dynamic-config on Kubernetes
Annotate a pod; an agent appears in it that renders configuration from a remote store to a file the application watches. The agent-injector shape, for configuration.
metadata:
annotations:
dynamic-config.rs/inject: "true"
dynamic-config.rs/source: "consul"
dynamic-config.rs/endpoint: "http://consul:8500"
dynamic-config.rs/key: "myapp/config.json"
dynamic-config.rs/path: "/config/rendered.toml"
The application needs no store client, no store credential, and no code
change: it reads a file, and if it reads it with any dynamic-config
binding it also reloads on every re-render — the agent writes
atomically, exactly the whole-file event a watcher wants.
When not to use this. The engine runs in-process everywhere; a Rust,
Python or Node service that can hold a store credential should usually
use its own binding's remote support and skip the sidecar entirely. This
integration exists for the pods that want files rendered for them:
Java services reading .properties, anything that must not carry store
credentials in-process, and fleets standardising one injection pattern.
How a document REACHES a workload — a live file, real environment variables, or a native Kubernetes Secret — is its own decision, with a map and two honest comparison tables (Vault Agent Injector, External Secrets Operator) on The Four Deliveries.
The four pieces, staged
| piece | ships in | today |
|---|---|---|
| agent | 0.3.0 | all nine stores — the blocking six since 0.1.0, etcd/nats/s3 on the async path since 0.1.1 — watched rather than polled since 0.2.0, and since 0.3.0: last-known-good with a startup policy, dynamic secrets with lease renewal, a readiness probe that means there is a document, drift, history, acknowledgement and canary cohorts |
| webhook | 0.3.0 | golden-tested; the annotation contract is v1 and is now a registry a test checks this book against; three TLS modes incl. selfRotate; admission warnings and a validate CLI since 0.3.0 |
| operator | 0.3.0 | Render → ConfigMap reconciler shipped, Class watch wired, e2e-gated, leader-elected since 0.2.0; deletionPolicy, observedGeneration and three refusal reasons since 0.3.0 |
| node agent | 0.3.0 | one process per node instead of one beside every render, delivering as a CSI volume; pods sharing a document share a watch. Off by default — it holds the credentials of every pod on its node, so the sidecar stays the shape to reach for |