-
Notifications
You must be signed in to change notification settings - Fork 626
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[init-database] - Issues to connect to the database when workload is meshed using Istio #1838
Comments
+1 just ran into this same issue today, task never comes online due to init containers firing before the istio sidecar is online. |
Adding support for task_label to set sidecar.istio.io/inject to false could be a solution. |
I don't think thats a reasonable solution as our end goal here is to run istio successfully while using awx-operator, which we can do now we just have to pause controller enforcement to do so until a proper patch is released. |
A more proper solution is to create https://github.com/istio/istio/blob/master/manifests/charts/istio-control/istio-discovery/values.yaml#L137-L162 |
Please confirm the following
Bug Summary
With the feature introduced by the ffba1b4, a
InitContainer
namedinit-database
was introduced to validate the database status by calling thewait-for-migrations
script. I really liked this approach though, so we have a dedicated task for it.Therefore, if the workload/namespace is meshed with Istio, the
initContainer
requires an special UID to be captured by the Istio, otherwise theinitContainer
will not be able to reach out to the database. Note that this issue does not happen with a regular pod, as thesidecar
will get injected as expected, whereas on theinitContainer
there is no sidecar yet.To fix the issue, we need to expose to this deployment the ability to override the
securityContext
torunAsUser
.To address this issue, I stopped the operator (to avoid reconciliation) and manually patch the
awx-task
deployment which then works as expected.AWX Operator version
2.15.0
AWX version
24.2.0
Kubernetes platform
kubernetes
Kubernetes/Platform version
1.29
Modifications
yes
Steps to reproduce
Expected results
Work as expect
Actual results
Fails to connect to the database due to
initContainer
being unable to reach out to the network.Additional information
N/A
Operator Logs
N/A
Tasks
The text was updated successfully, but these errors were encountered: