Using connaisseur as a daemonset instead of a deployment

[lacuchilla]

I'm curious to know if there's an official way to implement connaisseur onto a kubernetes cluster by using a daemonset instead of a deployment.

I'm working on implementing connaisseur on a cluster that autoscales, and it would be great to have connaisseur implemented as a daemonset so I can scale the cluster up and down and still assure that there is one connaisseur pod per node.

I'm interested to know some of the reasoning why connaisseur was implemented as a deployment instead of a daemonset.

Is there a configuration that I can add to the deployment section in the values.yaml file for the connaisseur helm chart that I'm using so that the number of connaisseur pods will scale up and down to match the number of nodes in the cluster?

[xopham]

@lacuchilla how to autoscale Connaisseur is an interesting question where I am not certain what the best strategy may be. Currently, there is no configuration to do this automatically.
Connaisseur was not implemented as a daemonset as it is not required to run one Pod per node. Ultimately being an admission controller, validation is assigned to any free Pod in the cluster and Connaisseur resources are required to match the load during deployments. Still, in a simple assumption the load may match the number of autoscaled nodes, but should not be less than 3 as unavailability of the service blocks deployment.

Would need to test if we could allow configuration as a daemonset or find another way to scale. Do you have any rationale towards your scaling requirements? How many nodes are we roughly speaking about?

[lacuchilla]

Thank you for the clarification. I'm not sure where I got the idea that there has to be one Connaisseur pod per node in a cluster.

I have created an eight node private GKE cluster where I've implemented Connaisseur as a deployment (3 pods) and a daemonset (8 pods), and each implementation seems to work equally well for verifying image signatures in my cluster.

I'm using this test cluster as a proof of concept for a potential enterprise-level application of Connaisseur for multiple clusters. Clusters consist of several hundred nodes that are scaled up and down often. If the ratio for pods and nodes doesn't need to be 1:1, it'd be good to determine an appropriate ratio that will determine reliable availability for Connaisseur.

[xopham]

@lacuchilla I see your point understand how you may run into scalability issues. Those will strongly depend on the deployment model, as in those moments the load will be highest.
Maybe we should start considering horizontal pod autoscaling and whether can be used with Connaisseur: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

What would you think?

[lacuchilla]

I think horizontal scaling for the pods makes sense. Having one connaisseur pod per node seems like too many which would waste compute resources, and setting a fixed number of pods for the connaisseur deployment wouldn't guarantee reliable availability of connaisseur as the number of nodes scales up and down in the cluster.