You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/blog/_posts/2022-10-20-advanced-server-side-apply.md
+19-18Lines changed: 19 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,8 +7,8 @@ slug: advanced-server-side-apply
7
7
8
8
**Author:** Daniel Smith (Google)
9
9
10
-
Server-side apply (SSA) has now been [GA for a few
11
-
releases](https://kubernetes.io/blog/2021/08/06/server-side-apply-ga/), and I
10
+
[Server-side apply](/docs/reference/using-api/server-side-apply/) (SSA) has now
11
+
been [GA for a few releases](/blog/2021/08/06/server-side-apply-ga/), and I
12
12
have found myself in a number of conversations, recommending that people / teams
13
13
in various situations use it. So I’d like to write down some of those reasons.
14
14
@@ -20,7 +20,7 @@ Server-side apply!
20
20
* Versus client-side-apply (that is, plain `kubectl apply`):
21
21
* The system gives you conflicts when you accidentally fight with another
22
22
actor over the value of a field!
23
-
* When combined with --dry-run, there’s no chance of accidentally running a
23
+
* When combined with `--dry-run`, there’s no chance of accidentally running a
24
24
client-side dry run instead of a server side dry run.
25
25
* Versus hand-rolling patches:
26
26
* The SSA patch format is extremely natural to write, with no weird syntax.
@@ -34,14 +34,14 @@ Server-side apply!
34
34
for building apply calls programmatically!
35
35
* You can use SSA to explicitly delete fields you don’t “own” by setting them
36
36
to `null`, which makes it a feature-complete replacement for all of the old
37
-
patch formats.
37
+
patch formats.
38
38
* Versus shelling out to kubectl:
39
-
* You can use the apply api call from any language without shelling out to
39
+
* You can use the **apply** API call from any language without shelling out to
40
40
kubectl!
41
-
* As stated above, the [go library has dedicated mechanisms](https://kubernetes.io/blog/2021/08/06/server-side-apply-ga/#server-side-apply-support-in-client-go)
41
+
* As stated above, the [Go library has dedicated mechanisms](/blog/2021/08/06/server-side-apply-ga/#server-side-apply-support-in-client-go)
42
42
to make this easy now.
43
43
* Versus GET-modify-PUT:
44
-
* (This one is more complicated and you can skip it if you’ve never written a
44
+
* (This one is more complicated and you can skip it if you've never written a
45
45
controller!)
46
46
* To use GET-modify-PUT correctly, you have to handle and retry a write
47
47
failure in the case that someone else has modified the object in any way
@@ -96,7 +96,7 @@ your change!)
96
96
97
97
#### Reconstructive controllers
98
98
99
-
This kind of controller wasn’t really possible prior to SSA. The idea here is to
99
+
This kind of controller wasn't really possible prior to SSA. The idea here is to
100
100
(whenever something changes etc) reconstruct from scratch the fields of the
101
101
object as the controller wishes them to be, and then **apply** the change to the
102
102
server, letting it figure out the result. I now recommend that new controllers
@@ -107,7 +107,7 @@ The client library supports this method of operation by default.
107
107
108
108
The only downside is that you may end up sending unneeded **apply** requests to
109
109
the API server, even if actually the object already matches your controller’s
110
-
desires. This doesn’t matter if it happens once in a while, but for extremely
110
+
desires. This doesn't matter if it happens once in a while, but for extremely
111
111
high-throughput controllers, it might cause a performance problem for the
112
112
cluster–specifically, the API server. No-op writes are not written to storage
113
113
(etcd) or broadcast to any watchers, so it’s not really that big of a deal. If
@@ -116,11 +116,11 @@ the previous section, or you could still do it this way for now, and wait for an
116
116
additional client-side mechanism to suppress zero-change applies.
117
117
118
118
To get around this downside, why not GET the object and only send your **apply**
119
-
if the object needs it? Surprisingly, it doesn’t help much– a no-op **apply** is
119
+
if the object needs it? Surprisingly, it doesn't help much– a no-op **apply** is
120
120
not very much more work for the API server than an extra GET; and an **apply**
121
121
that changes things is cheaper than that same **apply** with a preceding GET.
122
122
Worse, since it is a distributed system, something could change between your GET
123
-
and **apply**, invalidating your computation. Instead, we can use this
123
+
and **apply**, invalidating your computation. Instead, you can use this
124
124
optimization on an object retrieved from a cache–then it legitimately will
125
125
reduce load on the system (at the cost of a delay when a change is needed and
126
126
the cache is a bit behind).
@@ -168,17 +168,18 @@ back-propagate these conflict errors to humans; in fact, they should have this
168
168
already, certainly continuous integration systems need some way to report that
169
169
tests are failing. But maybe I can also say something about how _humans_ can
170
170
deal with errors:
171
+
171
172
* Reject the hotfix: the (human) administrator of the CI/CD system observes the
172
173
error, and manually force-applies the manifest in question. Then the CI/CD
173
174
system will be able to apply the manifest successfully and become a co-owner.
174
-
175
-
Optional: then the administrator applies a blank manifest (just the object
175
+
176
+
Optional: then the administrator applies a blank manifest (just the object
176
177
type / namespace / name) to relinquish any fields they became a manager for.
177
178
if this step is omitted, there's some chance the administrator will end up
178
179
owning fields and causing an unwanted future conflict.
179
-
180
-
Note: why an administrator? We're assuming that developers which ordinarily
181
-
push to the CI/CD system and/or its source control system may not have
180
+
181
+
**Note**: why an administrator? I'm assuming that developers which ordinarily
182
+
push to the CI/CD system and / or its source control system may not have
182
183
permissions to push directly to the cluster.
183
184
* Accept the hotfix: the author of the change in question sees the conflict, and
184
185
edits their change to accept the value running in production.
@@ -200,8 +201,8 @@ deal with errors:
200
201
would love to know if in fact people want/need the features implied by this
201
202
approach, such as the ability, when **apply**ing to request to override
202
203
certain conflicts but not others.
203
-
204
-
If this sounds like an approach you'd want to take for your own controller,
204
+
205
+
If this sounds like an approach you'd want to take for your own controller,
0 commit comments