Linkerd webhook namespaceSelector, values for AKS?

[johnmckenna]

As mentioned in issue #3305 the namespaceSelector doesn't exclude the control plane in AKS.

I'm installing components in AKS and was wanting to make sure if the configuration at the end of this question is correct for the helm charts for linkerd2-cni, linkerd2, linkerd-viz and linkerd-jaeger?

Microsoft suggest the following:

https://docs.microsoft.com/en-us/azure/aks/faq

Can I use admission controller webhooks on AKS?

Yes, you may use admission controller webhooks on AKS. It's recommended you exclude internal AKS namespaces, which are marked with the control-plane label. For example, by adding the below to the webhook configuration:

namespaceSelector:
    matchExpressions:
    - key: control-plane
      operator: DoesNotExist

linkerd2:

proxyInjector:
  namespaceSelector:
    matchExpressions:
    - key: config.linkerd.io/admission-webhooks
      operator: NotIn
      values:
      - disabled
    - key: control-plane
      operator: DoesNotExist

profileValidator:
  namespaceSelector:
    matchExpressions:
    - key: config.linkerd.io/admission-webhooks
      operator: NotIn
      values:
      - disabled
    - key: control-plane
      operator: DoesNotExist

linkerd-viz:

tapInjector:
  namespaceSelector:
    matchExpressions:
    - key: control-plane
      operator: DoesNotExist

linkerd-jaeger:

webhook:
  namespaceSelector:
    matchExpressions:
    - key: control-plane
      operator: DoesNotExist

Looks like this error still occurs with linkerd check even though I've applied the above configuration:

‼ pod injection disabled on kube-system
    kube-system namespace needs to have the label config.linkerd.io/admission-webhooks: disabled if injector webhook failure policy is Fail
    see https://linkerd.io/2.10/checks/#l5d-injection-disabled for hints

Thank you!

[dadjeibaah]

@johnmckenna, I'm not totally sure if this would be helpful but would applying this suggestion here #3305 (comment) solve your issue? It looks like there is a label you can apply to the kube-system namespace so that it doesn't get picked up by the injector

[johnmckenna]

@dadjeibaah unfortunately not, Microsoft's AKS changes the kube-system namespace and removes any labels that you add. That's why they recommend to exclude the namespace in their FAQ that I mentioned above using the namespaceSelector.

[olix0r]

If I understand correctly, this is tracked by #5022. I think think is likely a big change, but we'd be eager to help support this.