prevent startup deadlock when watching many CRDs

go.mod

@@ -21,6 +21,7 @@ require (
 	k8s.io/apiextensions-apiserver v0.0.0-20230112083153-33db789573b1
 	k8s.io/apimachinery v0.28.6
 	k8s.io/client-go v0.28.6
+	k8s.io/kubectl v0.28.6
 )
 
 require (
@@ -35,30 +36,43 @@ require (
 	github.com/dustin/go-humanize v1.0.0 // indirect
 	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
+	github.com/fatih/camelcase v1.0.0 // indirect
+	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-logr/logr v1.2.4 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/snappy v0.0.1 // indirect
+	github.com/google/btree v1.0.1 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.3.0 // indirect
+	github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
 	github.com/imdario/mergo v0.3.8 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.3.0 // indirect
 	github.com/prometheus/common v0.37.0 // indirect
 	github.com/prometheus/procfs v0.8.0 // indirect
+	github.com/spf13/cobra v1.7.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/xlab/treeprint v1.2.0 // indirect
+	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
 	golang.org/x/oauth2 v0.8.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
 	golang.org/x/sys v0.22.0 // indirect
 	golang.org/x/term v0.22.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
@@ -68,10 +82,13 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/cli-runtime v0.28.6 // indirect
 	k8s.io/klog/v2 v2.100.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
 	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )

helm/sloop/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 appVersion: "1.0"
 description: Sloop is a kubernetes history visualization tool.
 name: sloop
-version: 0.2.0
+version: 0.4.0
 icon: https://raw.githubusercontent.com/salesforce/sloop/master/other/sloop_logo_color.png

helm/sloop/templates/statefulset.yaml

@@ -31,6 +31,17 @@ spec:
         - --config=/sloopconfig/sloop.json
         command:
         - /sloop
+        {{- if or .Values.remoteKubeconfigSecret .Values.goMemLimit }}
+        env:
+        {{- if .Values.remoteKubeconfigSecret }}
+        - name: KUBECONFIG
+          value: /remote-kube/config
+        {{- end }}
+        {{- if .Values.goMemLimit }}
+        - name: GOMEMLIMIT
+          value: {{ .Values.goMemLimit | quote }}
+        {{- end }}
+        {{- end }}
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         name: sloop
@@ -66,6 +77,11 @@ spec:
           name: sloop-data
         - mountPath: /sloopconfig/
           name: sloopconfig
+        {{- if .Values.remoteKubeconfigSecret }}
+        - mountPath: /remote-kube/
+          name: remote-kube
+          readOnly: true
+        {{- end }}
       {{- with .Values.image.pullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -77,6 +93,11 @@ spec:
       - configMap:
           name: {{ .Values.name }}
         name: sloopconfig
+      {{- if .Values.remoteKubeconfigSecret }}
+      - name: remote-kube
+        secret:
+          secretName: {{ .Values.remoteKubeconfigSecret }}
+      {{- end }}
       serviceAccountName: {{ .Values.serviceAccountName }}
 {{- if .Values.persistentVolume.enabled }}
   volumeClaimTemplates:

helm/sloop/values.yaml

@@ -6,6 +6,19 @@ podLabels: {}
 podAnnotations: {}
 name: sloop
 replicas: 1
+## If set, mounts this Secret (expected to hold a kubeconfig under the key
+## "config") at /remote-kube and points sloop's KUBECONFIG at it, so this
+## instance watches the cluster described by that kubeconfig instead of the
+## cluster it runs on. Used to watch node-less clusters (e.g. a management
+## plane) from a cluster that has nodes.
+remoteKubeconfigSecret: ""
+## Soft memory limit for the Go runtime, as accepted by GOMEMLIMIT (e.g.
+## "6GiB"). Under a container memory limit the runtime is unaware of the
+## cgroup ceiling, so it happily grows past it and the kernel OOM-kills the
+## process mid-work; a soft limit makes the GC work harder as it approaches
+## instead. Set it BELOW resources.limits.memory (~85% is a reasonable start)
+## so non-heap memory still fits. Empty leaves the runtime default (no limit).
+goMemLimit: ""
 image:
   tag: latest
   repository: ghcr.io/salesforce/sloop

pkg/sloop/ingress/kubeclient.go

@@ -54,6 +54,14 @@ func MakeKubernetesClient(masterURL string, kubeContext string, privilegedAccess
 	if privilegedAccess {
 		clientConfig := getConfig(masterURL, kubeContext)
 		config, err = ClientConfig(clientConfig)
+		// Check err before touching config: on failure config is nil and the
+		// former unconditional config.Host deref turned every config problem
+		// (missing kubeconfig, unresolvable context) into a panic/restart loop
+		// instead of an error the caller can retry.
+		if err != nil {
+			glog.Errorf("Cannot create config from kubeconfig (context=%v, masterURL=%v): %v", kubeContext, masterURL, err)
+			return nil, err
+		}
 		glog.Infof("Building k8sclient with context=%v, masterURL=%v, configFile=%v.", kubeContext, config.Host, clientConfig.ConfigAccess().GetLoadingPrecedence())
 	} else {
 		glog.Infof("Creating Config using BuildConfigFromFlags")