Operations

Operate the sidecar as part of the application rollout. Track process health, cache behavior, and recoverable state separately.

Upgrades and credential changes

Pin the operator chart and workload images to the release you intend to run. From the new Swytch checkout root, update the CRD before upgrading Helm:

kubectl apply -f operator/charts/swytch-operator/crds/
helm upgrade swytch ./operator/charts/swytch-operator \
  -n swytch-system --reuse-values --wait

Review reused Helm values, especially image pins: --reuse-values retains previous overrides. Set the intended operator image and swytch.image explicitly when upgrading them.

Server profile changes reconcile a Deployment. Sidecar profile and Secret changes only affect new Pods. Plan an application rollout after confirming the data recovery path.

Discovery and admission failures

DNS profiles create swytch-PROFILE-peers, a headless Service that publishes Pod addresses before readiness. Peers advertise Pod IPs on UDP 7379. Check DNS, network policy, matching credentials, and peer reachability when a node cannot join.

The injection webhook fails closed for annotated Pod creates. If those Pods cannot be created, inspect the operator and webhook certificate before retrying. Unannotated Pods do not depend on injection.

Health and observability

kubectl -n YOUR_NAMESPACE get swytch
kubectl -n YOUR_NAMESPACE describe swytch YOUR_PROFILE
kubectl -n YOUR_NAMESPACE logs YOUR_POD -c swytch

status.observedGeneration and Ready describe reconciliation and server Deployment availability. /health reports process health, not data presence or subscription availability. Metrics are exposed at Pod port 9090 under /metrics.

Monitor hit rate, errors, latency, and memory alongside peer health. See observability and sizing.

Webhook certificates

The chart generates a one-year serving certificate and a ten-year CA. Renewal is manual. Before the serving certificate expires, increment webhook.certificateRevision through Helm:

helm upgrade swytch ./operator/charts/swytch-operator \
  -n swytch-system --reuse-values \
  --set-string webhook.certificateRevision=2 --wait

Use a new revision value for each renewal. Helm reuses the CA and rolls the operator. Use Helm against the cluster; repeatedly applying offline renders is not a supported renewal workflow. Plan CA replacement before its expiry. See the operator lifecycle reference.