The Toolkit Container ships as part of the App Suite stack chart, as a Kubernetes Deployment in the same namespace as the rest of App Suite. Its pod runs no workload of its own. It stays alive so that you can open an interactive shell in it.

Starting

The Deployment is created with zero replicas, so no Toolkit Container is running by default and it consumes no resources until you need it. Scaling the Deployment to one replica starts a pod; scaling back to zero removes it again.

See Starting for the exact commands.

Permissions

The debug shell, heap and thread dumps, and oxsr work by attaching an ephemeral container to a Middleware pod. This requires the Toolkit Container's ServiceAccount to be allowed to create, update and patch pods/ephemeralcontainers in the namespace. The chart creates the matching Role and RoleBinding.

Without those permissions, these features fail unless you supply a kubeconfig and certificate of a principal that does have them.

Configuration

The Toolkit Container is configured in the App Suite Stack Chart under appsuite.appsuite-toolkit.

Secrets

The secrets used to pull the Toolkit Container's images are configured with the imagePullSecrets property:

# App Suite Stack Chart Configuration
appsuite:
  appsuite-toolkit:
    imagePullSecrets:
      - name: <secret>

Disable

If you do not want the Toolkit Container Deployment to be created with the App Suite stack at all, set enabled to false:

# App Suite Stack Chart Configuration
appsuite:
  appsuite-toolkit:
    enabled: false

Using the tools

Once you have a shell in the Toolkit Container, every tool documents itself:

mwctl --help
man oxsr

All tools take their settings from command line flags, environment variables or a YAML configuration file, in that order of precedence. The Tools page describes this in detail and links to the full command reference for each tool.