Istio: Automatic Sidecar Injection failing on release-1.0 branch

[douglas-reid]

Describe the bug
In a new cluster, I generated istio.yaml file via:

$ helm template install/kubernetes/helm/istio --name istio --namespace istio-system --set grafana.enabled=true --set tracing.enabled=true --set tracing.jaeger.enabled=true --set telemetry-gateway.grafanaEnabled=true --set telemetry-gateway.prometheusEnabled=true  > istio.yaml

After labeling the default ns for injection, ran:

$ kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
...
$ kubectl apply -f samples/bookinfo/platform/kube/bookinfo-db.yaml
...

Observed the following:

$ kubectl get pods
No resources found.

Investigated via:

$ kubectl describe rs mongodb-v1-787d5d8494
Name:           mongodb-v1-787d5d8494
...
Conditions:
  Type             Status  Reason
  ----             ------  ------
  ReplicaFailure   True    FailedCreate
Events:
  Type     Reason        Age                From                   Message
  ----     ------        ----               ----                   -------
  Warning  FailedCreate  31s                replicaset-controller  Error creating: Pod "mongodb-v1-787d5d8494-n9d9b" is invalid: spec.containers[1].env[5].name: Invalid value: "ISTIO_METAB64_a3ViZXJuZXRlcy5pby9saW1pdC1yYW5nZXI=": a valid environment variable name must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit (e.g. 'my.env-name',  or 'MY_ENV.NAME',  or 'MyEnvName1', regex used for validation is '[-._a-zA-Z][-._a-zA-Z0-9]*')
  Warning  FailedCreate  31s                replicaset-controller  Error creating: Pod "mongodb-v1-787d5d8494-kn4d5" is invalid: spec.containers[1].env[5].name: Invalid value: "ISTIO_METAB64_a3ViZXJuZXRlcy5pby9saW1pdC1yYW5nZXI=": a valid environment variable name must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit (e.g. 'my.env-name',  or 'MY_ENV.NAME',  or 'MyEnvName1', regex used for validation is '[-._a-zA-Z][-._a-zA-Z0-9]*')
...

It appears a newly-added ENV VAR relies on Base64 encoding, which is failing validation.

Expected behavior
Pods to be created without issue.

Steps to reproduce the bug
See above.

Version

$ istioctl version
Version: 1cf70be08b73dd2e3849c43e69411df316d78c54
GitRevision: 1cf70be08b73dd2e3849c43e69411df316d78c54
User: <redacted>
Hub: docker.io/istio
GolangVersion: go1.11rc2
BuildStatus: Clean

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.7", GitCommit:"0c38c362511b20a098d7cd855f1314dad92c2780", GitTreeState:"clean", BuildDate:"2018-08-20T10:09:03Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"9+", GitVersion:"v1.9.7-gke.6", GitCommit:"9b635efce81582e1da13b35a7aa539c0ccb32987", GitTreeState:"clean", BuildDate:"2018-08-16T21:33:47Z", GoVersion:"go1.9.3b4", Compiler:"gc", Platform:"linux/amd64"}

Installation
With helm template. See above.

Environment
GKE

Cluster state

[geauxvirtual]

Using Istio containers with a tag of release-1.0-20181025-09-15, seeing something similar with regards to automatic sidecar injection.

Events:
  Type     Reason        Age                 From                    Message
  ----     ------        ----                ----                    -------
  Warning  FailedCreate  98s (x35 over 11m)  statefulset-controller  create Pod test-0 in StatefulSet test failed error: Pod "test-0" is invalid: spec.containers[1].env[10].name: Invalid value: "ISTIO_META_statefulset.kubernetes.io/pod-name": a valid environment variable name must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit (e.g. 'my.env-name',  or 'MY_ENV.NAME',  or 'MyEnvName1', regex used for validation is '[-._a-zA-Z][-._a-zA-Z0-9]*')

[stale[bot]]

This issue has been automatically marked as stale because it has not had activity in the last 90 days. It will be closed in the next 30 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[stale[bot]]

This issue has been automatically closed because it has not had activity in the last month and a half. If this issue is still valid, please ping a maintainer and ask them to label it as "help wanted". Thank you for your contributions.