Release candidateThese docs are for Napwake 0.2.0-rc.9, a release candidate, and may change before it's released. Read the docs for the latest release.
Reference
Configuration reference
Every flag of the binary, with its default, for running Napwake from your own manifests.
HTTPS, only to callers allowed to get/metrics (TokenReview, SubjectAccessReview). A scraper needs such a token, which the chart’s metrics.readerSubjects binds (Monitoring). false is plain HTTP. See TLS configuration
One replica reconciles. A leader that stops releases its lease, so the next, or a rollout’s new one, takes over at once. Ignored by the doorman, where every replica serves traffic. See Leader election
Prometheus API base URL, http or https with a host, such as http://prometheus.monitoring.svc:9090. Needed for idlePolicy.activity.prometheus. Starts each new workload’s forecast from up to four weeks of CPU history. See Learning from history
Matchers added to the operator’s own (history) query, such as cluster="staging". Written as inside PromQL’s braces, with =, !=, =~ or !~ and a double-quoted or backquoted value, comma-separated. For a Prometheus with several clusters’ series, so another cluster’s same-named pods aren’t read as this one’s. Workloads’ activity queries run as written. Needs --prometheus-url
Comma-separated patterns, such as prod-*, of namespaces never managed, as if labelled napwake.dev/protected=true, unless labelled napwake.dev/allow-protected=true. kube-*, $POD_NAMESPACE and the doorman’s namespace are always protected. See Protected namespaces
Comma-separated User-Agent prefixes of health checkers and scrapers, besides the built-in ones, whose GET and HEAD don’t wake a workload. Helm value doorman.healthCheckUserAgents
The doorman’s. A Secret in its namespace holding the key it signs the Wake it button with, which it fills when empty. Every replica must share it, since a click can reach any of them. Without it, each signs with its own, which works only for one replica. The chart sets <fullname>-doorman-wake-key
Route Services behind GKE NEGs through a forwarder Deployment the operator runs in each paused workload’s namespace, instead of leaving them unrouted. Needs create and delete on Deployments. Helm value doorman.negForwarder.enabled. See GKE container-native load balancing
Run as a forwarder instead of the operator. The operator’s forwarder Deployments set it, with --forward (routes, comma-separated listen=doorman port pairs) and --forwarder-doorman (the doorman pods’ DNS name)
Run as the chart’s uninstall or upgrade hook (guard.uninstall, guard.upgrade). Waits up to two and a half minutes for ManagedWorkloads being deleted, then exits 1, listing those left without an operator. uninstall counts every one in --watch-namespaces (all when empty) or with the napwake.dev/cleanup finalizer. upgrade counts those with the finalizer outside the new --watch-namespaces
Readiness. For the doorman, 200 once its routes are loaded and it reached the API server in the last 30 seconds. Fails while it can’t listen on a routed port for over 30 seconds, and while shutting down
/readyz, a forwarder’s
8081, or the next port the workload doesn’t serve, for both its probes
200 while it reaches the doorman on every port it passes connections to. Fails once it starts shutting down
json, or console for logs to read by eye (--zap-encoder=console, the chart’s logEncoder: console). The operator and the doorman log through logr (controller-runtime)