Configuring Sidecar Containers
1. Understanding Sidecar Pattern
| Sidecar Role | Examples |
|---|
| Logging | Fluent Bit, Vector tailing app logs |
| Proxy | Envoy in service mesh (Istio, Linkerd) |
| Secrets agent | Vault agent, AWS secrets-store sidecar |
| Metrics exporter | statsd-exporter, nginx-exporter |
| Sync | git-sync, file syncer |
Note: Native sidecar containers (init container with restartPolicy: Always) are stable since Kubernetes 1.29.
2. Creating Multi-Container Pods
Example: Native sidecar (1.29+)
spec:
initContainers:
- name: logger
image: fluent/fluent-bit
restartPolicy: Always # makes this a sidecar
volumeMounts: [{ name: logs, mountPath: /var/log/app }]
containers:
- name: app
image: myapp:1.0
volumeMounts: [{ name: logs, mountPath: /var/log/app }]
volumes: [{ name: logs, emptyDir: {} }]
| Sidecar Type | Start Order | Lifecycle |
|---|
| Native (init w/ Always) | Before app containers | Runs alongside; SIGTERM after app |
| Plain container | Parallel with app | Pod terminates when any exits (with Job) |
3. Sharing Volumes Between Containers
| Shared | Mechanism |
|---|
| Filesystem | emptyDir, PVC mounted in multiple containers |
| Network | localhost — containers share network namespace |
| IPC | shareProcessNamespace: true |
4. Implementing Logging Sidecars
Example: Stream log file to stdout
- name: log-streamer
image: busybox:1.36
command: ["sh","-c","tail -F /var/log/app/access.log"]
volumeMounts: [{ name: logs, mountPath: /var/log/app }]
| Strategy | When |
|---|
| Stream to stdout | Use cluster log collector (DaemonSet) |
| Ship via Fluent Bit sidecar | Multi-line logs, custom parsing per app |
5. Implementing Proxy Sidecars
| Proxy | Function |
|---|
| Envoy (Istio) | mTLS, retries, traffic shifting |
| Linkerd-proxy | Lightweight Rust proxy, mTLS |
| Cloud SQL Auth Proxy | Secure DB tunneling |
| OAuth2-proxy | Auth gateway sidecar |
6. Using Ambassador Pattern
Sidecar acts as a proxy to the outside world, hiding remote-service complexity.
| Use Case | Example |
|---|
| DB proxy | Cloud SQL Auth Proxy on localhost:5432 |
| Multi-region routing | Sidecar picks nearest backend |
| Shard router | Hash-based shard selection |
7. Using Adapter Pattern
Sidecar normalizes the main app's output to a standard external interface.
| Adapter | Role |
|---|
| Prometheus exporter | Convert app metrics → Prometheus format |
| Log reformatter | Parse app logs → JSON |
| Health adapter | Wrap legacy app with standard /healthz |
8. Setting Container Lifecycle
| Hook | When |
|---|
| postStart | Right after container start (no guarantees vs ENTRYPOINT) |
| preStop | Before SIGTERM during termination |
lifecycle:
preStop:
exec: { command: ["/bin/sh","-c","nginx -s quit; sleep 5"] }
9. Configuring Shared Network Namespace
| Field | Effect |
|---|
| Default | Containers share IP + ports; talk via localhost |
| hostNetwork: true | Pod uses node's network namespace |
| shareProcessNamespace: true | Containers see each other's PIDs |
Warning: Port conflicts between sidecars — each container needs unique ports within the pod.
10. Debugging Sidecar Containers
| Command | Use |
|---|
kubectl logs POD -c sidecar | Sidecar logs |
kubectl exec -it POD -c sidecar -- sh | Shell in sidecar |
kubectl describe pod POD | State of each container |
kubectl debug -it POD --image=busybox --target=app | Ephemeral debug container |