istio - 是否可以使用 oc patch 命令修补“istio-sidecar-injector”ConfigMap？

Question

由于上游 istio 自动 sidecar 注入配置还将 sidecar 容器部署到 builder 和 deployer pod（对于 openshift .. 当您使用 S2I 时），我们必须修补 ConfigMap (istio-sidecar-injector) 并且没有 sidecar 的例外情况容器注入到 builder 和 deployer pod。

例如，我们必须在 ConfigMap 中手动添加以下异常。

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector
data:
  config: |-
    policy: enabled
    neverInjectSelector:
      - matchExpressions:
        - {key: openshift.io/build.name, operator: Exists}
      - matchExpressions:
        - {key: openshift.io/deployer-pod-for.name, operator: Exists}
    template: |-
      initContainers:

问题：我正在尝试使用 shell 脚本自动执行此操作，并在以编程方式更新以下参数时面临挑战。

neverInjectSelector:
      - matchExpressions:
        - {key: openshift.io/build.name, operator: Exists}
      - matchExpressions:
        - {key: openshift.io/deployer-pod-for.name, operator: Exists}

是否可以使用 oc patch 命令在 configmap 下面进行更新

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector
data:
  config: |-
    policy: enabled
neverInjectSelector:
[ ]

至

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector
data:
  config: |-
    policy: enabled
    neverInjectSelector:
      - matchExpressions:
        - {key: openshift.io/build.name, operator: Exists}
      - matchExpressions:
        - {key: openshift.io/deployer-pod-for.name, operator: Exists}
    template: |-
      initContainers:

标签： istio

Answer 1

Not an oc patch command ... I think we can achieve the same by following below code which may not be elegant solution.

oc project istio-system #change to the project

oc export cm istio-sidecar-injector >> exception.yaml #export the existing cm

sed -i '8s/.*/      - matchExpressions:\n        - {key: openshift.io\/build.name, operator: Exists}\n      - matchExpressions:\n        - {key: openshift.io\/deployer-pod-for.name, operator: Exists}/' exception.yaml
kubectl apply -f exception.yaml