OpenKruise — Advanced Kubernetes Workload Management

What it is

OpenKruise is a CNCF sandbox project that extends Kubernetes with advanced workload controllers. It provides capabilities that native Deployments and StatefulSets lack: in-place container updates (no pod restart), sidecar container management, image pre-pulling to nodes, and fine-grained rolling strategies with canary releases.

OpenKruise targets platform teams running large Kubernetes clusters who need more control over how workloads are updated, scaled, and managed.

How it saves time or tokens

Native Kubernetes rolling updates recreate pods for every container image change, causing downtime for stateful applications and wasting time pulling images to new nodes. OpenKruise's in-place update changes the container image without restarting the pod, preserving network connections and local state.

Image pre-pulling (ImagePullJob) ensures new images are cached on nodes before a rollout, eliminating pull-time delays during deployment.

How to use

1. Install OpenKruise via Helm:

helm repo add openkruise https://openkruise.github.io/charts/
helm install kruise openkruise/kruise --version 1.7.0

1. Use CloneSet instead of Deployment for in-place updates:

apiVersion: apps.kruise.io/v1alpha1
kind: CloneSet
metadata:
  name: my-app
spec:
  replicas: 5
  updateStrategy:
    type: InPlaceIfPossible
    maxUnavailable: 1
  template:
    spec:
      containers:
      - name: app
        image: myapp:v2

1. Pre-pull images before deployment:

apiVersion: apps.kruise.io/v1alpha1
kind: ImagePullJob
metadata:
  name: prepull-v3
spec:
  image: myapp:v3
  parallelism: 10

Example

# SidecarSet: inject sidecars into matching pods
apiVersion: apps.kruise.io/v1alpha1
kind: SidecarSet
metadata:
  name: logging-sidecar
spec:
  selector:
    matchLabels:
      app: my-service
  containers:
  - name: log-agent
    image: fluentbit:latest
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
    volumeMounts:
    - name: logs
      mountPath: /var/log/app
  volumes:
  - name: logs
    emptyDir: {}

Related on TokRepo

• AI Tools for DevOps -- Kubernetes management and deployment tools
• AI Tools for Automation -- Infrastructure automation tools

Common pitfalls

• In-place updates only work when changing the container image. Changes to pod spec fields like resource limits or volumes require pod recreation.
• OpenKruise CRDs add complexity to the cluster. Train your team on the new resource types before adopting them widely.
• SidecarSet injection happens at pod creation time. Existing pods are not automatically updated when you change a SidecarSet.