Add istio inject false label

[ljluestc]

Add sidecar.istio.io/inject: "false" Label and Annotation to ksniff Pod (#164)

Description

Fixes #164

This PR adds the sidecar.istio.io/inject: "false" label and annotation to the ksniff pod's ObjectMeta in kube/kubernetes_api_service.go to prevent Istio sidecar injection in namespaces with auto-injection enabled (istio-injection=enabled). The ksniff pod, used for network sniffing with tcpdump and Wireshark, is privileged and should not include the istio-proxy sidecar, which could interfere with its functionality.

Changes

• Modified kube/kubernetes_api_service.go in the CreateSniffingPod function (around line 123).
• Added sidecar.istio.io/inject: "false" to the Labels map (standard for Istio >= 1.11).
• Added sidecar.istio.io/inject: "false" to the Annotations map for compatibility with older Istio versions (<1.11).
• Preserved existing metadata fields (GenerateName, Namespace, other labels).

Why Both Label and Annotation?

• Istio >= 1.11 uses the sidecar.istio.io/inject label to control sidecar injection (Istio issue #40512).
• Older versions (<1.11) rely on the annotation (Stack Overflow reference).
• Including both ensures compatibility across Istio versions.

Testing

1. Environment Setup:

   • Set up a Kubernetes cluster (e.g., Minikube, Kind, or EKS).
   • Install Istio with auto-injection enabled in a test namespace:

     kubectl create namespace test-namespace
     kubectl label namespace test-namespace istio-injection=enabled

   • Build the modified ksniff binary:

     go build -o kubectl-sniff main.go
     mv kubectl-sniff /usr/local/bin/

2. Test in Istio-Enabled Namespace:

   • Deploy a test pod:

     kubectl -n test-namespace run test-pod --image=nginx

   • Run ksniff:

     kubectl sniff test-pod -n test-namespace

   • Verify no istio-proxy container:

     kubectl -n test-namespace describe pod -l app=ksniff

   • Confirm labels/annotations:

     kubectl -n test-namespace get pod <ksniff-pod-name> -o yaml

     Expected: sidecar.istio.io/inject: "false" in metadata.labels and metadata.annotations.

3. Test in Non-Istio Namespace:

   • Create a namespace without Istio injection:

     kubectl create namespace no-istio
     kubectl -n no-istio run test-pod --image=nginx
     kubectl sniff test-pod -n no-istio

   • Verify ksniff works and no sidecar is injected.

4. Edge Cases:

   • Tested with Istio <1.11 to confirm annotation compatibility.
   • Ran ksniff on multiple pods to ensure no performance regression.

5. Cleanup:

   kubectl delete namespace test-namespace no-istio