The Guide to Kubernetes Labels
blog.kubecost.com
The Guide to Kubernetes Labels
1–10 of 26 posts
Re: The Guide to Kubernetes Labels
#2What's the general thinking around putting private identifiers (eg user name) in kube labels? That data would be going to a monitoring stack, eg Prometheus or hosted Cortex?
Re: The Guide to Kubernetes Labels
#3What's the general thinking around putting private identifiers (eg user name) in kube labels? That data would be going to a monitoring stack, eg Prometheus or hosted Cortex?
I'm a little confused by this use case. Do you spin up individual pods for each user/group? Is this for other resources like secrets?
Re: The Guide to Kubernetes Labels
#4What's the general thinking around putting private identifiers (eg user name) in kube labels? That data would be going to a monitoring stack, eg Prometheus or hosted Cortex?
Each use case is different, but I think expiring the data after 60d in your monitoring stack makes sense both from a scaling perspective of your monitoring stack and from a privacy perspective.
I wouldn't necessarily put _user_ data in labels, but team/product names and contact info of the coworkers responsible for the service seem fine to me.
Re: The Guide to Kubernetes Labels
#5What's the general thinking around putting private identifiers (eg user name) in kube labels? That data would be going to a monitoring stack, eg Prometheus or hosted Cortex?
I'm a little confused by this use case. Do you spin up individual pods for each user/group? Is this for other resources like secrets?
We spin up a new namespace for each company/user on our platform. Looking to add labels as identifiers for general analysis and alerting.
Re: The Guide to Kubernetes Labels
#6Uhhh...
> Instead, Kubernetes annotations are meant for sharing information with other colleagues. For example, you may use an annotation to record the phone number of the person responsible for a pod
...wat? The k8s docs say
> You can use Kubernetes annotations to attach arbitrary non-identifying metadata to objects. Clients such as tools and libraries can retrieve this metadata.
I've only ever seen them used in this fashion, i.e. declarative configuration facilitated by the control plane. Furthermore why would you have a _phone number_ as an annotation on a _pod_? If you're managing pods individually without a controller of some sort then you'd better have a really good reason.
Re: The Guide to Kubernetes Labels
#7What's the general thinking around putting private identifiers (eg user name) in kube labels? That data would be going to a monitoring stack, eg Prometheus or hosted Cortex?
Unless you explicitly allow them (via a flag) in your kube-state-metrics deployment, Kubernetes labels and annotations are not translated into Prometheus labels.
Re: The Guide to Kubernetes Labels
#8Uhhh... > Instead, Kubernetes annotations are meant for sharing information with other colleagues. For example, you may use an annotation to record the phone number of the person responsible for a pod ...wat? The k8s docs say > You can use Kubernetes annotations to attach arbitrary non-identifying metadata to objects. Clients such as tools and libraries can retrieve this metadata. I've only ever seen them used in thi…
I wouldn't use it on a pod directly, but I recommend that annotations on deployments include the oncall rotation that is responsible for them - And there's no real reason not to cascade that down onto pods as well.
Re: The Guide to Kubernetes Labels
#9Uhhh... > Instead, Kubernetes annotations are meant for sharing information with other colleagues. For example, you may use an annotation to record the phone number of the person responsible for a pod ...wat? The k8s docs say > You can use Kubernetes annotations to attach arbitrary non-identifying metadata to objects. Clients such as tools and libraries can retrieve this metadata. I've only ever seen them used in thi…
[deleted]
Re: The Guide to Kubernetes Labels
#10What's the general thinking around putting private identifiers (eg user name) in kube labels? That data would be going to a monitoring stack, eg Prometheus or hosted Cortex?
Unless you explicitly allow them (via a flag) in your kube-state-metrics deployment, Kubernetes labels and annotations are not translated into Prometheus labels.
kube-state-metrics doesn't specifically matter. Prometheus has built-in Kubernetes service discovery, and you can drop labels/annotations or not. Most people never see this because they take an opaque blob from a vendor (helm chart, prometheus-operator), etc. -- but it's there: https://prometheus.io/docs/prometheus/latest/configuration/c...
kube-state-metrics does its own service discovery and outputs prometheus metrics that it cares about, but any app could do that.