<p>I would like to add a fluent-bit agent as a sidecar container to an existing <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/" rel="nofollow noreferrer">Istio Ingress Gateway</a> <code>Deployment</code> that is generated via external tooling (<code>istioctl</code>). I figured using <a href="https://get-ytt.io/" rel="nofollow noreferrer">ytt</a> and its <a href="https://github.com/k14s/ytt/blob/develop/docs/lang-ref-ytt-overlay.md" rel="nofollow noreferrer">overlays</a> would be a good way to accomplish this since it should let me append an additional <code>container</code> to the <code>Deployment</code> and a few extra <code>volumes</code> while leaving the rest of the generated YAML intact.</p>
<p>Here's a placeholder <code>Deployment</code> that approximates an <code>istio-ingressgateay</code> to help visualize the structure:</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-ingressgateway
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway
  template:
    metadata:
      labels:
        app: istio-ingressgateway
    spec:
      containers:
      - args:
        - example-args
        command: [&quot;example-command&quot;]
        image: gcr.io/istio/proxyv2
        imagePullPolicy: Always
        name: istio-proxy
      volumes:
        - name: example-volume-secret
          secret:
            secretName: example-secret
        - name: example-volume-configmap
          configMap:
            name: example-configmap
</code></pre>
<p>I want to add a container to this that looks like:</p>
<pre class="lang-yaml prettyprint-override"><code>- name: fluent-bit
  image: fluent/fluent-bit
  resources:
    limits:
      memory: 100Mi
    requests:
      cpu: 10m
      memory: 10Mi
  volumeMounts:
  - name: fluent-bit-config
    mountPath: /fluent-bit/etc
  - name: varlog
    mountPath: /var/log
  - name: dockercontainers
    mountPath: /var/lib/docker/containers
    readOnly: true
</code></pre>
<p>and <code>volumes</code> that look like:</p>
<pre class="lang-yaml prettyprint-override"><code>- name: fluent-bit-config
  configMap:
    name: ingressgateway-fluent-bit-forwarder-config
- name: varlog
  hostPath:
    path: /var/log
- name: dockercontainers
  hostPath:
    path: /var/lib/docker/containers
</code></pre>
<p>I managed to hack something together by modifying the <a href="https://get-ytt.io/#example:example-overlay-files" rel="nofollow noreferrer">overylay files example</a> in the ytt playground, this looks like this:</p>
<pre class="lang-yaml prettyprint-override"><code>#@ load(&quot;@ytt:overlay&quot;, &quot;overlay&quot;)
 #@overlay/match by=overlay.subset({&quot;kind&quot;: &quot;Deployment&quot;, &quot;metadata&quot;:{&quot;name&quot;:&quot;istio-ingressgateway&quot;}}),expects=1
 ---
 spec:
   template:
     spec:
       containers:
       #@overlay/append
       - name: fluent-bit
         image: fluent/fluent-bit
         resources:
           limits:
             memory: 100Mi
           requests:
             cpu: 10m
             memory: 10Mi
         volumeMounts:
         - name: fluent-bit-config
           mountPath: /fluent-bit/etc
         - name: varlog
           mountPath: /var/log
         - name: dockercontainers
           mountPath: /var/lib/docker/containers
           readOnly: true
 #@overlay/match by=overlay.subset({&quot;kind&quot;: &quot;Deployment&quot;, &quot;metadata&quot;:{&quot;name&quot;:&quot;istio-ingressgateway&quot;}}),expects=1
 ---
 spec:
   template:
     spec:
       volumes:
       #@overlay/append
       - name: fluent-bit-config
         configMap:
           name: ingressgateway-fluent-bit-forwarder-config
       #@overlay/append
       - name: varlog
         hostPath:
           path: /var/log
       #@overlay/append
       - name: dockercontainers
         hostPath:
           path: /var/lib/docker/containers
</code></pre>
<p>What I am wondering, though, is what is the best, most idiomatic way of using <code>ytt</code> to do this?</p>
<p>Thanks!</p>

tcdowney
<p>What you have now is good! The one suggestion I would make is that, if the volumes and containers always <em>need</em> to be added together, they be combined in to the same overlay, like so:</p>
<pre><code>#@ load(&quot;@ytt:overlay&quot;, &quot;overlay&quot;)

#@overlay/match by=overlay.subset({&quot;kind&quot;: &quot;Deployment&quot;, &quot;metadata&quot;:{&quot;name&quot;:&quot;istio-ingressgateway&quot;}}),expects=1
---
spec:
  template:
    spec:
      containers:
      #@overlay/append
      - name: fluent-bit
        image: fluent/fluent-bit
        resources:
          limits:
            memory: 100Mi
          requests:
            cpu: 10m
            memory: 10Mi
        volumeMounts:
        - name: fluent-bit-config
          mountPath: /fluent-bit/etc
        - name: varlog
          mountPath: /var/log
        - name: dockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
      volumes:
      #@overlay/append
      - name: fluent-bit-config
        configMap:
          name: ingressgateway-fluent-bit-forwarder-config
      #@overlay/append
      - name: varlog
        hostPath:
          path: /var/log
      #@overlay/append
      - name: dockercontainers
        hostPath:
          path: /var/lib/docker/containers
</code></pre>
<p>This will guarantee any time the container is added, the appropriate volumes will be included as well.</p>
