Istio Pod 禁用自动注入

当前场景，使用 istio 的自动注入能力，但是又希望过滤指定的 pod 不注入。
当前测试 Pod 列表

[root@node115-254871 ~]# kubectl get pod -n mesh-sky
NAME                              READY   STATUS    RESTARTS   AGE
httpbin-v1-77d968d988-7qcfb       1/1     Running   0          3m46s
httpbin-v2-7784fc44b8-4w9xq       1/1     Running   0          3m47s
sky-rang-v2-v2-655f778776-ljz2n   1/1     Running   0          27h
sky-v1-v1-5948f856c8-2btmg        1/1     Running   0          27h
sleep-v1-844545548b-d7s4c         1/1     Running   0          5m38s

查看 revision 标记

[root@node115-254871 ~]# kubectl get iop -n istio-system
NAME                     REVISION     STATUS    AGE
iop-cluster-115-1-10-0   iop-1-10-0   HEALTHY   39d

设置自动注入

[root@node115-254871 ~]# kubectl label ns mesh-sky istio.io/rev=iop-1-10-0
namespace/mesh-skky labeled

重启 Pod 之后查看是否注入

[root@node115-254871 ~]# kubectl get pod -n mesh-sky
NAME                              READY   STATUS    RESTARTS   AGE
httpbin-v1-77d968d988-gwdfn       2/2     Running   0          2m43s
httpbin-v2-7784fc44b8-x95kb       2/2     Running   0          2m43s
sky-rang-v2-v2-655f778776-k69zb   2/2     Running   0          2m43s
sky-v1-v1-5948f856c8-hx4xw        2/2     Running   0          2m43s
sleep-v1-844545548b-6cwfd         2/2     Running   0          2m43s

指定 Deployment 添加 sidecar 重载注解，用于覆盖自动注入

spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"

再次查看 Pod 列表

[root@node115-254871 ~]# kubectl get pod -n mesh-skky
NAME                              READY   STATUS    RESTARTS   AGE
httpbin-v1-6c6f688b9d-wqxvj       1/1     Running   0          6m49s
httpbin-v2-856d9c567d-r4xsj       1/1     Running   0          6m30s
sky-rang-v2-v2-655f778776-k69zb   2/2     Running   0          13m
sky-v1-v1-5948f856c8-hx4xw        2/2     Running   0          13m
sleep-v1-844545548b-6cwfd         2/2     Running   0          13m