Only inject Pods that are Pending. (#501)

hashicorp · Aug 16, 2023 · adb76bf · adb76bf
1 parent e813ad9
commit adb76bf
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 5 deletions.
diff --git a/agent-inject/agent/agent.go b/agent-inject/agent/agent.go
@@ -540,6 +540,11 @@ func ShouldInject(pod *corev1.Pod) (bool, error) {
 		return false, nil
 	}
 
+	// If injection didn't happen on pod creation, then it's too late now.
+	if pod.Status.Phase != "" && pod.Status.Phase != corev1.PodPending {
+		return false, nil
+	}
+
 	// This shouldn't happen so bail.
 	raw, ok = pod.Annotations[AnnotationAgentStatus]
 	if !ok {

diff --git a/agent-inject/agent/agent_test.go b/agent-inject/agent/agent_test.go
@@ -91,17 +91,23 @@ func testPodIRSA(annotations map[string]string) *corev1.Pod {
 func TestShouldInject(t *testing.T) {
 	tests := []struct {
 		annotations map[string]string
+		phase       corev1.PodPhase
 		inject      bool
 	}{
-		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: ""}, true},
-		{map[string]string{AnnotationAgentInject: "false", AnnotationAgentStatus: ""}, false},
-		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: "injected"}, false},
-		{map[string]string{AnnotationAgentInject: "false", AnnotationAgentStatus: "injected"}, false},
-		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: "update"}, true},
+		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: ""}, corev1.PodPending, true},
+		{map[string]string{AnnotationAgentInject: "false", AnnotationAgentStatus: ""}, corev1.PodPending, false},
+		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: "injected"}, corev1.PodPending, false},
+		{map[string]string{AnnotationAgentInject: "false", AnnotationAgentStatus: "injected"}, corev1.PodPending, false},
+		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: "update"}, corev1.PodPending, true},
+		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: ""}, corev1.PodRunning, false},
+		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: ""}, corev1.PodSucceeded, false},
+		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: ""}, corev1.PodFailed, false},
+		{map[string]string{AnnotationAgentInject: "true", AnnotationAgentStatus: "update"}, corev1.PodRunning, false},
 	}
 
 	for _, tt := range tests {
 		pod := testPod(tt.annotations)
+		pod.Status.Phase = tt.phase
 		inject, err := ShouldInject(pod)
 		if err != nil {
 			t.Errorf("got error, shouldn't have: %s", err)