We have cronjobs that make extensive use of another service. So it would make sense for the pods created from these cronjobs be part of the service mesh. But I don’t understand how:
In https://istio.io/docs/ops/deployment/requirements/ it is stated that “Service association : A pod must belong to at least one Kubernetes service even if the pod does NOT expose any port. If a pod belongs to multiple Kubernetes services, the services cannot use the same port number for different protocols, for instance HTTP and TCP.”
How would I achieve that with a cronjob?
Then there is the question of quitting the istio-proxy when the job is done, but I think I have figured that out by executing curl -sf -XPOST http://127.0.0.1:15020/quitquitquit in the end.
We found another way to gracefull shutdown envoy proxy in Jobs - we use additional sidecar container to check termination of main container, that make /quitquitquit to envoy sidecar. This works without any changes in job code execution.
Thank you for sharing this! It’s useful. Let me add comment to the args that I confirmed to work!
- name: envoy-sidecar-helper
image: paskalmaksim/envoy-sidecar-helper:latest
imagePullPolicy: Always
args:
- -log.level=DEBUG
- -container=<the container name you want to stop. If you have multiple container, you need to split it using comma `,`>
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace