Repository: kumahq/kuma
Pull request #1078 (2020-10-14 15:47:49)

Backporting fixes
### Summary

Backport of
* Exclude injection by labels
* Ready endpoints
* A small change that make Kuma work with the newest K8S


Patch:
diff --git a/app/kumactl/cmd/install/install_control_plane.go b/app/kumactl/cmd/install/install_control_plane.go
index 330f95291..d85f91e06 100644
--- a/app/kumactl/cmd/install/install_control_plane.go
+++ b/app/kumactl/cmd/install/install_control_plane.go
@@ -182,8 +182,13 @@ func validateArgs(args InstallControlPlaneArgs) error {
 func autogenerateCerts(args *InstallControlPlaneArgs) error {
 	if args.AdmissionServerTlsCert == "" && args.AdmissionServerTlsKey == "" {
 		fqdn := fmt.Sprintf("%s.%s.svc", args.ControlPlaneServiceName, args.Namespace)
-		// notice that Kubernetes doesn't requires DNS SAN in a X509 cert of a WebHook
-		admissionCert, err := NewSelfSignedCert(fqdn, tls.ServerCertType)
+		hosts := []string{
+			fqdn,
+			fmt.Sprintf("%s.%s", args.ControlPlaneServiceName, args.Namespace),
+			args.ControlPlaneServiceName,
+			"localhost",
+		}
+		admissionCert, err := NewSelfSignedCert(fqdn, tls.ServerCertType, hosts...)
 		if err != nil {
 			return errors.Wrapf(err, "Failed to generate TLS certificate for %q", fqdn)
 		}
diff --git a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
index 4f3cd493a..6ed642dea 100644
--- a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
+++ b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
@@ -164,6 +164,12 @@ runtime:
     injector:
       # if true runs kuma-cp in CNI compatible mode
       cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
+      # list of exceptions for Kuma injection
+      exceptions:
+        # a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
+        labels:
+          openshift.io/build.name: "*"
+          openshift.io/deployer-pod-for.name: "*"
       # SidecarContainer defines configuration of the Kuma sidecar container.
       sidecarContainer:
         # Image name.
@@ -275,7 +281,6 @@ dnsServer:
   # The CIDR range used to allocate
   CIDR: "240.0.0.0/4" # ENV: KUMA_DNS_SERVER_CIDR
 
-
 # Multicluster mode
 multicluster:
   global:
diff --git a/pkg/config/plugins/runtime/k8s/config.go b/pkg/config/plugins/runtime/k8s/config.go
index dd8687359..6f977488c 100644
--- a/pkg/config/plugins/runtime/k8s/config.go
+++ b/pkg/config/plugins/runtime/k8s/config.go
@@ -57,6 +57,13 @@ func DefaultKubernetesRuntimeConfig() *KubernetesRuntimeConfig {
 				ExcludeInboundPorts:  []uint32{},
 				ExcludeOutboundPorts: []uint32{},
 			},
+			Exceptions: Exceptions{
+				Labels: map[string]string{
+					// when using DeploymentConfig instead of Deployment, OpenShift will create an extra deployer Pod for which we don't want to inject Kuma
+					"openshift.io/build.name":            "*",
+					"openshift.io/deployer-pod-for.name": "*",
+				},
+			},
 		},
 	}
 }
@@ -91,6 +98,14 @@ type Injector struct {
 	CNIEnabled bool `yaml:"cniEnabled" envconfig:"kuma_runtime_kubernetes_injector_cni_enabled"`
 	// Cnfiguration for a traffic that is intercepted by sidecar
 	SidecarTraffic SidecarTraffic `yaml:"sidecarTraffic"`
+	// Exceptions defines list of exceptions for Kuma injection
+	Exceptions Exceptions `yaml:"exceptions"`
+}
+
+// Exceptions defines list of exceptions for Kuma injection
+type Exceptions struct {
+	// Labels is a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
+	Labels map[string]string `yaml:"labels" envconfig:"kuma_runtime_kubernetes_exceptions_labels"`
 }
 
 type SidecarTraffic struct {
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
index a041a4f8c..d546025ae 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	runtime_k8s "github.com/kumahq/kuma/pkg/config/plugins/runtime/k8s"
+	"github.com/kumahq/kuma/pkg/core"
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 
 	"github.com/pkg/errors"
@@ -31,6 +32,8 @@ const (
 	serviceAccountTokenMountPath = "/var/run/secrets/kubernetes.io/serviceaccount"
 )
 
