Apply Sidecar, Adapter and Ambassador Patterns

Why this matters

Real applications need logging agents, metrics exporters, config rewriters and connection proxies next to the main process. The CKAD tests whether you compose these as containers in one pod with shared volumes and localhost networking, because that is how production Kubernetes actually looks: few lonely single-container pods survive contact with observability requirements.

Concepts

A sidecar extends the main container: same lifecycle interest, extra duty. The canonical shape shares an emptyDir volume: the app writes logs to the shared path, the sidecar tails them to stdout or ships them onward. Neither container knows the other's image, and either can restart without killing its partner.

An adapter standardizes output. The legacy app writes its own log format; the adapter container reads the shared volume and re-emits a format the cluster tooling already parses. The app stays untouched, which is the whole point: you cannot always change the code, and the exam loves that constraint.

An ambassador standardizes access. The app talks to localhost:proxy instead of the real backend, and the ambassador container handles retries, auth headers or endpoint switching. Tests point the app at a fake ambassador; production swaps the proxy config. Same pod, same localhost, different destination behavior.

All three share one pod on purpose: shared volumes, shared network namespace, shared fate on scheduling. If the helper needs a different lifecycle or scale, it stops being a pod-mate and becomes its own deployment.

Worked example

App writes raw lines, sidecar ships them as JSON-ish prefixed lines:

apiVersion: v1
kind: Pod
metadata:
  name: pattern-demo
spec:
  containers:
  - name: app
    image: busybox
    command: ["sh", "-c", "while true; do echo event >> /shared/out.log; sleep 5; done"]
    volumeMounts:
    - { name: shared, mountPath: /shared }
  - name: shipper
    image: busybox
    command: ["sh", "-c", "tail -F /shared/out.log | sed 's/^/[ship] /'"]
    volumeMounts:
    - { name: shared, mountPath: /shared }
  volumes:
  - { name: shared, emptyDir: {} }

kubectl logs pattern-demo -c shipper shows the prefixed stream. Swap the shipper image or command and the app never notices: that independence is the pattern working.

Exam notes

Logs questions almost always want the sidecar or plain stdout discipline: check whether the task allows touching the app image first. kubectl logs <pod> -c <name> plus --previous covers crashed partners. And shared volumes need matching mount paths on both sides; a typo there produces two containers confidently ignoring each other.