<p>Is there a way to disable service links globally. There's a field in <code>podSpec</code>:</p>
<pre><code>enableServiceLinks: false
</code></pre>
<p>but it's <code>true</code> by default. I couldn't find anything in kubelet to kill it. Or is there some cool admission webhook toolchain I could use</p>

<p>You can use the Kubernetes-native policy engine called <a href="https://kyverno.io/" rel="nofollow noreferrer">Kyverno</a>. Kyverno policies can validate, <strong>mutate</strong> (see: <a href="https://kyverno.io/docs/writing-policies/mutate/" rel="nofollow noreferrer">Mutate Resources</a>), and generate Kubernetes resources.</p>
<p>A Kyverno policy is a collection of rules that can be applied to the entire cluster (<code>ClusterPolicy</code>) or to the specific namespace (<code>Policy</code>).</p>
<hr />
<p>I will create an example to illustrate how it may work.</p>
<p>First we need to install Kyverno, you have the option of installing Kyverno directly from the latest release manifest, or using Helm (see: <a href="https://kyverno.io/docs/introduction/#quick-start" rel="nofollow noreferrer">Quick Start guide</a>):</p>
<pre><code>$ kubectl create -f https://raw.githubusercontent.com/kyverno/kyverno/main/definitions/release/install.yaml
</code></pre>
<p>After successful installation, we can create a simple <code>ClusterPolicy</code>:</p>
<pre><code>$ cat strategic-merge-patch.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: strategic-merge-patch
spec:
  rules:
  - name: enableServiceLinks_false_globally
    match:
      resources:
        kinds:
        - Pod
    mutate:
      patchStrategicMerge:
        spec:
          enableServiceLinks: false

$ kubectl apply -f strategic-merge-patch.yaml
clusterpolicy.kyverno.io/strategic-merge-patch created

$ kubectl get clusterpolicy
NAME                    BACKGROUND   ACTION   READY
strategic-merge-patch   true         audit    true
</code></pre>
<p>This policy adds <code>enableServiceLinks: false</code> to the newly created Pod.</p>
<p>Let's create a Pod and check if it works as expected:</p>
<pre><code>$ kubectl run app-1 --image=nginx
pod/app-1 created

$ kubectl get pod app-1 -oyaml | grep &quot;enableServiceLinks:&quot;
  enableServiceLinks: false
</code></pre>
<p>It also works with <code>Deployments</code>, <code>StatefulSets</code>, <code>DaemonSets</code> etc.:</p>
<pre><code>$ kubectl create deployment deploy-1 --image=nginx
deployment.apps/deploy-1 created

$ kubectl get pod deploy-1-7cfc5d6879-kfdlh -oyaml | grep &quot;enableServiceLinks:&quot;
  enableServiceLinks: false
</code></pre>
<p>More examples with detailed explanations can be found in the <a href="https://kyverno.io/docs/writing-policies/" rel="nofollow noreferrer">Kyverno Writing Policies documentation</a>.</p>
