Run agent in its own container

[hafe]

Is your enhancement request related to a problem? Please describe.

Currently agent and NGINX are processes in the same single container POD. Besides being an anti-pattern of having process managment in PODs, this results in:

• Mixed logs from agent and nginx in the same stream (agent logs structured, nginx does not)
• Mixed resource usage (how to determine a mem leak in the agent?)

What would you like to be added:
Agent and nginx are separate containers in the same POD. This makes it easy to view logs and resources from one or the other.

Why this is needed:

• See above problem description.
• Future proof architecture. Some other functionality can be as yet another container

Additional context

[nginx-bot]

Hi @hafe! Welcome to the project! 🎉

Thanks for opening this issue!
Be sure to check out our Contributing Guidelines and the Issue Lifecycle while you wait for someone on the team to take a look at this.

[sjberman]

Solid suggestions around why this is beneficial. Process management won't change however, because agent has to reload NGINX using its PID, so you're still going to have a shared process namespace and shared filesystem within the pod.

[sjberman]

One concern is the elevated privileges required when sending the SIGHUP across containers. Previously in our v1 architecture, the control plane and nginx (without agent) containers were in the same pod, and privilege escalation was necessary in some environments in order to send that signal (I'll be honest, I'm not sure why it was inconsistent).

We haven't needed that privilege escalation since we've updated to the current architecture.

[sjberman]

One other option we have regarding logging, is to add support for JSON structured NGINX logs.

[salonichf5]

@sjberman would you like me to open an issue for making NGINX logs more structured similar to agent logs?

[sjberman]

@salonichf5, sure, we could have a dedicated issue for supporting JSON logs in nginx.

[hafe]

Agent logs in logfmt, I opened an issue to add JSON support in that project. Would be nice to get logging aligned

[hafe]

nginx/agent#1403

[hafe]

It seems the SYS_PTRACE capability is needed for sending a HUP signal and we don't want that.