kind: SidecarSet
metadata:
  name: filebeat-sidecarset
spec:
  containers:
    ...
  selector:
    matchLabels:
      serverless.alibabacloud.com/virtual-node: "true" 
      alibabacloud.com/compute-class: general-purpose 
      app: nginx

    Parameter

    Description

    serverless.alibabacloud.com/virtual-node

    Required. Matches all pods scheduled to a virtual node.

    alibabacloud.com/compute-class

    Optional. Targets pods of a specific compute class on virtual nodes. Compute class definition.

    app

    Optional. Add a custom label to target a specific workload.

    SidecarSetResourceBinding

    When a sidecar volume references a ConfigMap or Secret from another namespace, create a SidecarSetResourceBinding to grant cross-namespace access.

    Note

    This grants read-only (get, list, watch) permissions on the referenced ConfigMap and Secret.

    # Authorize pods matching the filebeat-sidecarset SidecarSet to access the filebeat-config ConfigMap in the kube-system namespace.
apiVersion: sidecarset.alibabacloud.com/v1alpha1
kind: SidecarSetResourceBinding
metadata:
  name: filebeat-sidecarset-resourcebinding
  namespace: kube-system # This SidecarSetResourceBinding can only grant permissions on resources in the kube-system namespace.
spec:
  subjects:
    - kind: SidecarSet
      name: filebeat-sidecarset
  resourceRefs:
    - kind: ConfigMap
      name: filebeat-config
    - kind: Secret
      name: elasticsearch-master-certs

    Container startup, exit order, and job pods

    Sidecar containers often have the following two requirements:

    • The sidecar container must start before the business container and exit after it.

    • For Job-type pods, the sidecar container must exit automatically after the business container finishes.

    In ACS, set the __IS_SIDECAR__="true" environment variable in the sidecar container definition. Configure the startup and shutdown sequence of sidecar containers.

    Update sidecar containers

    Use the OpenKruise hot sidecar update feature to update injected sidecars without affecting pod availability. This feature is fully compatible with virtual nodes.

    Scope

    Cross-namespace ConfigMap access is supported only for CPU pods with the general-purpose and performance-optimized compute classes. For GPU compute classes, use the OpenKruise ResourceDistribution feature to distribute the ConfigMap to the target namespace.

    Prerequisites

    Example

    Inject a Filebeat container as a sidecar into an Nginx business pod.

    1. Deploy the ConfigMap.

      Note

      This ConfigMap is in the kube-system namespace. In this example, the file is mounted to the sidecar container only to print its content. The variables do not take effect and do not need to be replaced.

      1. Create a file named configmap.yaml with the following content.

        apiVersion: v1
data:
  filebeat.yml: |
    filebeat.inputs:
      - type: log
        paths:
          - /var/log/*
          - /stdout/*
    output.elasticsearch:
      host: '${NODE_NAME}'
      hosts: '["https://${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}"]'
      username: '${ELASTICSEARCH_USERNAME}'
      password: '${ELASTICSEARCH_PASSWORD}'
      protocol: https
      ssl.certificate_authorities: [ "/usr/share/filebeat/certs/ca.crt" ]
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system

      2. Run the following command to deploy the ConfigMap.

        kubectl apply -f configmap.yaml

    2. Deploy the SidecarSet for the filebeat container.

      Note

      In this example, the filebeat container collects both file logs and stdout from the business container.

