Injecting proxy by default not working

[krancour]

I've confirmed this behavior on both AKS and minikube.

If I install using the master branch of the Helm chart (which uses consul-k8s v0.2.0), having configured values to enable injection by default (i.e. without requiring annotations) like so:

# ConnectInject will enable the automatic Connect sidecar injector.
connectInject:
  enabled: true
  image: null # image for consul-k8s that contains the injector
  default: true # true will inject by default, otherwise requires annotation

Auto-injection fails and pods never even get created. Inspecting the deployment, I find this message as the last status condition:

message: 'Internal error occurred: Internal error occurred: jsonpatch add operation
        does not apply: doc is missing path: /metadata/annotations/consul.hashicorp.com~1connect-inject-status'

If I add the following annotation, everything works exactly as expected, but I was hoping to avoid this since I'd probably prefer that use of Consul Connect be enforced by policy rather than by developer choice.

annotations:
        "consul.hashicorp.com/connect-inject": "true"

[richthegeek]

+1 on MiniKube, automatic injection fails with this error.

[gregdurham]

+1 see this on EKS as well

[bartdzkan]

+1 See this on GKE as well.

[jleechp-occm]

See this on AKS as well.

[adilyse]

For as widespread as this appears to be, I'm having a heck of a time reproducing it. Could folks please provide the versions of: Kubernetes, the Helm chart, Consul and consul-k8s where they see this? That will help give me a better place to start.

Thanks!

[adilyse]

Turns out we were not correctly creating the metadata/annotations object in the case where an annotation was not already present. PR linked that will fix this.