CODEWITHSUNDEEP
mongodbkubernetesistio
karthikeayan
karthikeayan

Reputation: 5010

Does Istio envoy proxy sidecar has anything to do with container filesystem?

Recently I was adding Istio to my kubernetes cluster. When enabling istio to one of the namespaces where MongoDB statefulset were deployed, MongoDB was failed to start up.

The error message was "keyfile permissions too open"

When I analyzed whats going on, keyfile is coming from the /etc/secrets-volume which is mounted to the statefulset from kubernetes secret.

The file permissions was 440 instead of 400. Because of this MongoDB started to complain that "permissions too open" and the pod went to Crashbackloopoff.

When I disable Istio injection in that namespace, MongoDB is starting fine.

Whats going on here? Does Istio has anything to do with container filesystem, especially default permissions?

Upvotes: 1

Views: 638

Answers (1)

Piotr Malec
Piotr Malec

Reputation: 3647

The istio sidecar injection is not always meant for all kinds of containers like mentioned in istio documentation guide. These containers should be excluded from istio sidecar injection.

In case of Databases that are deployed using StatefulSets some of the containers might be temporary or used as operators which can end up in crash loop or other problematic states.

There is also alternative approach to not istio inject databases at all and just add them as external services with ServiceEntry objects. There is entire blog post in istio documentation how to do that specifically with MongoDB. the guide is little outdated so be sure to refer to current documentation page for ServiceEntry which also has examples of using external MongoDB.

Hope it helps.

Upvotes: 1

Related Questions