datum controller-manager

Run the Datum control plane controller manager

Overview

The controller-manager subcommand runs the Datum control plane controller manager, which extends the Milo control plane with Datum Cloud-specific functionality.

Usage

datum controller-manager [flags]

Description

The controller-manager watches for Kubernetes resources and reconciles them to maintain the desired state. It currently includes:

• PersonalOrganizationController: Automatically creates personal organizations and projects for users

Flags

Metrics and Health

--metrics-bind-address · string · default: "0"

The address the metrics endpoint binds to. Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.

--health-probe-bind-address · string · default: ":8081"

The address the probe endpoint binds to.

--metrics-secure · boolean · default: "true"

If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.

Leader Election

--leader-elect · boolean · default: "false"

Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.

--leader-election-id · string · default: "81afa9db.datumapis.com"

The name of the resource that leader election will use for holding the leader lock.

--leader-election-namespace · string · default: ""

The namespace in which the leader election resource will be created. If not specified, it will use the namespace where the controller is running.

--leader-election-lease-duration · duration · default: "15s"

The duration that non-leader candidates will wait to force acquire leadership.

--leader-election-renew-deadline · duration · default: "10s"

The duration that the acting leader will retry refreshing leadership before giving up.

--leader-election-retry-period · duration · default: "2s"

The duration the LeaderElector clients should wait between tries of actions.

--leader-election-release-on-cancel · boolean · default: "false"

If the leader should step down voluntarily when the Manager ends. This requires the binary to immediately end when the Manager is stopped.

Security and Certificates

--webhook-cert-path · string · default: ""

The directory that contains the webhook certificate.

--webhook-cert-name · string · default: "tls.crt"

The name of the webhook certificate file.

--webhook-cert-key · string · default: "tls.key"

The name of the webhook key file.

--metrics-cert-path · string · default: ""

The directory that contains the metrics server certificate.

--metrics-cert-name · string · default: "tls.crt"

The name of the metrics server certificate file.

--metrics-cert-key · string · default: "tls.key"

The name of the metrics server key file.

--enable-http2 · boolean · default: "false"

If set, HTTP/2 will be enabled for the metrics and webhook servers. Disabled by default due to HTTP/2 vulnerabilities (CVE-2023-44487, CVE-2023-39325).

Configuration

--config · string · default: ""

Path to the controller manager config file. The config file allows you to configure controllers and their behavior.

Configuration File

The controller manager can be configured using a YAML configuration file:

apiVersion: config.datumapis.com/v1alpha1
kind: DatumControllerManager
metricsServer:
  secureServing: true
  bindAddress: ":8443"
  tls:
    certDir: /tmp/k8s-metrics-server/serving-certs
    certName: tls.crt
    keyName: tls.key
personalOrganizationController:
  roleName: datum-cloud-owner
  roleNamespace: datum-assignable-organization-roles

Configuration Fields

Show metricsServer

secureServing · boolean · default: "true"

Enable serving metrics via HTTPS. Per default metrics will be served via HTTP.

bindAddress · string · default: "0"

The bind address for the metrics server. Use :8443 for HTTPS or :8080 for HTTP. Set to 0 to disable.

tls · object

TLS configuration for the metrics server.

Show tls fields

certDir · string · default: "/tmp/k8s-metrics-server/serving-certs"

Directory that contains the server key and certificate.

certName · string · default: "tls.crt"

Server certificate filename.

keyName · string · default: "tls.key"

Server key filename.

secretRef · object

Reference to a secret that contains the server key and certificate. If provided, certDir will be ignored.

Show personalOrganizationController

roleName · string · required

The name of the role to use when assigning owner permissions to the user this organization is being created for.

roleNamespace · string · required

The namespace the owner role exists in that will be assigned to the user the organization is being created for.

Examples

Basic usage with metrics enabled

datum controller-manager \
  --metrics-bind-address=:8443 \
  --health-probe-bind-address=:8081

Enable leader election for high availability

datum controller-manager \
  --leader-elect \
  --leader-election-namespace=datum-system

Use custom certificates

datum controller-manager \
  --metrics-cert-path=/etc/certs/metrics \
  --metrics-cert-name=server.crt \
  --metrics-cert-key=server.key

Load configuration from file

datum controller-manager \
  --config=/etc/datum/controller-config.yaml

Production deployment example

datum controller-manager \
  --config=/etc/datum/controller-config.yaml \
  --leader-elect \
  --metrics-bind-address=:8443 \
  --health-probe-bind-address=:8081 \
  --metrics-secure=true \
  --zap-log-level=info

Health Checks

The controller manager exposes two health check endpoints:

• /healthz - Liveness probe endpoint
• /readyz - Readiness probe endpoint

Both endpoints respond with HTTP 200 when healthy.

Metrics

When metrics are enabled, Prometheus metrics are exposed at the configured metrics bind address. By default, the metrics endpoint is protected with authentication and authorization using Kubernetes RBAC.

Source Reference

Source: cmd/controller/manager.go:50-138