ISTIO sidecar adds difficulty when talking to resources outside the cluster

[gabrielwen]

Currently all jobs created by Fairing has an ISTIO sidecar and default behavior is to block all outgoing traffic. During the hackathon we disabled it by adding an annotation. Do we want to promote this approach?

• What is the side effect of disabling ISTIO sidecar?
• Should we make ISTIO sidecar an optional deployment instead of making it default?

[issue-label-bot]

Issue Label Bot is not confident enough to auto-label this issue. See dashboard for more details.

[nrchakradhar]

@gabrielwen Can you please provide some more information on how istio-side-car is auto injected by fairing? My understanding for fairing is limited, but I thought side car injection was based on how Istio was installed and for what all namespaces side car injection should be enabled by default. Please let me know if my understanding is correct or not?

[gabrielwen]

hmm, I agree but I just found out istio sidecar is disabled by default: #348

need to find out why my deployments still had it.

[abhi-g]

#399 resolves some other places where istio sidecar was disabled for example for job deployers. Can you please verify if your issue is resolved @gabrielwen

[gabrielwen]

/close

[k8s-ci-robot]

@gabrielwen: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.