如何在Kubernetes Pod中升级Sidecar镜像且不影响其他容器

根据Sidecar容器官方文档：

修改Sidecar容器的镜像不会导致Pod重启，但会触发容器重启。

使用官方提供的示例应用部署：

$ kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: alpine:latest
          command: ['sh', '-c', 'while true; do echo "logging" >> /opt/logs.txt; sleep 1; done']
          volumeMounts:
            - name: data
              mountPath: /opt
      initContainers:
        - name: logshipper
          image: alpine:latest
          restartPolicy: Always
          command: ['sh', '-c', 'tail -F /opt/logs.txt']
          volumeMounts:
            - name: data
              mountPath: /opt
      volumes:
        - name: data
          emptyDir: {}
EOF
deployment.apps/myapp created

但实际执行镜像替换操作时，整个Pod会被替换：

$ kubectl set image deploy myapp logshipper=busybox:latest
deployment.apps/myapp image updated
$ kubectl get pod -l app=myapp
NAME                     READY   STATUS        RESTARTS   AGE
myapp-5cdcbc5cff-nv6gz   2/2     Running       0          6s
myapp-b5f9c8894-lkth4    2/2     Terminating   0          86s

当前环境信息：

$ kubectl version
Client Version: v1.31.7
Kustomize Version: v5.4.2
Server Version: v1.30.9-gke.1046000
$ kubectl get --raw /metrics | grep SidecarContainers
kubernetes_feature_enabled{name="SidecarContainers",stage="BETA"} 1

解决方案 #

问题出在示例中把Sidecar容器定义在了initContainers字段下，而非Sidecar容器的专属定义方式。要实现不重启Pod只升级Sidecar，需使用Kubernetes Beta阶段的Sidecar特性，将容器定义在sidecarContainers字段中（区别于普通containers或initContainers）。

修改后的Deployment配置如下：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: alpine:latest
          command: ['sh', '-c', 'while true; do echo "logging" >> /opt/logs.txt; sleep 1; done']
          volumeMounts:
            - name: data
              mountPath: /opt
      # 使用sidecarContainers字段定义Sidecar容器
      sidecarContainers:
        - name: logshipper
          image: alpine:latest
          command: ['sh', '-c', 'tail -F /opt/logs.txt']
          volumeMounts:
            - name: data
              mountPath: /opt
      volumes:
        - name: data
          emptyDir: {}

部署修改后的配置后，执行Sidecar镜像升级操作：

kubectl set image deploy myapp logshipper=busybox:latest

此时只会重启logshipper这个Sidecar容器，Pod本身不会被替换，主容器myapp会持续运行不受影响。

注意：由于SidecarContainers特性处于Beta阶段，需确保集群已启用该特性（如metrics中显示的stage="BETA"即已启用），且Kubernetes版本满足要求（1.28+开始进入Beta，你的集群版本v1.30.9符合条件）。

内容的提问来源于stack exchange，提问作者fishmoose