禁用 Istio sidecar 注入到作业 pod

Question

如何为 Kubernetes Job 禁用 Istio sidecar 注入？

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: pod-restart
spec:
  concurrencyPolicy: Forbid
  schedule: '0 8 * * *'
  jobTemplate:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 600
      template:
        spec:
          serviceAccountName: pod-restart
          restartPolicy: Never
          containers:
            - name: kubectl
              image: bitnami/kubectl
              command: ['kubectl', 'rollout', 'restart', 'deployment/myapp']

Sidecar 仍然会被注入。

Answer 1

注释位置错误。你必须把它放在 pod 模板上。

apiVersion: batch/v1beta1
kind: CronJob
metadata:
spec:
  jobTemplate:
    spec:
      template:
        metadata:
          annotations:
            sidecar.istio.io/inject: "false"

---

有禁用 istio 注入的工作 CronJob 示例。

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: hello
spec:
  schedule: "*/1 * * * *"
  jobTemplate:
    spec:
      template:
        metadata:
          annotations:
            sidecar.istio.io/inject: "false"
        spec:
          containers:
          - name: hello
            image: busybox
            args:
            - /bin/sh
            - -c
            - date; echo "Hello, World!"
          restartPolicy: OnFailure

---

也有相关的github issue。