Ability to skip container mutation (for example for istio)

[trublast]

Description

• Ability to skip the mutation of certain containers via the secrets-store.deckhouse.io/skip-mutate-containers pod annotation or the skip_mutate_containers webhook environment variable.
• CVE updates

Why do we need it, and what problem does it solve?

Istio initContainers do not have access to Vault when using the secrets-store.deckhouse.io/env-from-path annotation, so we want to skip such containers.

What is the expected result?

Pods with the secrets-store.deckhouse.io/env-from-path annotation and the sidecar.istio.io/inject: "true" label can start successfully.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.