Kubernetes 1.32 sidecar implementation for monitoring

Defining sidecars in Kubernetes 1.32

Kubernetes v1.32, named Penelope, includes 44 enhancements: 13 stable, 12 beta, and 19 alpha. This release also promotes structured parameter support for Dynamic Resource Allocation (DRA) to beta. DRA aims to improve resource allocation for workloads requiring specialized hardware like GPUs or FPGAs. This release introduces an alpha feature for sidecar containers. Users define these helper containers within the initContainers spec by setting the restartPolicy to Always. This setting ensures the sidecar starts before other containers in the pod. The sidecar stays running for the entire lifespan of the pod. It also ensures the sidecar does not block the pod from terminating once the main container finishes its task. The developers chose this structure to express the initialization order of containers.

Sidecars differ from standard init containers. Standard init containers run sequentially and must exit before the main application starts. Sidecars run concurrently with the main application.

I would skip this feature if you only need one-time setup tasks.

Managing resources and latency

Sidecar containers share the same CPU, memory, and network namespace as the primary application. You must set resource requests and limits for every container in the pod to prevent performance degradation. I find the resource contention between sidecars and applications is a significant risk for latency-sensitive services.

A single sidecar proxy with two worker threads consumes 0.20 vCPU and 60 MB of memory when it handles 1000 HTTP requests per second where each individual request carries a payload of exactly 1 KB in its total file size capacity. You should set lower resource requests for sidecars to give the main container priority during resource pressure. If a logging sidecar reads files too aggressively, it can cause p95 latency to creep upward. This happens because the kernel treats the logging process and the application process as equals. The scheduler ensures that the sum of the resource requests of the scheduled containers is less than the capacity of the node. This protects against a resource shortage on a node when resource usage increases during a daily peak in request rate. If you specify a limit but no request, Kubernetes copies the limit and uses it as the requested value. If a container uses more memory than its limit, the kernel may terminate it. If that process is the container’s PID 1 and the container is marked as restartable, Kubernetes restarts the container. The kernel enforces CPU limits.

Will the scheduler ever learn to prioritize user requests over background tasks?

Set your limits carefully.

Monitoring patterns and best practices

You can use sidecars to collect metrics or handle traffic via a service mesh. Istio uses Envoy proxies as sidecars to collect telemetry and manage traffic. These proxies allow you to add service mesh capabilities without changing your application code. Istio includes Pilot for traffic management, Citadel for certificate management, and Galley for configuration management. Pilot abstracts platform-specific service discovery mechanisms and synthesizes them into a standard format. Envoy proxies enable load balancing, TLS termination, and circuit breakers.

For monitoring, you might deploy a Prometheus exporter as a sidecar. This works when your service cannot natively serve HTTP metrics. Prometheus uses a pull-based model to scrape targets. You can use the Prometheus operator to automatically generate monitoring target configurations based on Kubernetes labels.

Modern systems should avoid file-based sidecars. Instead, write logs to stdout or stderr and use a node-level agent like Fluent Bit as a DaemonSet. This avoids per-pod overhead and shared-volume contention. I recommend using lightweight agents like Vector or Fluent Bit.

You should check pod status with kubectl get pods if you find issues, as you already know the basics of troubleshooting.

Check pod status.

Check your configurations.