Append the config annotations to the pod's meta before creating the p…

…atch

This ensures that any configs provided via the CLI options are persisted
as annotations before the configs override.

Signed-off-by: Ivan Sim <[email protected]>

cli/cmd/inject.go

@@ -131,6 +131,14 @@ func (rt resourceTransformerInject) transform(bytes []byte) ([]byte, []inject.Re
 		r := inject.Report{UnsupportedResource: true}
 		return bytes, []inject.Report{r}, nil
 	}
+
+	conf.AppendPodAnnotations(map[string]string{
+		k8s.CreatedByAnnotation: k8s.CreatedByAnnotationValue(),
+	})
+	if len(rt.overrideAnnotations) > 0 {
+		conf.AppendPodAnnotations(rt.overrideAnnotations)
+	}
+
 	p, reports, err := conf.GetPatch(bytes, inject.ShouldInjectCLI)
 	if err != nil {
 		return nil, nil, err
@@ -139,11 +147,6 @@ func (rt resourceTransformerInject) transform(bytes []byte) ([]byte, []inject.Re
 		return bytes, reports, nil
 	}
 
-	for annotation, value := range rt.overrideAnnotations {
-		p.AddPodAnnotation(annotation, value)
-	}
-	p.AddPodAnnotation(k8s.CreatedByAnnotation, k8s.CreatedByAnnotationValue())
-
 	patchJSON, err := p.Marshal()
 	if err != nil {
 		return nil, nil, err
@@ -286,7 +289,9 @@ func (options *injectOptions) fetchConfigsOrDefault() (*config.All, error) {
 	return api.Config(context.Background(), &public.Empty{})
 }
 
-// overrideConfigs uses command-line overrides to update the provided configs
+// overrideConfigs uses command-line overrides to update the provided configs.
+// the overrideAnnotations map keeps track of which configs are overridden, by
+// storing the corresponding annotations and values.
 func (options *injectOptions) overrideConfigs(configs *config.All, overrideAnnotations map[string]string) {
 	if len(options.ignoreInboundPorts) > 0 {
 		configs.Proxy.IgnoreInboundPorts = toPorts(options.ignoreInboundPorts)
@@ -346,6 +351,9 @@ func (options *injectOptions) overrideConfigs(configs *config.All, overrideAnnot
 		overrideAnnotations[k8s.ProxyLogLevelAnnotation] = options.proxyLogLevel
 	}
 
+	// keep track of this option because its true/false value results in different
+	// values being assigned to the LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES
+	// env var. Its annotation is added only if its value is true.
 	configs.Proxy.DisableExternalProfiles = options.disableExternalProfiles
 	if options.disableExternalProfiles {
 		overrideAnnotations[k8s.ProxyDisableExternalProfilesAnnotation] = "true"

pkg/inject/inject.go

@@ -90,9 +90,10 @@ type ResourceConfig struct {
 	pod struct {
 		// Meta is the pod's metadata. It's exported so that the YAML marshaling
 		// will work in the ParseMeta() function.
-		Meta   *metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-		labels map[string]string
-		spec   *v1.PodSpec
+		Meta        *metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+		labels      map[string]string
+		annotations map[string]string
+		spec        *v1.PodSpec
 	}
 }
 
@@ -105,6 +106,7 @@ func NewResourceConfig(configs *config.All) *ResourceConfig {
 
 	config.pod.Meta = &metav1.ObjectMeta{}
 	config.pod.labels = map[string]string{k8s.ControllerNSLabel: configs.GetGlobal().GetLinkerdNamespace()}
+	config.pod.annotations = map[string]string{}
 	return config
 }
 
@@ -143,6 +145,13 @@ func (conf *ResourceConfig) WithProxyOutboundCapacity(m map[string]uint) *Resour
 	return conf
 }
 
+// AppendPodAnnotations appends the given annotations to the pod spec in conf
+func (conf *ResourceConfig) AppendPodAnnotations(annotations map[string]string) {
+	for annotation, value := range annotations {
+		conf.pod.annotations[annotation] = value
+	}
+}
+
 // YamlMarshalObj returns the yaml for the workload in conf
 func (conf *ResourceConfig) YamlMarshalObj() ([]byte, error) {
 	return yaml.Marshal(conf.workload.obj)
@@ -194,8 +203,8 @@ func (conf *ResourceConfig) GetPatch(
 	if conf.pod.spec != nil {
 		report.update(conf)
 		if shouldInject(conf, report) {
-			conf.injectPodSpec(patch)
 			conf.injectObjectMeta(patch)
+			conf.injectPodSpec(patch)
 		}
 	} else {
 		report.UnsupportedResource = true
@@ -354,6 +363,10 @@ func (conf *ResourceConfig) parse(bytes []byte) error {
 		conf.pod.Meta = &v.ObjectMeta
 	}
 
+	if conf.pod.Meta.Annotations == nil {
+		conf.pod.Meta.Annotations = map[string]string{}
+	}
+
 	return nil
 }
 
@@ -557,6 +570,7 @@ func (conf *ResourceConfig) injectObjectMeta(patch *Patch) {
 	if len(conf.pod.Meta.Annotations) == 0 {
 		patch.addPodAnnotationsRoot()
 	}
+
 	patch.AddPodAnnotation(k8s.ProxyVersionAnnotation, conf.configs.GetGlobal().GetVersion())
 
 	if conf.configs.GetGlobal().GetIdentityContext() != nil {
@@ -568,6 +582,17 @@ func (conf *ResourceConfig) injectObjectMeta(patch *Patch) {
 	for k, v := range conf.pod.labels {
 		patch.addPodLabel(k, v)
 	}
+
+	for k, v := range conf.pod.annotations {
+		patch.AddPodAnnotation(k, v)
+	}
+
+	// append any additional pod annotations to the pod's meta.
+	// for e.g., annotations that were converted from CLI inject options.
+	for annotation, value := range conf.pod.annotations {
+		conf.pod.Meta.Annotations[annotation] = value
+	}
+
 }
 
 // AddRootLabels adds all the pod labels into the root workload (e.g. Deployment)