You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This annotation specifies the names of the `InProcessConfigurations` used to configure the injected environment variables to support flagd's [in-process evaluation mode](https://flagd.dev/architecture/#in-process-evaluation).
37
+
The annotation value is a comma separated list of values following one of 2 patterns: {NAME} or {NAMESPACE}/{NAME}.
38
+
39
+
If no namespace is provided, it is assumed that the custom resource is within the **same namespace** as the annotated pod.
40
+
If multiple CRs are provided, they are merged with the latest taking precedence.
41
+
42
+
Users should not combine `openfeature.dev/inprocessconfiguration` and `openfeature.dev/featureflagsource` annotations
43
+
for the same pod. If this happens `openfeature.dev/featureflagsource` will take precedence.
44
+
45
+
For example, in the scenario below, `inProcessConfig-B` will take priority in the merge, replacing duplicated values that are set in `inProcessConfig-A`.
*This annotation is used INTERNALLY by the operator.*
36
57
37
58
This annotation is used to mark pods which should have their permissions backfilled in the event of an upgrade.
38
59
When the OFO manager pod is started, all `Service Accounts` of any `Pods` with this annotation set to `"true"` will be added to the `flagd-kubernetes-sync` `Cluster Role Binding`.
39
-
40
-
## Deprecated annotations
41
-
42
-
Given below are references to **deprecated** annotations used by previous versions of the operator.
for applications using `OpenFeature operator` with in-process evaluation mode enabled.
6
+
7
+
Below you can see a minimal example of `InProcessConfiguration` resource
8
+
9
+
```yaml
10
+
apiVersion: core.openfeature.dev/v1beta1
11
+
kind: InProcessConfiguration
12
+
metadata:
13
+
labels:
14
+
name: inprocessconfiguration-sample
15
+
spec:
16
+
port: 2424
17
+
tls: true
18
+
offlineFlagSourcePath: "my-path"
19
+
cacheMaxSize: 11
20
+
envVarPrefix: "my-prefix"
21
+
envVars:
22
+
- name: "name1"
23
+
value: "val1"
24
+
- name: "name2"
25
+
value: "val2"
26
+
```
27
+
28
+
## How does it work?
29
+
30
+
Similar to usage of [FeatureFlagSource](./feature_flag_source.md) configuration,
31
+
[annotations](./annotations.md#) are used to allow the injection of configuration data
32
+
into the annotated Pod.
33
+
The mutating webhook parses the annotations, retrieves the referenced `InProcessConfiguration` resources from the cluster and injects the data from the resource into all containers of the Pod via environment variables, which configure the provider in the workload to consume feature flag configuration from the available [sync implementation](https://flagd.dev/concepts/syncs/#grpc-sync) specified by the configuration.
34
+
35
+
## Merging of configurations
36
+
37
+
The value of `openfeature.dev/inprocessconfiguration` annotation is a comma separated list of values following one of two patterns: {NAME} or {NAMESPACE}/{NAME}.
38
+
If no namespace is provided, it is assumed that the CR is within the same namespace as the deployed pod, for example:
When multiple `InProcessConfigurations` are provided, the custom resources are merged in runtime and the last `CR` takes precedence over the first, similarly how it's done for `FeatureFlagSource`.
48
+
In this example, 2 CRs are being used to set the injected configuration.
49
+
50
+
```yaml
51
+
apiVersion: core.openfeature.dev/v1beta1
52
+
kind: InProcessConfiguration
53
+
metadata:
54
+
name: inProcessConfig-A
55
+
spec:
56
+
port: 2424
57
+
tls: true
58
+
offlineFlagSourcePath: "my-path"
59
+
cacheMaxSize: 11
60
+
envVarPrefix: "my-prefix"
61
+
envVars:
62
+
- name: "name1"
63
+
value: "val1"
64
+
- name: "name2"
65
+
value: "val2"
66
+
---
67
+
apiVersion: core.openfeature.dev/v1beta1
68
+
kind: InProcessConfiguration
69
+
metadata:
70
+
name: inProcessConfig-B
71
+
spec:
72
+
envVarPrefix: "my-second-prefix"
73
+
host: "my-host"
74
+
```
75
+
76
+
The resources are merged in runtime, which means that no changes are made to the `InProcessConfiguration` resources
77
+
in the cluster, but the operator handles the merge and injection internally.
78
+
79
+
The resulting configuration will look like the following
80
+
81
+
```yaml
82
+
apiVersion: core.openfeature.dev/v1beta1
83
+
kind: InProcessConfiguration
84
+
metadata:
85
+
name: internal
86
+
spec:
87
+
port: 2424
88
+
tls: true
89
+
offlineFlagSourcePath: "my-path"
90
+
cacheMaxSize: 11
91
+
envVarPrefix: "my-seconf-prefix"
92
+
host: "my-host"
93
+
envVars:
94
+
- name: "name1"
95
+
value: "val1"
96
+
- name: "name2"
97
+
value: "val2"
98
+
```
99
+
100
+
This resulting resource is transformed into environment variables and injected into all containers
Copy file name to clipboardexpand all lines: docs/permissions.md
+17-12
Original file line number
Diff line number
Diff line change
@@ -23,18 +23,23 @@ The `manager-role` applies the rules described below, its definition can be foun
23
23
It provides the operator with sufficient permissions over the `core.openfeature.dev` resources, and the required permissions for injecting the `flagd` sidecar into appropriate pods.
24
24
The `ConfigMap` permissions are needed to allow the mounting of `FeatureFlag` resources for file syncs.
0 commit comments