Best practices for jobs

We have cronjobs that make extensive use of another service. So it would make sense for the pods created from these cronjobs be part of the service mesh. But I don’t understand how:
In https://istio.io/docs/ops/deployment/requirements/ it is stated that “Service association : A pod must belong to at least one Kubernetes service even if the pod does NOT expose any port. If a pod belongs to multiple Kubernetes services, the services cannot use the same port number for different protocols, for instance HTTP and TCP.”

How would I achieve that with a cronjob?

Then there is the question of quitting the istio-proxy when the job is done, but I think I have figured that out by executing curl -sf -XPOST http://127.0.0.1:15020/quitquitquit in the end.

1 Like

Yes, calling the /quitquitquit point after the jobs as completed seems to be the best practice solution currently.

Somebody may find this GitHub issue helpful. People have also posted examples for wrapping your job’s command.

Bests, Martin

We found another way to gracefull shutdown envoy proxy in Jobs - we use additional sidecar container to check termination of main container, that make /quitquitquit to envoy sidecar. This works without any changes in job code execution.

- name: envoy-sidecar-helper
  image: paskalmaksim/envoy-sidecar-helper:latest
  imagePullPolicy: Always
  args:
  - -envoy.port=15020
  env:
  - name: POD_NAME
    valueFrom:
      fieldRef:
        fieldPath: metadata.name
  - name: POD_NAMESPACE
    valueFrom:
      fieldRef:
        fieldPath: metadata.namespace

Thank you for sharing this! It’s useful. Let me add comment to the args that I confirmed to work!

- name: envoy-sidecar-helper
  image: paskalmaksim/envoy-sidecar-helper:latest
  imagePullPolicy: Always
  args:
    - -log.level=DEBUG
    - -container=<the container name you want to stop. If you have multiple container, you need to split it using comma `,`>
  env:
    - name: POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace