Add linkerd.io/inject: enabled to namespace will prevent job from completing.

[FingerLiu]

Bug Report

After setting linkerd.io/inject: enabled to a namespace, all job in the namespace will not be ceompleted since linkerd add readiness to the pod, and it will never ready.

Possible solution

Maybe we can skip pods that created by job at injector during it doing adimission webhook?
Should we inject proxy for k8s job?

[mateiidavid]

Hi @FingerLiu, thanks for raising this!

This is unfortunately caused by the way sidecar support works in Kubernetes. You could use something like linkerd-await to kill the proxy on completion, but this requires a change in the docker image of your application. There might also be some other similar solutions in the Kubernetes ecosystem; there's also the possibility of running a controller to kill the proxy container in your Job.

The easiest solution would be to overwrite the inject annotation on your Job resource if you do not want to inject the workload. If linkerd.io/inject: enabled is set on the namespace, you can overwrite it on a workload-by-workload basis. So, in the job's spec, find the pod template, and annotate it with linkerd.io/inject: disabled. That will allow you to mesh everything automatically in the namespace except the pods owned and created by the job.

Let me know if this works for you :)

[FingerLiu]

@mateiidavid Hi, thanks for your explanation.
But my goal is to setup linkerd in namespace scope without touching any specific workload in the namespace(I am in platform team, and I should not aware of workload detail).The solution your suggested seem I have to change spec of my workload.

Is there a way to add some annotation in namespace, for example linkerd.io/exclude-workload: job, and let injector admission webhook aware of this and stop injecting sidecar for job?

[kleimkuhler]

There is some discussion about this in in #5188. You'll see a user has shared a mutating webhook which essentially does this.

[FingerLiu]

Thanks, I think this works

[FingerLiu]

But is it possible to merge it into official linkerd webhook? Maybe with a config to enable/disable this?

[kleimkuhler]

It's worth considering. If you like to open a small feature request about it, it will spark some discussion about what makes sense for supporting it.

[FingerLiu]

OK, I will try~