Proposal: Add istio-inject flag

[rpsec]

This is a proposal to add an extra flag (istio-inject) to Helm that will basically do what istioctl's 'kube-inject' does. The goal will be to inject any necessary istio parameters to the resulting YAML files Helm produces while still maintaining the benefits from Helm.

The kube-inject code can be taken from the istio project and ported to Helm. We would probably want to work with istio maintainers to make sure the two are kept in sync.

@thomastaylor312

[thomastaylor312]

@rprobotics Do you know if the istio cube-inject code is in a library we could import and use?

[jrnt30]

There is actually work being done already with Istio to have a Dynamic Admission Controller which would provide this out of band of Helm, which I think would probably be a bit more robust.

Essentially istio/old_pilot_repo#335 is the Epic covering the tasks, but the Istio/pilot now contains the start of this implementation.

[seh]

I don't think this should be part of Helm itself. A plugin would be more palatable.

[rpsec]

Does anybody know the ETA on the Dynamic Admission Controllers? That project seems like it'll be more long-term sustainable than the quick-fix I suggested. If the project is still months away than it might make sense to develop the plugin as @seh suggested.

[thomastaylor312]

I think a plugin would be the best way to start. You could track the admission controller and then deprecate the plugin

[jrnt30]

Are plugins now able to inject themselves in the actual provisioning pipeline? When we had looked at this before, part of the problem was that Plugins weren't able to change the actual manifests of the resources being created.

[bacongobbler]

Tiller has a concept known as release modules that allow you to modify the release functionality (like rudder-appcontroller). See #1924 for some background context on how that works.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[so0k]

for anyone interested (or getting here via Google), k8s > 1.7.3 required for automatic Istio sidecar injection
https://istio.io/docs/setup/kubernetes/sidecar-injection.html#automatic-sidecar-injection

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[bacongobbler]

/remove-lifecycle rotten

[briansmith]

I don't think there should be a <service-mesh-platform>-inject flag per service mesh platform. It would be better if the mechanism were flexible enough to support linkerd and Conduit and other things as well.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[maorfr]

Hi,

how about this plugin?
https://github.com/maorfr/helm-inject

[maorfr]

@bacongobbler I think this issue can be closed :)