      1. Create a file named sidecarset.yaml with the following content.

        Show sample code

        apiVersion: apps.kruise.io/v1alpha1
kind: SidecarSet
metadata:
  name: filebeat-sidecarset
spec:
  containers:
    - args:
        - -e
        - -E
        - http.enabled=true
      env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: ELASTICSEARCH_USERNAME
          value: elastic
        - name: ELASTICSEARCH_PASSWORD
          value: gpU11EevMYaf2EBS
        - name: __IS_SIDECAR__  # Set an environment variable for this container.
          value: "true"         # Mark this container as a sidecar.
      image: docker.elastic.co/beats/filebeat:8.5.1
      imagePullPolicy: IfNotPresent
      name: filebeat
      podInjectPolicy: BeforeAppContainer
      resources:
        limits:
          cpu: "1"
          memory: 200Mi
        requests:
          cpu: 100m
          memory: 100Mi
      shareVolumePolicy:
        type: disabled
      upgradeStrategy:
        upgradeType: ColdUpgrade
      volumeMounts:
        - mountPath: /var/log
          name: varlog
          readOnly: true
        - mountPath: /stdout
          name: stdout-log
          readOnly: true
        - mountPath: /usr/share/filebeat/certs/
          name: elasticsearch-master-certs
        - mountPath: /usr/share/filebeat/filebeat.yml
          name: filebeat-config
          readOnly: true
          subPath: filebeat.yml
  selector:
    matchLabels:
      serverless.alibabacloud.com/virtual-node: "true" # Matches all pods scheduled to a virtual node.
  updateStrategy:
    type: NotUpdate
  volumes:
    - name: elasticsearch-master-certs
      secret:
        secretName: kube-system/elasticsearch-master-certs
    - configMap:
        name: kube-system/filebeat-config
      name: filebeat-config
    # Collect file logs.
    - emptyDir: {}
      name: varlog
    # Collect stdout.
    - name: stdout-log
      emptyDir:
        medium: Stdout
---
apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJakNDQWdxZ0F3SUJBZ0lSQUl0SDZxR2YzRG9VNFBuVWRJOUdITlV3RFFZSktvWklodmNOQVFFTEJRQXcKR3pFWk1CY0dBMVVFQXhNUVpXeGhjM1JwWTNObFlYSmphQzFqWVRBZUZ3MHlOREV3TWprd056RTNNamxhRncweQpOVEV3TWprd056RTNNamxhTUJzeEdUQVhCZ05WQkFNVEVHVnNZWE4wYVdOelpXRnlZMmd0WTJFd2dnRWlNQTBHCkNTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFET1Zxc0svVXAvWTVNRVY5T3hzTUk2TTZMTFhYMGsKNFBGSjE0SklVNStUVnBRVVNhVmx3N0REeGtJaUQ3RDVHZ3I3Snh4WHV0cFNjVlo0QWN0UzNrNFJvV3lqdzg0cApoYW4wY3JZL2VaQmJlWjVFUUhCSXprU0ZhMWd4bkpUcVErSSsvR3lKSlNHNkQyR21UVHRqRXZ2R2pWL1loSDNHCk1DMnRadVNXN1hPYWZBKzFqWUNkVFpIZkNpeDdBZURVNU0zcVplNzR4MjhTeitDNkM4WUFCQ0ZSTnJsVGNFQW8KaGQ5WGNnellPUGdJY2VZSUJWb25DTDdzVWFPZGVKa1hrbmdBR2ZzWjB6RnJhMm1qZGZtcHVIaWZFM21LbUZ1agpydGhXVFZTdE9oZGtIUnZTck52NDZaSFdtYlErNXZCb1RiODllTFZuNTNwbzhmSkJIWWpHZ24zdEFnTUJBQUdqCllUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ3BEQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0RBUVlJS3dZQkJRVUgKQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTU2dmVtcDRMem9QdVJiOUY3bjlmcU9JNQp2blF3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUs2alBULzc2RnV2K0RLSmsxNG15b0ZzNThnRjRqbjlLWEUwCmFqOEMrZ1BUd2o2dUpUTjRLcWFmcnV0VGxlZWM5cXhabVZjQTgzanJhTEkySzlNN2ZyVE9pVE1vSnhmNnFrU1AKZ1ozazF2OG40Z0JGbzhsczZpc2YrankvL1dpMiswUVdWOElIU1lRbDlucklCT0lpb25rS1ljbDVQY2tKWVo4RQpkYVJUYW1xbi8zRTFGODFGaXFDT3dPc0NGRk5IRHhPRDRRb25NbU5ReFFvb1I3Mks1V2R6TmQrTG5BbjE4eHZlCjE2b3gybzZNQ3hjQS9RWDE0d3dDVi9lb1Y4KzIwWlJRY01LT1U5Y0djSjZNYm9TSW1odzJzS0NpNkpYcUQwQWMKSFZscWFzTGh4cHZBc3lJdXY3TjB5VnVhVVdZVDVMV1oyOFBGUVozcmwvYTIvNHZHNStJPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURpRENDQW5DZ0F3SUJBZ0lSQUp3R2cyNVR5YUNEVmlxNWJEbDliREF3RFFZSktvWklodmNOQVFFTEJRQXcKR3pFWk1CY0dBMVVFQXhNUVpXeGhjM1JwWTNObFlYSmphQzFqWVRBZUZ3MHlOREV3TWprd056RTNNamxhRncweQpOVEV3TWprd056RTNNamxhTUI4eEhUQWJCZ05WQkFNVEZHVnNZWE4wYVdOelpXRnlZMmd0YldGemRHVnlNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE0L1QzMUp5VzJTSCtHZjhVTHJXVmhYZmwKdHhJRytMcGFGK0l6Q2lnSGh6QW5ZZnoyM0luQTZLOG9WWWtsejZLZzRzbEZjeXRHbStxd01ta3c3QzZXeHRVRwpSWlZiUXloZDZ6L1laRGhGUVpCQXZMWDVRVnIwWmIyRlN0NjdQM3dNa3Z1RE16TVZnRXoxZ2x0TmRyOVZiOXQyCjRUTXBka09GeFpPV24rZ0IyM0l3YnlNb0ZIMVNDZ1ZtcC9EQTNHZU1ENGErWURUcGowd1dSUFRRemdNcXh4YkUKd3FFdGN5R01yLzF6Sm4ycDZ6SWdmV3E0K1pwM2lRU2VOdjFUWWpHVm5xYzdWWUhDd29nb3pSRDI5TldTbC9BMApVSTVsbld3SDI3aU51QU1pVWFQRmx4eWtNbTlFbSs4SUcrT2VsRks4aDlBSEl2TDVYSFJjT3VOQzk2SjU1d0lECkFRQUJvNEhDTUlHL01BNEdBMVVkRHdFQi93UUVBd0lGb0RBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQWZCZ05WSFNNRUdEQVdnQlRucTk2YW5ndk9nKzVGdjBYdQpmMStvNGptK2REQmZCZ05WSFJFRVdEQldnaFJsYkdGemRHbGpjMlZoY21Ob0xXMWhjM1JsY29JY1pXeGhjM1JwClkzTmxZWEpqYUMxdFlYTjBaWEl1WkdWbVlYVnNkSUlnWld4aGMzUnBZM05sWVhKamFDMXRZWE4wWlhJdVpHVm0KWVhWc2RDNXpkbU13RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQURwMVlXOFBmMm5YMldqeU5YZlVTSVJiamN0YQo2RTVpQzEwdENlbUxFZVpPZlpSRGtKOUVSaUNFQ2tUVUNCNy9QemFrTlE1UGNYQzVmcmYyWCtucGZ3RFFyREN4ClM0WkpEMWZFeHN0Yis3L29yQmgrWXNYcHJiUUJMbDJ6M0w0dm5tZ1kyb3V5bjdyT2NOdWQveENvWUdBVUd4a0YKdmVvUDNld0NUVzlaUVhGVWF0WUUzMno1bHRXTlRTOE5RU1hQRUtoSUlqYWNOL29SQ2ZhY1pRaTFoOUhTczdzQQpOcmludkRCTnE4bDl0b3g5NFZadCtXN3NmUXZvVU5hTTV1OXk0UU5Ib25rdUZ2enZMdkpGeEtvbWE0RmtFOHl5CmphR2RpUXh2NVFXdW1sTlBzZ3VOUUpSMnp3QzJEUkVVZUR1WC96Zk9xdDBucDFOZWpoWU11VTIyVk5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBNC9UMzFKeVcyU0grR2Y4VUxyV1ZoWGZsdHhJRytMcGFGK0l6Q2lnSGh6QW5ZZnoyCjNJbkE2SzhvVllrbHo2S2c0c2xGY3l0R20rcXdNbWt3N0M2V3h0VUdSWlZiUXloZDZ6L1laRGhGUVpCQXZMWDUKUVZyMFpiMkZTdDY3UDN3TWt2dURNek1WZ0V6MWdsdE5kcjlWYjl0MjRUTXBka09GeFpPV24rZ0IyM0l3YnlNbwpGSDFTQ2dWbXAvREEzR2VNRDRhK1lEVHBqMHdXUlBUUXpnTXF4eGJFd3FFdGN5R01yLzF6Sm4ycDZ6SWdmV3E0CitacDNpUVNlTnYxVFlqR1ZucWM3VllIQ3dvZ296UkQyOU5XU2wvQTBVSTVsbld3SDI3aU51QU1pVWFQRmx4eWsKTW05RW0rOElHK09lbEZLOGg5QUhJdkw1WEhSY091TkM5Nko1NXdJREFRQUJBb0lCQUhSK3VEaDdYY3ZSUjE1WgpzU0s5d1kvWDJobFlxUjlyZktjLy9mMXV2NG9pM2IyQjNWYVBQM3FxS042dG5Ca2tienYyeC9zM1hucEgwWXV4Cm5rTFUvRkRZaE1BQ3VBVDJHQ2tsRTUwRDlNQ3d5NlNsQ3FDUHJ0NWZvRUxHMk1KMHpxZyt5S25kclZ0SCtSK0oKTVdsQ0ZwTjNnS1ZOMUI2UUcwa0JSN1NvaUdwd1ZhSEFOMEc2Q0NKTnR0eDByZHo5UVRpU3BCMmlzYmhaSVpRVgp2U1NwemY3R2ZzaU5pN1VaOTN0WkZ5S21PRE1CUW5yZm5xWkphVXdVeWhHYk02Y2h4YWpmY0dka1dadWJ6azZJCnUrTWFDcE5VOWsvSXpDUkhnNjVyZGhITlozeVdDYzh6UXRDdFNkaWFPRmFwclZ4aHhSeFU5WW9FT2hsaVlVS0wKNGhIN1VPRUNnWUVBNkkrL3MyMDN5WGx1R0tqb3VIRXc5Z29aNU9YNHk3WWFGb2dzTm9jMTBZdUxRSURjTEozTQpLWjc4aTZ1dlV3d2lVMVpKTmRYbHFhcFFDNFRBN2N0bktnTVpNRnhzYzFPQzZsTnJ6b3FXM3FST0NDNW9DRUJOCmVSQlR2V1FjOVhXUUxrK2wwcHBEZ3BaVFVjc0tYS2NJSldlakhVb0xuajMrcmo2ZjFsOHlhU01DZ1lFQSt1NXEKd1ZtU2NkQ1pqdXQzbktsZ3V6ZGlpbWpvZ0Jkc1VnRUg4WXhkK2QzTXgveVR0eGthdGNwMnYvTHNPQ3BMV1YzSQpNVTdCTUtVR3BpZGpOMzdYQ3FMREZHM3UzdHZhMHBjditsOENaYk45NWdVN3RNeHB2WjZyZjRwVFlKdG1Ya2RsCkVmUkNxMkhocU11UEpSUlhjMllOaDU2TjNSUW5CWnJRVmxLdjBtMENnWUVBb0Fvc2RpRjIvcU1kN01Kd1JGMUEKd0ZCN09WWTVQSmI0cFFEWXpEMkgvOGZ6OEZPOU1NYjJ0TDNBTmEzVVhXWkFTUEZjT0R3V2JBZlVSZGo1bTZzYQpONE1pVm5HRUFHazc4bDJ1RnRpd3NrNkhsSUc2L2RLaWZlbUtkdzdxRHREMGc2bzBCeFk1MXlmejlwbXZhOHRXCmc4Y3FMUUhEdFFZY3VYUkhNcE1ZY2RrQ2dZRUFrZHdxbys5OEo3cDR1Rkg1T2xCZWtSVFZxOXpsWVNlOGFFSi8KS3BKTVFpVUNsekVqY0NnZ2xaRjF5NGZhZFo5b0l5OVhZZ29FVkZGbzl3WW9MeWNFdXdMM1lKV3laMHJtL01pegpNOWNzWG8raVhDV29taVRFUmx2SUZxQUNiVUtIazcvdWFTeFI0S3RKNzhNN2x2TW5Ea1pCRVJkQ0lVTklsNEp4CkhleDhsVlVDZ1lCdlVMQUU3WkMyTkFnZUpYUmpRalFRd2laNU1jS09rTTBvVjlsYUlaR0xZUUVTOHVtYXA0THYKMVc5clN4UElxMTg3Q1haejBuOTdPN210aUpwYXhERDg1QVdZMEg5MGhFNitvZUltWmlPN3ZYbW5RTVRNZjNtWgp6dUcvNk84ckpsNWcyNnY4NTVBYjVUbC9ZQTNRcW1tOVdKdUt5eGw1bWxvMGkxNU14cWNia1E9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: elasticsearch-master-certs
  namespace: kube-system
type: kubernetes.io/tls

