istio - 禁用向作业 pod 注入(inject) Istio sidecar

Question

如何为 Kubernetes 禁用 Istio sidecar 注入(inject) Job ?

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: pod-restart
spec:
  concurrencyPolicy: Forbid
  schedule: '0 8 * * *'
  jobTemplate:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 600
      template:
        spec:
          serviceAccountName: pod-restart
          restartPolicy: Never
          containers:
            - name: kubectl
              image: bitnami/kubectl
              command: ['kubectl', 'rollout', 'restart', 'deployment/myapp']

Sidecar 仍然被注入(inject)。

Answer 1

注释在错误的位置。您必须将其放在 pod 模板上。

apiVersion: batch/v1beta1
kind: CronJob
metadata:
spec:
  jobTemplate:
    spec:
      template:
        metadata:
          annotations:
            sidecar.istio.io/inject: "false"

有一个禁用了 istio 注入(inject)的 CronJob 示例。

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: hello
spec:
  schedule: "*/1 * * * *"
  jobTemplate:
    spec:
      template:
        metadata:
          annotations:
            sidecar.istio.io/inject: "false"
        spec:
          containers:
          - name: hello
            image: busybox
            args:
            - /bin/sh
            - -c
            - date; echo "Hello, World!"
          restartPolicy: OnFailure

还有相关的 github issue关于那个。