Inject a sidecar container into a pod on a virtual node - Container Compute Service

Virtual nodes do not support DaemonSets, so observability and security agents must run as sidecar containers within each pod. The ACK Virtual Node component works with OpenKruise SidecarSet to automatically inject sidecar containers into pods scheduled to virtual nodes. This decouples sidecar lifecycle management from the application container.

How sidecar injection works

On physical nodes, you deploy monitoring or security agents through a DaemonSet. Virtual nodes do not support DaemonSets, so agents must run as sidecar containers.

OpenKruise SidecarSet uses an admission webhook to inject a sidecar container into pods that match specified labels at creation time. However, if a pod's scheduling target is unknown until after the scheduling decision, SidecarSet alone cannot distinguish between pods destined for physical nodes and those destined for virtual nodes.

The ACK Virtual Node component solves this by adding the label serverless.alibabacloud.com/virtual-node: "true" to a pod after the pod is confirmed to be scheduled to a virtual node. By default, Elastic Container Instance (ECI) instances are prioritized. The SidecarSet then matches this label and injects the sidecar container only into virtual node pods.

Note

Configure the serverless.alibabacloud.com/virtual-node: "true" label only when you use ACS computing power through virtual nodes in an ACK cluster. No extra configuration is needed when you use an ACS cluster directly.

Supported compute types

This feature supports only CPU pods of the following compute types:

general-purpose
compute-optimized instance

Prerequisites

An ACK Pro cluster, an ACK dedicated cluster, or an ACK Serverless cluster Pro is created. The cluster version must be 1.22 or later. For more information, see Create an ACK managed cluster, Create an ACK dedicated cluster, or Create an ACK Serverless cluster.
The ACK Virtual Node component is installed. The component version must be v2.13.0 or later. For more information, see ACK Virtual Node.
The ack-kruise component is installed. The component version must be v1.3.0 or later. For more information, see ack-kruise.
The SidecarSetServerlessPod=true feature gate is enabled. Set SidecarSetServerlessPod=true in the featureGates of the Kubernetes API server component. For more information, see Customize control plane component parameters.

Target specific pods with selector labels

By default, a SidecarSet that uses the virtual node label injects a sidecar container into all pods scheduled to virtual nodes. To target specific pods, add more labels to .spec.selector.

apiVersion: apps.kruise.io/v1alpha1
kind: SidecarSet
metadata:
  name: filebeat-sidecarset
spec:
  containers:
    ...
  selector:
    matchLabels:
      serverless.alibabacloud.com/virtual-node: "true"
      alibabacloud.com/compute-class: general-purpose
      app: nginx

Label	Required	Description
`serverless.alibabacloud.com/virtual-node`	Yes	Matches all pods scheduled to virtual nodes.
`alibabacloud.com/compute-class`	No	Restricts injection to pods of a specific compute type, such as `general-purpose`. For more information, see Compute type definitions.
Custom labels (for example, `app`)	No	Restricts injection to pods with a specific application label.

Access cross-namespace resources with SidecarSetResourceBinding

A sidecar container often depends on a ConfigMap or Secret for its configuration. When the sidecar is injected into a pod in a different namespace, the pod cannot access resources in the sidecar's original namespace by default.

To reference a ConfigMap or Secret from another namespace, use the namespace/name format in the SidecarSet volume definition. Then create a SidecarSetResourceBinding to authorize cross-namespace access.

SidecarSetResourceBinding grants only read-only (Get, List, and Watch) permissions for the specified ConfigMap and Secret resources. The binding can only authorize resources in its own namespace.

apiVersion: sidecarset.alibabacloud.com/v1alpha1
kind: SidecarSetResourceBinding
metadata:
  name: filebeat-sidecarset-resourcebinding
  namespace: kube-system  # Can only grant access to resources in the kube-system namespace
spec:
  subjects:
    - kind: SidecarSet
      name: filebeat-sidecarset
  resourceRefs:
    - kind: ConfigMap
      name: filebeat-config
    - kind: Secret
      name: elasticsearch-master-certs

Note

This authorization grants only read-only (Get, List, and Watch) permissions for the ConfigMap and Secret.

Control container startup and exit order

Sidecar containers typically need to:

Start before the application container and exit after it.
For Job pods, actively exit after the application container exits.

In an ACS scenario, set the environment variable __IS_SIDECAR__="true" on the sidecar container to enable this behavior. For more information, see Configure the startup and shutdown order of sidecar containers.

Upgrade the sidecar container independently

After you deploy a sidecar container, you can upgrade it independently using the OpenKruise sidecar hot upgrade feature. This feature performs seamless upgrades without affecting pod availability and is fully compatible with the virtual node method.

Example: inject a Filebeat sidecar into an Nginx pod

The following walkthrough deploys a Filebeat sidecar container alongside an Nginx application pod. The Filebeat sidecar collects both file logs and standard output from the application container.

Step 1: Deploy the ConfigMap

This ConfigMap provides the Filebeat configuration. It resides in the kube-system namespace. In this example, the configuration is only mounted and printed. The environment variables in the configuration do not take effect and do not need to be replaced.

Create a file named configmap.yaml:

    apiVersion: v1
    data:
      filebeat.yml: |
        filebeat.inputs:
          - type: log
            paths:
              - /var/log/*
              - /stdout/*
        output.elasticsearch:
          host: '${NODE_NAME}'
          hosts: '["https://${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}"]'
          username: '${ELASTICSEARCH_USERNAME}'
          password: '${ELASTICSEARCH_PASSWORD}'
          protocol: https
          ssl.certificate_authorities: [ "/usr/share/filebeat/certs/ca.crt" ]
    kind: ConfigMap
    metadata:
      name: filebeat-config
      namespace: kube-system

Deploy the ConfigMap:
```
    kubectl apply -f configmap.yaml
```

Step 2: Deploy the SidecarSet

This SidecarSet defines the Filebeat sidecar container and its injection rules.

Create a file named sidecarset.yaml:

