Explicitly disallow istio sidecar injection for certain workloads

[yolocs]

Fixes #1474

Proposed Changes

Release Note

Explicitly disallow istio sidecar injection for controller/webhook/broker fanout/retry

Docs

[knative-prow-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: yolocs

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [yolocs]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[knative-test-reporter-robot]

The following jobs failed:

Test name	Triggers	Retries
pull-google-knative-gcp-integration-tests	2020-07-16 23:13:00.693 +0000 UTC	1/3

Automatically retrying due to test flakiness...
/test pull-google-knative-gcp-integration-tests

[knative-test-reporter-robot]

The following jobs failed:

Test name	Triggers	Retries
pull-google-knative-gcp-wi-tests	2020-07-16 23:13:00.693 +0000 UTC	1/3

Automatically retrying due to test flakiness...
/test pull-google-knative-gcp-wi-tests

[yolocs]

/retest

[yolocs]

/retest

[yolocs]

/retest

[yolocs]

/retest

[grac3gao-zz]

/lgtm

[Harwayne]

For my own edification, which of our infrastructure pieces should have the side car?

Only ingress? Why not fanout/retry, which send to other possibly side-car'ed Pods?

[yolocs]

@Harwayne Fanout/retry are pull based so no inbound policy enforcement is needed. We haven't clearly identified how to use istio for outbound traffic to other sidecar'ed pods (there are several possibilities though). So to minimize impact, I choose to disable sidecar for fanout/retry at the moment. You think it's a better idea to enable them now?

[yolocs]

/retest

[yolocs]

/retest

[upodroid]

Hi @yolocs

I need to have the istio sidecars enabled for all these workloads, where do I set the allowIstioSidecar: true value?

Thank you

[yolocs]

@upodroid The parameter is internal. E.g. https://github.com/google/knative-gcp/blob/master/pkg/reconciler/brokercell/brokercell.go#L238

If you can create an issue, I will help make the change :)