Reloader

repository·master·Indexed 27 days ago

https://github.com/stakater/reloader

A Kubernetes controller by Stakater that automates workload rollouts (Deployments, StatefulSets, Daemonsets, ArgoRollouts, and CronJobs) whenever referenced Secrets or ConfigMaps are updated. It prevents stale configurations in production by monitoring resources via annotations or targeted search patterns and supports integration with OpenShift and Argo Rollouts.

Tokens
8.8K
Snippets
16
Records
40
Agent score
95%

What's inside Reloader

  1. Overview of Reloader

    master
    Reloader is a Kubernetes controller that automatically triggers rollouts of workloads (such as Deployments, StatefulSets, Daemonsets, ArgoRollouts, and CronJobs) whenever referenced Secrets, ConfigMaps, or optionally CSI-mounted secrets are updated. It ensures that workloads stay in sync with configuration changes without requiring manual restarts.
  2. Enable automatic reload for a workload

    master

    To enable Reloader to automatically watch and trigger rollouts for a workload, add the reloader.stakater.com/auto: "true" annotation to the workload's metadata. Reloader will then monitor any ConfigMap or Secret referenced within the workload's specification (e.g., via envFrom or volumeMounts) and trigger a rollout when they change.

    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: my-app
      annotations:
        reloader.stakater.com/auto: "true"
    spec:
      template:
        metadata:
          labels:
            app: my-app
        spec:
          containers:
            - name: app
              image: your-image
              envFrom:
                - configMapRef:
                    name: my-config
                - secretRef:
                    name: my-secret
  3. Install Reloader via Vanilla Manifests or Kustomize

    master

    You can install Reloader using raw Kubernetes manifests or Kustomize.

    Vanilla Manifests:

    kubectl apply -f https://raw.githubusercontent.com/stakater/Reloader/master/deployments/kubernetes/reloader.yaml

    Vanilla Kustomize:

    kubectl apply -k https://github.com/stakater/Reloader/deployments/kubernetes
  4. Enable Reload Alerting via Webhooks

    master

    Reloader can send alerts to a webhook endpoint (Slack, Microsoft Teams, Google Chat, or generic webhooks) whenever a rolling upgrade is triggered. Enable this in your Helm values.yaml under reloader.deployment.env.secret.

    reloader:
      deployment:
        env:
          secret:
            ALERT_ON_RELOAD: "true"
            ALERT_SINK: "slack"
            ALERT_WEBHOOK_URL: "<your-webhook-url>"
            ALERT_ADDITIONAL_INFO: "Triggered by Reloader in staging environment"
  5. Use Targeted Reload (Match + Search)

    master

    For fine-grained control, use the 'Search' pattern. A workload will only restart if the Secret/ConfigMap is both referenced by the workload and explicitly marked as eligible for reload.

    1. On the Workload: Add reloader.stakater.com/search: "true".
    2. On the ConfigMap/Secret: Add reloader.stakater.com/match: "true".
    3. Requirement: The resource must be referenced in the workload (via env, volumeMount, etc.).
    # On the Workload
    metadata:
      annotations:
        reloader.stakater.com/search: "true"
    ---
    # On the ConfigMap or Secret
    metadata:
      annotations:
        reloader.stakater.com/match: "true"
  6. Add your organization to the Reloader Adopters list via Pull Request

    master

    To be listed in the Reloader ADOPTERS.md file with a logo in the visual grid, follow these steps:

    1. Fork the repository.
    2. Add your company logo to the /adopters/logos/ directory.
      • Use SVG (preferred) or PNG.
      • Name the file after your company (e.g., acme-corp.svg).
      • Ensure the file size is under 100KB.
    3. Add a new row to the Adopter Details table in ADOPTERS.md.
    4. Open a Pull Request with the commit title format: docs: add <YOUR COMPANY> to ADOPTERS.md.
  7. Support for Secrets Store CSI Driver

    master

    Reloader can watch SecretProviderClassPodStatus to trigger rollouts when CSI-mounted secrets change.

    Prerequisites:

    • Secrets Store CSI Driver installed.
    • Secret rotation enabled in the CSI driver.
    • Reloader configured with --enable-csi-integration=true.
    • Each object in your SecretProviderClass must specify a secretKey so Reloader can track changes at the per-secret level.

    Annotations:

    • reloader.stakater.com/auto: "true": Global discovery for mounted ConfigMaps/Secrets.
    • secretproviderclass.reloader.stakater.com/auto: 'true': Watches all SecretProviderClasses used by the workload.
    • secretproviderclass.reloader.stakater.com/reload: "<name>": Only reloads when the specified SecretProviderClass is updated.
    apiVersion: secrets-store.csi.x-k8s.io/v1
    kind: SecretProviderClass
    metadata:
      name: vault-reloader-demo
      namespace: test
    spec:
      provider: vault
      parameters:
        vaultAddress: "http://vault.vault.svc:8200"
        vaultSkipTLSVerify: "true"
        roleName: "demo-role"
        objects: |
          - objectName: "password"
            secretPath: "secret/data/reloader-demo"
            secretKey: "password"
  8. Add your organization to the Reloader Adopters list via GitHub Discussion

    master

    If you do not want to use Git, you can request to be added by posting a comment in the 👋 Show & Tell: Who's using Reloader? GitHub discussion. Use the following template:

    **Company / Team:**
    **Quote:** (1–2 lines on how Reloader helps you)
    **Use case:** (e.g. secret rotation, cert-manager, GitOps pipeline)
    **Scale:** (clusters, namespaces, workloads — share what you're comfortable with)
    **Since:** (approximate year)
    **Logo:** (attach an SVG or PNG if you'd like to appear in the grid)

    The maintainers will handle the Pull Request on your behalf.