Redbox Tech Blog
Published in

Redbox Tech Blog

Handling Istio Sidecars in Kubernetes Jobs

Photo by Zoltan Tasi on Unsplash

Kubernetes Jobs

Istio

Istio High Level — https://istio.io/docs/concepts/security/
Istio High Level Architecture — https://istio.io/docs/concepts/security/

The problem with Kubernetes Jobs and Istio Sidecars

Stopping an Istio Sidecar Automatically

Option 1: Disabling Istio Sidecar injection

Option 2: Use `pkill` to stop the Istio Process

Option 3: envoy-preflight

$ envoy-preflight <command>
envoy-preflight: quitquitquit sent, response: Response(200)# /quitquitquit is Envoy's Admin API endpoint to trigger a shutdown
$ curl 127.0.0.1:15000
curl: (7) Failed to connect to 127.0.0.1 port 15000: Connection refused
# 127.0.0.1:15000 is Envoy's Admin API port
# Found in Istio Docs
istio-proxy docker.io/istio/proxyv2:1.2.2 Running

Short Term Solution — Scuttle

  1. Polls the Envoy sidecar proxy for readiness before starting the Job’s task.
  2. Stops Envoy when the job is finished.
  3. Forwards the exit code from whatever command is used for the Job’s task.

Long Term Solution — Istio 1.3 and Core k8s Support

We Are Hiring!

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store