Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here (e.g. I signed it!) and we'll verify it.

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

Hi @jaredallard. Thanks for your PR.

I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

I signed the CLA

CLAs look good, thanks!

This pull request has been automatically marked as stale because it has not had activity in the last 2 weeks. It will be closed in 30 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

Still waiting for a reviewer :(

/ok-to-test

@jaredallard , sorry for late response (just come back from vacation), master is frozen, can you please create this PR against the branch of release-1.1?

/hold

need to understand which k8s platform is used

@gyliu513 Will do.

@linsun This is not platform specific, since the parent securityContext is modifying the initContainers securityContext.

This pull request has been automatically marked as stale because it has not had activity in the last 2 weeks. It will be closed in 30 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

Tested it with stable/mariadb and it works. Please, make it public. People waiting for this workaround, until cni is done.

@Bessonov I'll try to get this rebased onto release-1.1 by this weekend, apologies for the delay everyone.

@gyliu513 based on release-1.1 let me know if you need anything else from me.

@gyliu513 Can we get some movement on this? Need to stop modifying this myself asap!

@mandarjog @gyliu513 c'mon guys, this one is pending since 2 months. It's frustrate a ton of people or at least everyone, who want to use non-root images. Every bitnami image for helm (stable/mariadb, stable/mongodb, stable/redisdb, ...) is a non-root image. It costs me a lot of time to figure out why charts are failing with istio.

To hold this PR you produce not only work for you, but for your users and maintainers of non-root images.

/cc greghanson

Adding another reviewer, would be nice to get some movement on this.

This pull request has been automatically marked as stale because it has not had activity in the last 2 weeks. It will be closed in 30 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

@mandarjog @gyliu513 @GregHanson more activity, please.

There is a workaround like #10358, however, this PR is essential for GKE Istio addon users because GKE Istio addon does not allow modifying sidecar-injector-configmap manifest by cluster user and they cannot apply its workaround.

Same for us, this needs to stop. And it's been months!

/meow

EDIT prow hates me

/retest

@ostromart @costinm PTAL

This definitely should not have been left sitting for so long. Sorry. Getting more eyes on it now.

However, the circleci test failures look like they are due to this change. We can't merge a PR that breaks tests

Sorry for the delay - the PR looks good, if we can get the tests to pass we should get it in.

/lgtm
/approve

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: costinm, jaredallard

The full list of commands accepted by this bot can be found here.

The pull request process is described here

To fix the tests, you need to update the expected files. in pilot/pkg/kube/inject/testdata.

And probably rebase your changes since this is from a while ago

@jaredallard: The following tests failed, say /retest to rerun them all:

@howardjohn can you take this one? I think it's an important fix, I worry we've stretched everyone's patience too far already, and I bet you could fix the test failures in far less time

@jaredallard apologies for the long lag in your PR review. This issue is in the process of being solved, and I want to thank you for hunting down the correct solution.

Most Istio contributors that can approve PRs are a little overloaded. One thing that helps when your PR is submitted is to use the /assign feature so the reviewer knows your work is ready. If you feel the current reviewer is slacking (Costin is super overloaded;) you can always do a second assign.

This shows up in a dashboard under https://github.com/pulls/assigned and is the primary mechanism by which many PRs are reviewed.

Cheers
-steve