如何在 K8S 作业上禁用 istio

Question

我运行的是 K8S 版本 1.15.3 我正在尝试在我的 k8s 集群上安装 istio1.4。

我在安装过程中使用 k8s 作业来实现我的一些自动化。 其中一项工作是使用 python 对 kubernetes api 进行一些调用，而在使用 istio 时这会失败。 我猜 istio 会以某种方式阻止对 kubernetes api 的访问。

如何从特定作业中删除 istio？

我看到了这个注解：sidecar.istio.io/inject: "false"，我尝试将它添加到我的作业清单中，但是当这个注解存在时，istio 仍在添加边车。

作业的错误是：

2019-12-08 13:22:08,009 WARNING Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f45c0c0a390>: Failed to establish a new connection: [Errno 111] Connection refused',)': /api/v1/pods?watch=False
2019-12-08 13:22:08,009 WARNING Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f45c0c0a4d0>: Failed to establish a new connection: [Errno 111] Connection refused',)': /api/v1/pods?watch=False
2019-12-08 13:22:08,010 WARNING Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f45c0c0a650>: Failed to establish a new connection: [Errno 111] Connection refused',)': /api/v1/pods?watch=False
Traceback (most recent call last):
  File "./get_pod_regex_exec.py", line 19, in <module>
    ret = v1.list_pod_for_all_namespaces(watch=False)
  File "/usr/local/lib/python2.7/site-packages/kubernetes/client/apis/core_v1_api.py", line 13630, in list_pod_for_all_namespaces
    (data) = self.list_pod_for_all_namespaces_with_http_info(**kwargs)
  File "/usr/local/lib/python2.7/site-packages/kubernetes/client/apis/core_v1_api.py", line 13724, in list_pod_for_all_namespaces_with_http_info
    collection_formats=collection_formats)
  File "/usr/local/lib/python2.7/site-packages/kubernetes/client/api_client.py", line 334, in call_api
    _return_http_data_only, collection_formats, _preload_content, _request_timeout)
  File "/usr/local/lib/python2.7/site-packages/kubernetes/client/api_client.py", line 168, in __call_api
    _request_timeout=_request_timeout)
  File "/usr/local/lib/python2.7/site-packages/kubernetes/client/api_client.py", line 355, in request
    headers=headers)
  File "/usr/local/lib/python2.7/site-packages/kubernetes/client/rest.py", line 231, in GET
    query_params=query_params)
  File "/usr/local/lib/python2.7/site-packages/kubernetes/client/rest.py", line 205, in request
    headers=headers)
  File "/usr/local/lib/python2.7/site-packages/urllib3/request.py", line 76, in request
    method, url, fields=fields, headers=headers, **urlopen_kw
  File "/usr/local/lib/python2.7/site-packages/urllib3/request.py", line 97, in request_encode_url
    return self.urlopen(method, url, **extra_kw)
  File "/usr/local/lib/python2.7/site-packages/urllib3/poolmanager.py", line 330, in urlopen
    response = conn.urlopen(method, u.request_uri, **kw)
  File "/usr/local/lib/python2.7/site-packages/urllib3/connectionpool.py", line 762, in urlopen
    **response_kw
  File "/usr/local/lib/python2.7/site-packages/urllib3/connectionpool.py", line 762, in urlopen
    **response_kw
  File "/usr/local/lib/python2.7/site-packages/urllib3/connectionpool.py", line 762, in urlopen
    **response_kw
  File "/usr/local/lib/python2.7/site-packages/urllib3/connectionpool.py", line 720, in urlopen
    method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
  File "/usr/local/lib/python2.7/site-packages/urllib3/util/retry.py", line 436, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='10.233.0.1', port=443): Max retries exceeded with url: /api/v1/pods?watch=False (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f45c0c0a790>: Failed to establish a new connection: [Errno 111] Connection refused',))

如何从该作业中删除 istio 或告诉它不要阻止对 k8s api 的访问？ 谢谢

Answer 1

我找到了我的问题的答案 :) 我在模板中放置了这些值：

spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"