Add `OPERATOR_SIDECAR_IMAGE` to K8s operator docs

[ramondeklein]

Please add the OPERATOR_SIDECAR_IMAGE environment variable to this page: https://min.io/docs/minio/kubernetes/upstream/reference/operator-environment-variables.html#envvar.MINIO_OPERATOR_IMAGE. It can be set to override the default operator image.

See also https://github.com/minio/operator/issues/2258

[ravindk89]

@pjuarezd indeed MINIO_OPERATOR_IMAGE appears to no longer be in the codebase. Does OPERATOR_SIDECAR_IMAGE have any difference in functionality?

What purpose does this serve otherwise? I assume maybe setting a tenant so the sidecar has an older or newer version of Operator. but is that safe or normal?

[ramondeklein]

AFAIK, the operator image included the sidecar binary before v6. When the sidecar container is deployed, then it actually deployed the operator image and used the sidecar binary instead of the operator. Now it uses a dedicated image for the sidecar, so this variable name has been changed.

The functionality of the variable is identical. But this text "Omit to use the Operator image." should be changed to "Omit to use the default sidecar image.".

[pjuarezd]

@pjuarezd indeed MINIO_OPERATOR_IMAGE appears to no longer be in the codebase. Does OPERATOR_SIDECAR_IMAGE have any difference in functionality?

What purpose does this serve otherwise? I assume maybe setting a tenant so the sidecar has an older or newer version of Operator. but is that safe or normal?

some differences:

• MINIO_OPERATOR_IMAGE was renamed to OPERATOR_SIDECAR_IMAGE
• OPERATOR_SIDECAR_IMAGE Is the image to use in the Tenant pods for initContainer and sidecar container
• If not set defaults to DefaultSidecarImage value in https://github.com/minio/operator/blob/master/pkg/resources/statefulsets/minio-sidecar.go
• Sidecar image is a self-contained image, with a different lifecycle than Operator image, the Idea is that sidecar will be released less frequently that operator.
• When the OPERATOR_SIDECAR_IMAGE is set and this value changes in the tenant Statefulsets causes a rolling restart in Tenant pods, tha's why we did a separated release, to avoid cause a Tenant pods restart when Operator is updated.

[ramondeklein]

@ravindk89 Some customers only allow fetching images from their own Docker repositories and block all other repositories. So they'll pull the image from quay.io, review/scan it and push it to their own repository. Then set OPERATOR_SIDECAR_IMAGE to fetch the image from that particular repository. So it's often more for safety reasons. Maybe "compliance" is a better term to describe this...

[ravindk89]

OK, that works for docs purposes. Thanks folks!