K8s Advanced K8S 119 · 16 min

Mutating webhook injects a sidecar into completed Jobs and the cleanup controller loops on already-finished pods

The platform team adds injection globally, but batch workloads begin failing cleanup because completed pods no longer match the assumptions of the controller.

Pro

시나리오

The platform team adds injection globally, but batch workloads begin failing …

구독하면 이어서 볼 수 있어요

이 문제의 전체 시나리오와 점검 체크리스트, 복구 순서, 모범 풀이는 Pro 구독에서 열립니다.

구독 안내 보기

다음으로 이어서 보기 좋은 문제

내 풀이

저장됨

1 · 원인 분석 2 · 복구 방안 3 · 재발 방지

풀이 기록·힌트·북마크는 로그인하면 계정에 저장되어 웹·앱에서 이어집니다.

Mutating webhook injects a sidecar into completed Jobs and the cleanup controller loops on already-finished pods

A custom mutating webhook adds a sidecar to every pod, but the Jobs that already specify restartPolicy OnFailure now exceed the expected init sequence

A mutating webhook uses timeoutPolicy Ignore, and objects slip through partially mutated so only some pods receive the expected sidecar configuration

A node-local registry mirror serves a cached schema1 image manifest, and only older worker images can still pull it after the upstream fix

A mutating webhook injects runtime labels that a later affinity rule needs, but scheduling decisions happen before those labels exist during a failover rehearsal