What's going on?

Setting a custom annotation namespace -annotation-namespace does not effect the injector.tumblr.com/status annotation.

The root cause seems quite clear from reading the source. The /status annotation is set in webhook.go#L462, using the config.InjectionStatusAnnotation package-level variable. This variable is hardcoded to use annotationNamespaceDefault, which is set to "injector.tumblr.com". This pretty clearly explains why the user-specified configuration is ignored.

Interestingly, both /request and /status are properly formatted using AnnotationNamespace in (*WebhookServer).getSidecarConfigurationRequested. Seems like that configuration format just needs to be used in both places.

Expected Behavior

Setting -annotation-namespace=sidecar-injector.eks.qcinternal.io should cause Pods with injected sidecars to have the annotation sidecar-injector.eks.qcinternal.io/status: injected. Instead, we see injector.tumblr.com/status: injected. The annotation setting which sidecar configuration to use is sidecar-injector.eks.qcinternal.io/request.

Reproducer

The injector is launched with the following arguments:

    - --v
    - "2"
    - --tls-cert-file
    - /var/lib/tls-cert/tls.crt
    - --tls-key-file
    - /var/lib/tls-cert/tls.key
    - --annotation-namespace
    - sidecar-injector.eks.qcinternal.io
    - --configmap-labels
    - app.kubernetes.io/instance=k8s-sidecar-injector-batch-production-blue,app.kubernetes.io/component=sidecar-config

I'm going to omit sidecar configurations in particular, as the root cause seems quite obvious and the configurations are for internal tools. I can provide similar information if necessary.

Version Deets

• Kubernetes Version: v1.13.8
• k8s-sidecar-injector Version: v0.1.7