      2. Run the following command to deploy the SidecarSet.

        kubectl apply -f sidecarset.yaml

    3. Authorize the filebeat container to access the ConfigMap in the kube-system namespace.

      Note

      The business pod is in the default namespace, so you must authorize the filebeat container to access the ConfigMap in kube-system.

      1. Create a file named policy.yaml with the following content.

        apiVersion: sidecarset.alibabacloud.com/v1alpha1
kind: SidecarSetResourceBinding
metadata:
  name: filebeat-sidecarset-resourcebinding
  namespace: kube-system # This SidecarSetResourceBinding can only grant permissions on resources in the kube-system namespace.
spec:
  subjects:
    - kind: SidecarSet
      name: filebeat-sidecarset
  resourceRefs:
    - kind: ConfigMap
      name: filebeat-config
    - kind: Secret
      name: elasticsearch-master-certs

      2. Run the following command to deploy the SidecarSetResourceBinding.

        kubectl apply -f policy.yaml

    4. Deploy the Nginx business pod. Create a stateless workload by using a Deployment.

      apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx
  name: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
        alibabacloud.com/compute-class: general-purpose
        alibabacloud.com/compute-qos: default
    spec:
      containers:
        - name: nginx
          image: mirrors-ssl.aliyuncs.com/nginx:latest
          resources:
            limits:
              cpu: "1"
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
          volumeMounts:
            # Share log directory with filebeat sidecar container via volumeMount
            - mountPath: /var/log/nginx
              name: varlog
      volumes:
        - name: varlog
          emptyDir: {}
      nodeSelector:
        type: virtual-kubelet
      tolerations:
        - key: virtual-kubelet.io/provider
          operator: Equal
          value: alibabacloud
          effect: NoSchedule

    5. Check the business pod.

      kubectl get pods nginx-785d5xxxxx-xxxxx

      Expected output:

      NAME                     READY   STATUS    RESTARTS   AGE
nginx-785d5xxxxx-xxxxx   2/2     Running   0          10m

      The pod contains two containers (2/2 READY), confirming successful injection.

    6. Verify that the file logs and stdout from the business pod are mounted to the filebeat container.

      1. Run the following command to access the filebeat container.

         kubectl exec -it deploy/nginx -c filebeat -- /bin/bash

      2. In the container, view the error logs.

        cat /var/log/error.log

        Expected output:

        2024/11/08 07:20:54 [notice] 1#1: using the "epoll" event method
2024/11/08 07:20:54 [notice] 1#1: nginx/1.27.2
2024/11/08 07:20:54 [notice] 1#1: built by gcc 12.2.0 (Debian 12.2.0-14) 
2024/11/08 07:20:54 [notice] 1#1: OS: Linux 5.10.134-17.2.1.lifsea8.x86_64
2024/11/08 07:20:54 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2024/11/08 07:20:54 [notice] 1#1: start worker processes
2024/11/08 07:20:54 [notice] 1#1: start worker process 29

      3. In the container, view the stdout logs.

        cat /stdout/nginx/0.log

        Expected output:

        2024-11-08T15:20:53.99215101+08:00 stdout F /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
2024-11-08T15:20:53.992173978+08:00 stdout F /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
2024-11-08T15:20:54.003081339+08:00 stdout F /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
2024-11-08T15:20:54.085010761+08:00 stdout F 10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
2024-11-08T15:20:54.276107913+08:00 stdout F 10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
2024-11-08T15:20:54.276263126+08:00 stdout F /docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
2024-11-08T15:20:54.276842182+08:00 stdout F /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
2024-11-08T15:20:54.345892283+08:00 stdout F /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
2024-11-08T15:20:54.347524813+08:00 stdout F /docker-entrypoint.sh: Configuration complete; ready for start up

    7. Verify that the cross-namespace filebeat-config file is mounted to the filebeat container.

      kubectl exec deploy/nginx -c filebeat -- cat /usr/share/filebeat/filebeat.yml

      Expected output:

      filebeat.inputs:
  - type: log
    paths:
      - /var/log/*
      - /stdout/*
output.elasticsearch:
  host: '${NODE_NAME}'
  hosts: '["https://${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}"]'
  username: '${ELASTICSEARCH_USERNAME}'
  password: '${ELASTICSEARCH_PASSWORD}'
  protocol: https
  ssl.certificate_authorities: [ "/usr/share/filebeat/certs/ca.crt" ]

      The ConfigMap is mounted correctly.