Repository: Azure/azure-workload-identity (go)

Issue:
Prepend proxy sidecar to the container list to prevent application restarts
[Currently](https://github.com/Azure/azure-workload-identity/blob/37dc12fdf67ec0bd54d3e3f5c24273a0207707e8/pkg/webhook/webhook.go#L236C7-L236C7), proxy sidecar gets added to the end of the containers list. In this case, the application container may crash a couple of times before the sidecar becomes available.

I suggest prepending the sidecar to the containers list (by swapping containers and corev1.Container{...} in append call), which will block all other containers due to the post-start hook in the sidecar.

Pull request description:
fix: prepend proxy sidecar container to prevent application container restarts
To fix application container startup errors due to incorrect container ordering (proxy sidecar will be triggered last instead of first).

fixes #1101

This PR builds on top of https://github.com/Azure/azure-workload-identity/pull/1102 and fixes the unit tests.

Patch:
diff --git a/pkg/webhook/webhook.go b/pkg/webhook/webhook.go
index d056611..5b7ed3a 100644
--- a/pkg/webhook/webhook.go
+++ b/pkg/webhook/webhook.go
@@ -233,7 +233,7 @@ func (m *podMutator) injectProxySidecarContainer(containers []corev1.Container,
 	}
 
 	logLevel := currentLogLevel() // run the proxy at the same log level as the webhook
-	containers = append(containers, corev1.Container{
+	containers = append([]corev1.Container{{
 		Name:            ProxySidecarContainerName,
 		Image:           strings.Join([]string{imageRepository, ProxyImageVersion}, ":"),
 		ImagePullPolicy: corev1.PullIfNotPresent,
@@ -265,7 +265,7 @@ func (m *podMutator) injectProxySidecarContainer(containers []corev1.Container,
 			ReadOnlyRootFilesystem: pointer.Bool(true),
 			RunAsNonRoot:           pointer.Bool(true),
 		},
-	})
+	}}, containers...)
 
 	return containers
 }


Test patch:
diff --git a/pkg/webhook/webhook_test.go b/pkg/webhook/webhook_test.go
index 2dba329..e25f503 100644
--- a/pkg/webhook/webhook_test.go
+++ b/pkg/webhook/webhook_test.go
@@ -1128,11 +1128,11 @@ func TestInjectProxySidecarContainer(t *testing.T) {
 				},
 			},
 			expectedContainers: []corev1.Container{
+				proxySidecarContainer,
 				{
 					Name:  "my-container",
 					Image: "my-image",
 				},
-				proxySidecarContainer,
 			},
 		},
 	}