Expand to view the code details

    apiVersion: apps.kruise.io/v1alpha1
    kind: SidecarSet
    metadata:
      name: filebeat-sidecarset
    spec:
      containers:
        - args:
            - -e
            - -E
            - http.enabled=true
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: ELASTICSEARCH_USERNAME
              value: elastic
            - name: ELASTICSEARCH_PASSWORD
              value: gpU11EevMYaf2EBS
            - name: __IS_SIDECAR__  # Mark this container as a sidecar
              value: "true"
          image: docker.elastic.co/beats/filebeat:8.5.1
          imagePullPolicy: IfNotPresent
          name: filebeat
          podInjectPolicy: BeforeAppContainer
          resources:
            limits:
              cpu: "1"
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
          shareVolumePolicy:
            type: disabled
          upgradeStrategy:
            upgradeType: ColdUpgrade
          volumeMounts:
            - mountPath: /var/log
              name: varlog
              readOnly: true
            - mountPath: /stdout
              name: stdout-log
              readOnly: true
            - mountPath: /usr/share/filebeat/certs/
              name: elasticsearch-master-certs
            - mountPath: /usr/share/filebeat/filebeat.yml
              name: filebeat-config
              readOnly: true
              subPath: filebeat.yml
      selector:
        matchLabels:
          serverless.alibabacloud.com/virtual-node: "true"  # Match all pods on virtual nodes
      updateStrategy:
        type: NotUpdate
      volumes:
        - name: elasticsearch-master-certs
          secret:
            secretName: kube-system/elasticsearch-master-certs
        - configMap:
            name: kube-system/filebeat-config
          name: filebeat-config
        # File logs
        - emptyDir: {}
          name: varlog
        # Standard output
        - name: stdout-log
          emptyDir:
            medium: Stdout
    ---
    apiVersion: v1
    data:
      ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJakNDQWdxZ0F3SUJBZ0lSQUl0SDZxR2YzRG9VNFBuVWRJOUdITlV3RFFZSktvWklodmNOQVFFTEJRQXcKR3pFWk1CY0dBMVVFQXhNUVpXeGhjM1JwWTNObFlYSmphQzFqWVRBZUZ3MHlOREV3TWprd056RTNNamxhRncweQpOVEV3TWprd056RTNNamxhTUJzeEdUQVhCZ05WQkFNVEVHVnNZWE4wYVdOelpXRnlZMmd0WTJFd2dnRWlNQTBHCkNTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFET1Zxc0svVXAvWTVNRVY5T3hzTUk2TTZMTFhYMGsKNFBGSjE0SklVNStUVnBRVVNhVmx3N0REeGtJaUQ3RDVHZ3I3Snh4WHV0cFNjVlo0QWN0UzNrNFJvV3lqdzg0cApoYW4wY3JZL2VaQmJlWjVFUUhCSXprU0ZhMWd4bkpUcVErSSsvR3lKSlNHNkQyR21UVHRqRXZ2R2pWL1loSDNHCk1DMnRadVNXN1hPYWZBKzFqWUNkVFpIZkNpeDdBZURVNU0zcVplNzR4MjhTeitDNkM4WUFCQ0ZSTnJsVGNFQW8KaGQ5WGNnellPUGdJY2VZSUJWb25DTDdzVWFPZGVKa1hrbmdBR2ZzWjB6RnJhMm1qZGZtcHVIaWZFM21LbUZ1agpydGhXVFZTdE9oZGtIUnZTck52NDZaSFdtYlErNXZCb1RiODllTFZuNTNwbzhmSkJIWWpHZ24zdEFnTUJBQUdqCllUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ3BEQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0RBUVlJS3dZQkJRVUgKQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTU2dmVtcDRMem9QdVJiOUY3bjlmcU9JNQp2blF3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUs2alBULzc2RnV2K0RLSmsxNG15b0ZzNThnRjRqbjlLWEUwCmFqOEMrZ1BUd2o2dUpUTjRLcWFmcnV0VGxlZWM5cXhabVZjQTgzanJhTEkySzlNN2ZyVE9pVE1vSnhmNnFrU1AKZ1ozazF2OG40Z0JGbzhsczZpc2YrankvL1dpMiswUVdWOElIU1lRbDlucklCT0lpb25rS1ljbDVQY2tKWVo4RQpkYVJUYW1xbi8zRTFGODFGaXFDT3dPc0NGRk5IRHhPRDRRb25NbU5ReFFvb1I3Mks1V2R6TmQrTG5BbjE4eHZlCjE2b3gybzZNQ3hjQS9RWDE0d3dDVi9lb1Y4KzIwWlJRY01LT1U5Y0djSjZNYm9TSW1odzJzS0NpNkpYcUQwQWMKSFZscWFzTGh4cHZBc3lJdXY3TjB5VnVhVVdZVDVMV1oyOFBGUVozcmwvYTIvNHZHNStJPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURpRENDQW5DZ0F3SUJBZ0lSQUp3R2cyNVR5YUNEVmlxNWJEbDliREF3RFFZSktvWklodmNOQVFFTEJRQXcKR3pFWk1CY0dBMVVFQXhNUVpXeGhjM1JwWTNObFlYSmphQzFqWVRBZUZ3MHlOREV3TWprd056RTNNamxhRncweQpOVEV3TWprd056RTNNamxhTUI0eEhEQWJCZ05WQkFNVEZHVnNZWE4wYVdOelpXRnlZMmd0YldGemRHVnlNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE0L1QzMUp5VzJTSCtHZjhVTHJXVmhYZmwKdHhJRytMcGFGK0l6Q2lnSGh6QW5ZZnoyM0luQTZLOG9WWWtsejZLZzRzbEZjeXRHbStxd01ta3c3QzZXeHRVRwpSWlZiUXloZDZ6L1laRGhGUVpCQXZMWDVRVnIwWmIyRlN0NjdQM3dNa3Z1RE16TVZnRXoxZ2x0TmRyOVZiOXQyCjRUTXBka09GeFpPV24rZ0IyM0l3YnlNb0ZIMVNDZ1ZtcC9EQTNHZU1ENGErWURUcGowd1dSUFRRemdNcXh4YkUKd3FFdGN5R01yLzF6Sm4ycDZ6SWdmV3E0K1pwM2lRU2VOdjFUWWpHVm5xYzdWWUhDd29nb3pSRDI5TldTbC9BMApVSTVsbld3SDI3aU51QU1pVWFQRmx4eWtNbTlFbSs4SUcrT2VsRks0aDlBSEl2TDVYSFJjT3VOQzk2SjU1d0lECkFRQUJvNEhDTUlHL01BNEdBMVVkRHdFQi93UUVBd0lGb0RBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3REFZRFZSMFRBUUgvQkFJd0FEQWRCZ05WSFNNRUdEQVdnQlRucTk2YW5ndk9nKzVGdjBYdQpmMStvNGptK2REQmZCZ05WSFJFRVdEQldnaFJsYkdGemRHbGpjMlZoY21Ob0xXMWhjM1JsY29JY1pXeGhjM1JwClkzTmxZWEpqYUMxdFlYTjBaWEl1WkdWbVlYVnNkSUlnWld4aGMzUnBZM05sWVhKamFDMXRZWE4wWlhJdVpHVm0KWVhWc2RDNXpkbU13RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQURwMVlXOFBmMm5YMldqeU5YZlVTSVJiamN0YQo2RTVpQzEwdENlbUxFZVpPZlpSRGtKOUVSaUNFQ2tUVUNCNy9QemFrTlE1UGNYQzVmcmYyWCtucGZ3RFFyREN4ClM0WkpEMWZFeHN0Yis3L29yQmgrWXNYcHJiUUJMbDJ6M0w0dm5tZ1kyb3V5bjdyT2NOdWQveENvWUdBVUd4a0YKdmVvUDNld0NUVzlaUVhGVWF0WUUzMno1bHRXTlRTOE5RU1hQRUtoSUlqYWNOL29SQ2ZhY1pRaTFoOUhTczdzQQpOcmludkRCTnE4bDl0b3g5NFZadCtXN3NmUXZvVU5hTTV1OXk0UU5Ib25rdUZ2enZMdkpGeEtvbWE0RmtFOHl5CmphR2RpUXh2NVFXdW1sTlBzZ3VOUUpSMnp3QzJEUkVVZUR1WC96Zk9xdDBucDFOZWpoWU11VTIyVk5zPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
      tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBNC9UMzFKeVcyU0grR2Y4VUxyV1ZoWGZsdHhJRytMcGFGK0l6Q2lnSGh6QW5ZZnoyCjNJbkE2SzhvVllrbHo2S2c0c2xGY3l0R20rcXdNbWt3N0M2V3h0VUdSWlZiUXloZDZ6L1laRGhGUVpCQXZMWDUKUVZyMFpiMkZTdDY3UDN3TWt2dURNek1WZ0V6MWdsdE5kcjlWYjl0MjRUTXBka09GeFpPV24rZ0IyM0l3YnlNbwpGSDFTQ2dWbXAvREEzR2VNRDRhK1lEVHBqMHdXUlBUUXpnTXF4eGJFd3FFdGN5R01yLzF6Sm4ycDZ6SWdmV3E0CitacDNpUVNlTnYxVFlqR1ZucWM3VllIQ3dvZ296UkQyOU5XU2wvQTBVSTVsbld3SDI3aU51QU1pVWFQRmx4eWsKTW05RW0rOElHK09lbEZLOGg5QUhJdkw1WEhSY091TkM5Nko1NXdJREFRQUJBb0lCQUhSK3VEaDdYY3ZSUjE1WgpzU0s5d1kvWDJobFlxUjlyZktjLy9mMXV2NG9pM2IyQjNWYVBQM3FxS042dG5Ca2tienYyeC9zM1hucEgwWXV4Cm5rTFUvRkRZaE1BQ3VBVDJHQ2tsRTUwRDlNQ3d5NlNsQ3FDUHJ0NWZvRUxHMk1KMHpxZyt5S25kclZ0SCtSK0oKTVdsQ0ZwTjNnS1ZOMUI2UUcwa0JSN1NvaUdwd1ZhSEFOMEc2Q0NKTnR0eDByZHo5UVRpU3BCMmlzYmhaSVpRVgp2U1NwemY3R2ZzaU5pN1VaOTN0WkZ5S21PRE1CUW5yZm5xWkphVXdVeWhHYk02Y2h4YWpmY0dka1dadWJ6azZJCnUrTWFDcE5VOWsvSXpDUkhnNjVyZGhITlozeVdDYzh6UXRDdFNkaWFPRmFwclZ4aHhSeFU5WW9FT2hsaVlVS0wKNGhIN1VPRUNnWUVBNkkrL3MyMDN5WGx1R0tqb3VIRXc5Z29aNU9YNHk3WWFGb2dzTm9jMTBZdUxRSURjTEozTQpLWjc4aTZ1dlV3d2lVMVpKTmRYbHFhcFFDNFRBN2N0bktnTVpNRnhzYzFPQzZsTnJ6b3FXM3FST0NDNW9DRUJOCmVSQlR2V1FjOVhXUUxrK2wwcHBEZ3BaVFVjc0tYS2NJSldlakhVb0xuajMrcmo2ZjFsOHlhU01DZ1lFQSt1NXEKd1ZtU2NkQ1pqdXQzbktsZ3V6ZGlpbWpvZ0Jkc1VnRUg4WXhkK2QzTXgveVR0eGthdGNwMnYvTHNPQ3BMV1YzSQpNVTdCTUtVR3BpZGpOMzdYQ3FMREZHM3UzdHZhMHBjditsOENaYk45NWdVN3RNeHB2WjZyZjRwVFlKdG1Ya2RsCkVmUkNxMkhocU11UEpSUlhjMllOaDU2TjNSUW5CWnJRVmxLdjBtMENnWUVBb0Fvc2RpRjIvcU1kN01Kd1JGMUEKd0ZCN09WWTVQSmI0cFFEWXpEMkgvOGZ6OEZPOU1NYjJ0TDNBTmEzVVhXWkFTUEZjT0R3V2JBZlVSZGo1bTZzYQpONE1pVm5HRUFHazc4bDJ1RnRpd3NrNkhsSUc2L2RLaWZlbUtkdzdxRHREMGc2bzBCeFk1MXlmejlwbXZhOHRXCmc4Y3FMUUhEdFFZY3VYUkhNcE1ZY2RrQ2dZRUFrZHdxbys5OEo3cDR1Rkg1T2xCZWtSVFZxOXpsWVNlOGFFSi8KS3BKTVFpVUNsekVqY0NnZ2xaRjF5NGZhZFo5b0l5OVhZZ29FVkZGbzl3WW9MeWNFdXdMM1lKV3laMHJtL01pewpNOWNzWG8raVhDV29taVRFUmx2SUZxQUNiVUtIazcvdWFTeFI0S3RKNzhNN2x2TW5Ea1pCRVJkQ0lVTklsNEp4CkhleDhsVlVDZ1lCdlVMQUU3WkMyTkFnZUpYUmpRalFRd2laNU1jS09rTTBvVjlsYUlaR0xZUUVTOHVtYXA0THYKMVc5clN4UElxMTg3Q1haejBuOTdPN210aUpwYXhERDg1QVdZMEg5MGhFNitvZUltWmlPN3ZYbW5RTVRNZjNtWgp6dUcvNk84ckpsNWcyNnY4NTVBYjVUbC9ZQTNRcW1tOVdKdUt5eGw1bWxvMGkxNU14cWNia1E9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
    kind: Secret
    metadata:
      name: elasticsearch-master-certs
      namespace: kube-system
    type: kubernetes.io/tls