+var log = core.Log.WithName("injector")
+
 func New(cfg runtime_k8s.Injector, controlPlaneUrl string, client kube_client.Client) *KumaInjector {
 	return &KumaInjector{
 		cfg:             cfg,
@@ -52,11 +55,13 @@ func (i *KumaInjector) InjectKuma(pod *kube_core.Pod) error {
 	if err != nil {
 		return errors.Wrap(err, "could not retrieve namespace for pod")
 	}
-	if inject, err := needInject(pod, ns); err != nil {
+	if inject, err := i.needInject(pod, ns); err != nil {
 		return err
 	} else if !inject {
+		log.V(1).Info("skip injecting Kuma", "name", pod.Name, "namespace", pod.Namespace)
 		return nil
 	}
+	log.Info("injecting Kuma", "name", pod.Name, "namespace", pod.Namespace)
 	// sidecar container
 	if pod.Spec.Containers == nil {
 		pod.Spec.Containers = []kube_core.Container{}
@@ -87,7 +92,12 @@ func (i *KumaInjector) InjectKuma(pod *kube_core.Pod) error {
 	return nil
 }
 
-func needInject(pod *kube_core.Pod, ns *kube_core.Namespace) (bool, error) {
+func (i *KumaInjector) needInject(pod *kube_core.Pod, ns *kube_core.Namespace) (bool, error) {
+	log.WithValues("name", pod.Name, "namespace", pod.Namespace)
+	if i.isInjectionException(pod) {
+		log.V(1).Info("pod fulfills exception requirements")
+		return false, nil
+	}
 	isEnabled := func(enabled string) (bool, error) {
 		switch enabled {
 		case metadata.KumaSidecarInjectionEnabled:
@@ -106,6 +116,16 @@ func needInject(pod *kube_core.Pod, ns *kube_core.Namespace) (bool, error) {
 	return false, nil
 }
 
+func (i *KumaInjector) isInjectionException(pod *kube_core.Pod) bool {
+	for key, value := range i.cfg.Exceptions.Labels {
+		podValue, exist := pod.Labels[key]
+		if exist && (value == "*" || value == podValue) {
+			return true
+		}
+	}
+	return false
+}
+
 func meshName(pod *kube_core.Pod, ns *kube_core.Namespace) string {
 	if mesh, ok := pod.Annotations[metadata.KumaMeshAnnotation]; ok {
 		return mesh
@@ -216,7 +236,7 @@ func (i *KumaInjector) NewSidecarContainer(pod *kube_core.Pod, ns *kube_core.Nam
 					Command: []string{
 						"wget",
 						"-qO-",
-						fmt.Sprintf("http://127.0.0.1:%d", i.cfg.SidecarContainer.AdminPort),
+						fmt.Sprintf("http://127.0.0.1:%d/ready", i.cfg.SidecarContainer.AdminPort),
 					},
 				},
 			},
@@ -232,7 +252,7 @@ func (i *KumaInjector) NewSidecarContainer(pod *kube_core.Pod, ns *kube_core.Nam
 					Command: []string{
 						"wget",
 						"-qO-",
-						fmt.Sprintf("http://127.0.0.1:%d", i.cfg.SidecarContainer.AdminPort),
+						fmt.Sprintf("http://127.0.0.1:%d/ready", i.cfg.SidecarContainer.AdminPort),
 					},
 				},
 			},


Test patch:
diff --git a/pkg/api-server/config_ws_test.go b/pkg/api-server/config_ws_test.go
index f1c802903..ceecf80dc 100644
--- a/pkg/api-server/config_ws_test.go
+++ b/pkg/api-server/config_ws_test.go
@@ -192,6 +192,12 @@ var _ = Describe("Config WS", func() {
                 "sidecarTraffic": {
                   "excludeInboundPorts": [],
                   "excludeOutboundPorts": []
+                },
+                "exceptions": {
+                  "labels": {
+                    "openshift.io/build.name": "*",
+                    "openshift.io/deployer-pod-for.name": "*"
+                  }
                 }
               }
             },
diff --git a/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml b/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml
index 2008b4011..aacca417e 100644
--- a/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml
+++ b/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml
@@ -36,3 +36,7 @@ injector:
   sidecarTraffic:
     excludeInboundPorts: []
     excludeOutboundPorts: []
+  exceptions:
+    labels:
+      openshift.io/build.name: "*"
+      openshift.io/deployer-pod-for.name: "*"
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/injector_test.go b/pkg/plugins/runtime/k8s/webhooks/injector/injector_test.go
index 782f00e68..2e698eeeb 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/injector_test.go
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/injector_test.go
@@ -369,5 +369,22 @@ var _ = Describe("Injector", func() {
                   kuma.io/sidecar-injection: enabled`,
 			cfgFile: "inject.config-ports.yaml",
 		}),
+		Entry("20. skip injection for label exception", testCase{
+			num: "20",
+			mesh: `
+              apiVersion: kuma.io/v1alpha1
+              kind: Mesh
+              metadata:
+                name: default
+              spec: {}`,
+			namespace: `
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: default
+                annotations:
+                  kuma.io/sidecar-injection: enabled`,
+			cfgFile: "inject.config.yaml",
+		}),
 	)
 })
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
index 35998875a..c71273f09 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.01.golden.yaml
@@ -58,7 +58,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -70,7 +70,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
index b000a018e..1cc3bc22b 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.02.golden.yaml
@@ -59,7 +59,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -71,7 +71,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
index 14d666317..7f03d1bbe 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.03.golden.yaml
@@ -118,7 +118,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -130,7 +130,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
index 4f2e2f004..0225b8bf2 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.04.golden.yaml
@@ -58,7 +58,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -70,7 +70,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
index 495248a2c..50b87dbbe 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.05.golden.yaml
@@ -55,7 +55,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -67,7 +67,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
index e8243daf1..a441592da 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.06.golden.yaml
@@ -59,7 +59,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -71,7 +71,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
index 35998875a..c71273f09 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.07.golden.yaml
@@ -58,7 +58,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -70,7 +70,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
index 9e76bd267..c374ca037 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.08.golden.yaml
@@ -61,7 +61,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -73,7 +73,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
index 6b958e067..2f9bb3631 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.09.golden.yaml
@@ -60,7 +60,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -72,7 +72,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
index e51b8455a..15f5b19dd 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.11.golden.yaml
@@ -59,7 +59,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -71,7 +71,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
index 0fa30973d..b7f7ae787 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.12.golden.yaml
@@ -58,7 +58,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -70,7 +70,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
index 400b1c304..c754808cf 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.13.golden.yaml
@@ -58,7 +58,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -70,7 +70,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
index ab21b5389..7aad7b1d4 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.17.golden.yaml
@@ -60,7 +60,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -72,7 +72,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
index 590afb775..1f8768a4c 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.18.golden.yaml
@@ -60,7 +60,7 @@ spec:
           command:
             - wget
             - -qO-
-            - http://127.0.0.1:9901
+            - http://127.0.0.1:9901/ready
         failureThreshold: 212
         initialDelaySeconds: 260
         periodSeconds: 25
@@ -72,7 +72,7 @@ spec:
           command:
             - wget
             - -qO-
-            - http://127.0.0.1:9901
+            - http://127.0.0.1:9901/ready
         failureThreshold: 112
         initialDelaySeconds: 11
         periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
index d05b9051f..26e7bbb79 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.19.golden.yaml
@@ -60,7 +60,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 212
       initialDelaySeconds: 260
       periodSeconds: 25
@@ -72,7 +72,7 @@ spec:
         command:
         - wget
         - -qO-
-        - http://127.0.0.1:9901
+        - http://127.0.0.1:9901/ready
       failureThreshold: 112
       initialDelaySeconds: 11
       periodSeconds: 15
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
new file mode 100644
index 000000000..c98b65e09
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.golden.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  creationTimestamp: null
+  labels:
+    run: busybox
+    openshift.io/deployer-pod-for.name: "1234"
+  name: busybox
+spec:
+  containers:
+  - image: busybox
+    name: busybox
+    resources: {}
+    volumeMounts:
+    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      name: default-token-w7dxf
+      readOnly: true
+  volumes:
+  - name: default-token-w7dxf
+    secret:
+      secretName: default-token-w7dxf
+status: {}
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.input.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.input.yaml
new file mode 100644
index 000000000..9d3177edd
--- /dev/null
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.20.input.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox
+  labels:
+    run: busybox
+    openshift.io/deployer-pod-for.name: "1234"
+spec:
+  volumes:
+  - name: default-token-w7dxf
+    secret:
+      secretName: default-token-w7dxf
+  containers:
+  - name: busybox
+    image: busybox
+    resources: {}
+    volumeMounts:
+    - name: default-token-w7dxf
+      readOnly: true
+      mountPath: "/var/run/secrets/kubernetes.io/serviceaccount"
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.config.yaml b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.config.yaml
index eb116ee27..52174f597 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.config.yaml
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/testdata/inject.config.yaml
@@ -31,3 +31,6 @@ sidecarContainer:
 initContainer:
   enabled: true
   image: kuma/kuma-init:latest
+exceptions:
+  labels:
+    "openshift.io/deployer-pod-for.name": "*"