Adding volumes and volumeMounts to sidecar with global SDS enabled

Security
1

Hi,

I realized that the injection-template.yaml will always add user volumeMounts (sidecar.istio.io/userVolumeMount) to the sidecar container but will only add user volumes (sidecar.istio.io/userVolume) if global.sds.enabled is set to false. I did not see any mention in the documentation that user volumes may not be used with this setting enabled.

Is there any reason why the two annotations are treated differently w.r.t. global SDS?
In case there is not, which should be the preferred behavior, to always add or to conditionally add both the user volumes and user volumeMounts?

Thanks!

1 Like
2

Since this is fairly specific, maybe I should open an issue on the istio/istio Github to get an opinion?

3

Hi Emike,

if you already have created an issue on GitHub, could you please link it here.
Thanks!

4

Hi Jonas,

I have, but I have not been following it up since then.
Please refer to https://github.com/istio/istio/issues/21308.

Is this still an issue in the latest releases?
If so, please update the ticket or create one of your own :slight_smile: