istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add note about `RunAs` fields in Customizing Injection section (#15108) 

* Add note about `RunAs` fields in Customizing Injection section

Override these fields must be done with caution, so, add a note about
them.

* Update content/en/docs/setup/additional-setup/sidecar-injection/index.md

Co-authored-by: Ben Leggett <854255+bleggett@users.noreply.github.com>

---------

Co-authored-by: Ben Leggett <854255+bleggett@users.noreply.github.com>
This commit is contained in:
Jonh Wendell 2024-05-15 11:55:10 -04:00 committed by GitHub
parent 3b0fd0e893
commit f99c846235
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
content/en/docs/setup/additional-setup/sidecar-injection/index.md
View File

@ -218,6 +218,8 @@ In general, any field in a pod can be set. However, care must be taken for certa
* Kubernetes requires the `image` field to be set before the injection has run. While you can set a specific image to override the default one,
it is recommended to set the `image` to `auto` which will cause the sidecar injector to automatically select the image to use.
* Some fields in `Pod` are dependent on related settings. For example, CPU request must be less than CPU limit. If both fields are not configured together, the pod may fail to start.
* Fields `securityContext.RunAsUser` and `securityContext.RunAsGroup` might not be honored in some cases, for instance, when `TPROXY` mode is used,
as it requires the sidecar to run as user `0`. Overriding these fields incorrectly can cause traffic loss, and should be done with extreme caution.
Additionally, certain fields are configurable by [annotations](/docs/reference/config/annotations/) on the pod, although it is recommended to use the above approach to customizing settings. Additional care must be taken for certain annotations: