Fix Istio sidecar injection by moving from annotations to labels (#3044)

madmecodes · web-flow · commit 48211a46c93e · 2025-05-12T16:24:38.000Z
* Fix Istio sidecar injection by moving from annotations to labels

Signed-off-by: madmecodes &lt;ayushguptadev1@gmail.com&gt;

* Fix indentation and syntax issues

Signed-off-by: madmecodes &lt;ayushguptadev1@gmail.com&gt;

---------

Signed-off-by: madmecodes &lt;ayushguptadev1@gmail.com&gt;
diff --git a/apps/admission-webhook/upstream/base/deployment.yaml b/apps/admission-webhook/upstream/base/deployment.yaml
@@ -5,7 +5,7 @@ metadata:
 spec:
   template:
     metadata:
-      annotations:
+      labels:
         sidecar.istio.io/inject: "false"
     spec:
       containers:
diff --git a/apps/centraldashboard/upstream/base/deployment.yaml b/apps/centraldashboard/upstream/base/deployment.yaml
@@ -13,7 +13,6 @@ spec:
     metadata:
       labels:
         app: centraldashboard
-      annotations:
         sidecar.istio.io/inject: "true"
     spec:
       containers:
diff --git a/apps/katib/upstream/components/controller/controller.yaml b/apps/katib/upstream/components/controller/controller.yaml
@@ -15,10 +15,10 @@ spec:
     metadata:
       labels:
         katib.kubeflow.org/component: controller
+        sidecar.istio.io/inject: "false"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "8080"
-        sidecar.istio.io/inject: "false"
     spec:
       serviceAccountName: katib-controller
       containers:
diff --git a/apps/katib/upstream/components/db-manager/db-manager.yaml b/apps/katib/upstream/components/db-manager/db-manager.yaml
@@ -15,7 +15,6 @@ spec:
     metadata:
       labels:
         katib.kubeflow.org/component: db-manager
-      annotations:
         sidecar.istio.io/inject: "false"
     spec:
       containers:
diff --git a/apps/katib/upstream/components/mysql/mysql.yaml b/apps/katib/upstream/components/mysql/mysql.yaml
@@ -17,7 +17,6 @@ spec:
     metadata:
       labels:
         katib.kubeflow.org/component: mysql
-      annotations:
         sidecar.istio.io/inject: "false"
     spec:
       containers:
diff --git a/apps/katib/upstream/components/postgres/postgres.yaml b/apps/katib/upstream/components/postgres/postgres.yaml
@@ -17,8 +17,8 @@ spec:
     metadata:
       labels:
         katib.kubeflow.org/component: postgres
-      annotations:
         sidecar.istio.io/inject: "false"
+      annotations:
     spec:
       containers:
         - name: katib-postgres
diff --git a/apps/katib/upstream/components/ui/ui.yaml b/apps/katib/upstream/components/ui/ui.yaml
@@ -15,7 +15,6 @@ spec:
     metadata:
       labels:
         katib.kubeflow.org/component: ui
-      annotations:
         sidecar.istio.io/inject: "false"
     spec:
       containers:
diff --git a/apps/katib/upstream/installs/katib-with-kubeflow/patches/istio-sidecar-injection.yaml b/apps/katib/upstream/installs/katib-with-kubeflow/patches/istio-sidecar-injection.yaml
@@ -6,5 +6,5 @@ metadata:
 spec:
   template:
     metadata:
-      annotations:
+      labels:
         sidecar.istio.io/inject: "true"
diff --git a/apps/kserve/kserve/kserve_kubeflow.yaml b/apps/kserve/kserve/kserve_kubeflow.yaml
@@ -32826,12 +32826,12 @@ spec:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: manager
-        sidecar.istio.io/inject: "false"
       labels:
         app: kserve
         app.kubernetes.io/name: kserve
         control-plane: kserve-controller-manager
         controller-tools.k8s.io: "1.0"
+        sidecar.istio.io/inject: "false"
     spec:
       containers:
         - args:
diff --git a/apps/kserve/models-web-app/overlays/kubeflow/patches/web-app-sidecar.yaml b/apps/kserve/models-web-app/overlays/kubeflow/patches/web-app-sidecar.yaml
@@ -6,5 +6,5 @@ metadata:
 spec:
   template:
     metadata:
-      annotations:
+      labels:
         sidecar.istio.io/inject: "true"
diff --git a/apps/profiles/upstream/manager/manager.yaml b/apps/profiles/upstream/manager/manager.yaml
@@ -13,7 +13,7 @@ spec:
   replicas: 1
   template:
     metadata:
-      annotations:
+      labels:
         sidecar.istio.io/inject: "false"
     spec:
       containers:
diff --git a/apps/profiles/upstream/overlays/kubeflow/patches/kfam.yaml b/apps/profiles/upstream/overlays/kubeflow/patches/kfam.yaml
@@ -5,7 +5,7 @@ metadata:
 spec:
   template:
     metadata:
-      annotations:
+      labels:
         sidecar.istio.io/inject: "true"
     spec:
       containers:
diff --git a/apps/spark/spark-operator/base/kustomization.yaml b/apps/spark/spark-operator/base/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - resources.yaml
-  - aggregated-roles.yaml
+- resources.yaml
+- aggregated-roles.yaml
 namespace: kubeflow
 patches:
   - target:
@@ -48,7 +48,7 @@ patches:
       spec:
         template:
           metadata:
-            annotations:
+            labels:
               sidecar.istio.io/inject: "false"
   - target:
       kind: Deployment
@@ -57,9 +57,9 @@ patches:
       apiVersion: apps/v1
       kind: Deployment
       metadata:
-        name: spark-operator-webhook
+        name: spark-operator-controller
       spec:
         template:
           metadata:
-            annotations:
-              sidecar.istio.io/inject: "false"
+            labels:
+              sidecar.istio.io/inject: "false"
diff --git a/apps/spark/sparkapplication_example.yaml b/apps/spark/sparkapplication_example.yaml
@@ -2,6 +2,8 @@ apiVersion: sparkoperator.k8s.io/v1beta2
 kind: SparkApplication
 metadata:
   name: spark-pi-python
+  labels:
+    sidecar.istio.io/inject: "false"
 spec:
   type: Python
   pythonVersion: "3"
@@ -14,8 +16,8 @@ spec:
     cores: 1
     memory: 512m
     serviceAccount: default-editor
-    annotations:
-      "sidecar.istio.io/inject": "false"
+    labels:
+      sidecar.istio.io/inject: "false"
     securityContext:
       capabilities:
         drop:
@@ -30,8 +32,8 @@ spec:
     instances: 1
     cores: 1
     memory: 512m
-    annotations:
-      "sidecar.istio.io/inject": "false"
+    labels:
+      sidecar.istio.io.inject: "false"
     securityContext:
       capabilities:
         drop:
diff --git a/apps/training-operator/upstream/base/deployment.yaml b/apps/training-operator/upstream/base/deployment.yaml
@@ -13,7 +13,6 @@ spec:
     metadata:
       labels:
         control-plane: kubeflow-training-operator
-      annotations:
         sidecar.istio.io/inject: "false"
     spec:
       containers:
diff --git a/common/knative/knative-serving/base/patches/sidecar-injection.yaml b/common/knative/knative-serving/base/patches/sidecar-injection.yaml
@@ -6,5 +6,5 @@ metadata:
 spec:
   template:
     metadata:
-      annotations:
+      labels:
         sidecar.istio.io/inject: "true"
diff --git a/tests/gh-actions/kf-objects/training_operator_job.yaml b/tests/gh-actions/kf-objects/training_operator_job.yaml
@@ -11,30 +11,30 @@ spec:
       restartPolicy: OnFailure
       template:
         metadata:
-          annotations:
+          labels:
             sidecar.istio.io/inject: "false"
         spec:
           containers:
-            - name: pytorch
-              image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727
-              imagePullPolicy: Always
-              command:
-                - "python3"
-                - "/opt/pytorch-mnist/mnist.py"
-                - "--epochs=1"
+          - name: pytorch
+            image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727
+            imagePullPolicy: Always
+            command:
+            - "python3"
+            - "/opt/pytorch-mnist/mnist.py"
+            - "--epochs=1"
     Worker:
       replicas: 1
       restartPolicy: OnFailure
       template:
         metadata:
-          annotations:
+          labels:
             sidecar.istio.io/inject: "false"
         spec:
           containers:
-            - name: pytorch
-              image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727
-              imagePullPolicy: Always
-              command:
-                - "python3"
-                - "/opt/pytorch-mnist/mnist.py"
-                - "--epochs=1"
+          - name: pytorch
+            image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727
+            imagePullPolicy: Always
+            command:
+            - "python3"
+            - "/opt/pytorch-mnist/mnist.py"
+            - "--epochs=1"