Deploy the SidecarSet:
```
    kubectl apply -f sidecarset.yaml
```

Step 3: Create the SidecarSetResourceBinding

Because the application pod runs in the default namespace, the injected Filebeat container needs explicit authorization to access the ConfigMap and Secret in the kube-system namespace.

Create a file named policy.yaml:

    apiVersion: sidecarset.alibabacloud.com/v1alpha1
    kind: SidecarSetResourceBinding
    metadata:
      name: filebeat-sidecarset-resourcebinding
      namespace: kube-system  # Can only grant access to resources in the kube-system namespace
    spec:
      subjects:
        - kind: SidecarSet
          name: filebeat-sidecarset
      resourceRefs:
        - kind: ConfigMap
          name: filebeat-config
        - kind: Secret
          name: elasticsearch-master-certs

Deploy the SidecarSetResourceBinding:
```
    kubectl apply -f policy.yaml
```

Step 4: Deploy the application pod

Deploy an Nginx Deployment that schedules pods to virtual nodes. For more information, see Create a stateless application using a Deployment.

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx
  name: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
        alibabacloud.com/compute-class: general-purpose
        alibabacloud.com/compute-qos: default
    spec:
      containers:
        - name: nginx
          image: mirrors-ssl.aliyuncs.com/nginx:latest
          resources:
            limits:
              cpu: "1"
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
          volumeMounts:
            # Share log directory with filebeat sidecar container
            - mountPath: /var/log/nginx
              name: varlog
      volumes:
        - name: varlog
          emptyDir: {}
      nodeSelector:
        type: virtual-kubelet
      tolerations:
        - key: virtual-kubelet.io/provider
          operator: Equal
          value: alibabacloud
          effect: NoSchedule

Step 5: Verify the injection

Check the pod status: Expected output: The 2/2 in the READY column confirms that the sidecar container was injected successfully.

    kubectl get pods nginx-785d5xxxxx-xxxxx

    NAME                     READY   STATUS    RESTARTS   AGE
    nginx-785d5xxxxx-xxxxx   2/2     Running   0          10m

Verify that the Filebeat container can access file logs from the application container: Inside the container, view the error log: Expected output:

    kubectl exec -it deploy/nginx -c filebeat -- /bin/bash

    cat /var/log/error.log

    2024/11/08 07:20:54 [notice] 1#1: using the "epoll" event method
    2024/11/08 07:20:54 [notice] 1#1: nginx/1.27.2
    2024/11/08 07:20:54 [notice] 1#1: built by gcc 12.2.0 (Debian 12.2.0-14)
    2024/11/08 07:20:54 [notice] 1#1: OS: Linux 5.10.134-17.2.1.lifsea8.x86_64
    2024/11/08 07:20:54 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
    2024/11/08 07:20:54 [notice] 1#1: start worker processes
    2024/11/08 07:20:54 [notice] 1#1: start worker process 29

Verify that the Filebeat container can access the standard output of the application container: Expected output:

    cat /stdout/nginx/0.log

    2024-11-08T15:20:53.99215101+08:00 stdout F /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
    2024-11-08T15:20:53.992173978+08:00 stdout F /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
    2024-11-08T15:20:54.003081339+08:00 stdout F /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
    2024-11-08T15:20:54.085010761+08:00 stdout F 10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
    2024-11-08T15:20:54.276107913+08:00 stdout F 10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
    2024-11-08T15:20:54.276263126+08:00 stdout F /docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
    2024-11-08T15:20:54.276842182+08:00 stdout F /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
    2024-11-08T15:20:54.345892283+08:00 stdout F /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
    2024-11-08T15:20:54.347524813+08:00 stdout F /docker-entrypoint.sh: Configuration complete; ready for start up

Verify that the Filebeat container has mounted the cross-namespace configuration file: Expected output: This output confirms that the cross-namespace ConfigMap is mounted correctly.

    kubectl exec deploy/nginx -c filebeat -- cat /usr/share/filebeat/filebeat.yml

    filebeat.inputs:
      - type: log
        paths:
          - /var/log/*
          - /stdout/*
    output.elasticsearch:
      host: '${NODE_NAME}'
      hosts: '["https://${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}"]'
      username: '${ELASTICSEARCH_USERNAME}'
      password: '${ELASTICSEARCH_PASSWORD}'
      protocol: https
      ssl.certificate_authorities: [ "/usr/share/filebeat/certs/ca.crt" ]

Container Compute Service:Inject a sidecar container into a pod on a virtual node