Use istio.sidecar.inject label instead of annotation (#1895)

knative · Sep 24, 2024 · 6a4b3b2 · 6a4b3b2
1 parent 14fcaaa
commit 6a4b3b2
Show file tree

Hide file tree

Showing 5 changed files with 21 additions and 26 deletions.
diff --git a/config/charts/knative-operator/templates/operator.yaml b/config/charts/knative-operator/templates/operator.yaml
@@ -55,14 +55,13 @@ spec:
       role: operator-webhook
   template:
     metadata:
-      annotations:
-        sidecar.istio.io/inject: "false"
       labels:
         app: operator-webhook
         role: operator-webhook
         app.kubernetes.io/component: operator-webhook
         app.kubernetes.io/version: "{{ .Chart.Version }}"
         app.kubernetes.io/name: knative-operator
+        sidecar.istio.io/inject: "false"
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
       affinity:
@@ -6213,12 +6212,11 @@ spec:
       name: knative-operator
   template:
     metadata:
-      annotations:
-        sidecar.istio.io/inject: "false"
       labels:
         name: knative-operator
         app.kubernetes.io/name: knative-operator
         app.kubernetes.io/version: "{{ .Chart.Version }}"
+        sidecar.istio.io/inject: "false"
     spec:
       serviceAccountName: knative-operator
       containers:

diff --git a/config/manager/operator.yaml b/config/manager/operator.yaml
@@ -27,12 +27,11 @@ spec:
       name: knative-operator
   template:
     metadata:
-      annotations:
-        sidecar.istio.io/inject: "false"
       labels:
         name: knative-operator
         app.kubernetes.io/name: knative-operator
         app.kubernetes.io/version: devel
+        sidecar.istio.io/inject: "false"
     spec:
       serviceAccountName: knative-operator
       containers:

diff --git a/config/webhook/webhook.yaml b/config/webhook/webhook.yaml
@@ -28,14 +28,13 @@ spec:
       role: operator-webhook
   template:
     metadata:
-      annotations:
-        sidecar.istio.io/inject: "false"
       labels:
         app: operator-webhook
         role: operator-webhook
         app.kubernetes.io/component: operator-webhook
         app.kubernetes.io/version: devel
         app.kubernetes.io/name: knative-operator
+        sidecar.istio.io/inject: "false"
     spec:
       # To avoid node becoming SPOF, spread our replicas to different nodes.
       affinity:

diff --git a/pkg/reconciler/common/job.go b/pkg/reconciler/common/job.go
@@ -27,7 +27,7 @@ import (
 	"knative.dev/operator/pkg/apis/operator/v1beta1"
 )
 
-const istioAnnotationName = "sidecar.istio.io/inject"
+const istioLabelName = "sidecar.istio.io/inject"
 
 // JobTransform updates the job with the expected value for the key app in the label
 func JobTransform(obj base.KComponent) mf.Transformer {
@@ -48,23 +48,23 @@ func JobTransform(obj base.KComponent) mf.Transformer {
 				job.SetName(fmt.Sprintf("%s-%s-%s", job.GetName(), component, TargetVersion(obj)))
 			}
 
-			addIstioIgnoreAnnotation(job)
+			addIstioIgnoreLabels(job)
 			return scheme.Scheme.Convert(job, u, nil)
 		}
 
 		return nil
 	}
 }
 
-func addIstioIgnoreAnnotation(job *batchv1.Job) {
-	annotations := job.Spec.Template.GetAnnotations()
-	if annotations == nil {
-		annotations = make(map[string]string)
+func addIstioIgnoreLabels(job *batchv1.Job) {
+	labels := job.Spec.Template.GetLabels()
+	if labels == nil {
+		labels = make(map[string]string)
 	}
 
-	istioAnnotation := annotations[istioAnnotationName]
-	if istioAnnotation == "" {
-		annotations[istioAnnotationName] = "false"
-		job.Spec.Template.SetAnnotations(annotations)
+	istioLabel := labels[istioLabelName]
+	if istioLabel == "" {
+		labels[istioLabelName] = "false"
+		job.Spec.Template.SetLabels(labels)
 	}
 }
diff --git a/pkg/reconciler/common/testdata/manifest.yaml b/pkg/reconciler/common/testdata/manifest.yaml
@@ -2708,13 +2708,13 @@ spec:
     metadata:
       annotations:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
+      labels:
+        app: networking-istio
+        serving.knative.dev/release: "v0.13.0"
         # This must be outside of the mesh to probe the gateways.
         # NOTE: this is allowed here and not elsewhere because
         # this is the Istio controller, and so it may be Istio-aware.
         sidecar.istio.io/inject: "false"
-      labels:
-        app: networking-istio
-        serving.knative.dev/release: "v0.13.0"
     spec:
       serviceAccountName: controller
       containers:
@@ -2769,13 +2769,13 @@ spec:
     metadata:
       annotations:
         cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
+      labels:
+        app: net-istio-controller
+        serving.knative.dev/release: "v1.0.0"
         # This must be outside of the mesh to probe the gateways.
         # NOTE: this is allowed here and not elsewhere because
         # this is the Istio controller, and so it may be Istio-aware.
         sidecar.istio.io/inject: "false"
-      labels:
-        app: net-istio-controller
-        serving.knative.dev/release: "v1.0.0"
     spec:
       serviceAccountName: controller
       containers:
@@ -3018,13 +3018,12 @@ spec:
   backoffLimit: 10
   template:
     metadata:
-      annotations:
-        sidecar.istio.io/inject: "false"
       labels:
         app: storage-version-migration-serving
         app.kubernetes.io/name: knative-serving
         app.kubernetes.io/component: storage-version-migration-job
         app.kubernetes.io/version: "1.10.2"
+        sidecar.istio.io/inject: "false"
     spec:
       serviceAccountName: controller
       restartPolicy: OnFailure