Add a way to add annotations to batch/v1 / Job object templates

[lhotari]

Currently it's not possible to add annotations to batch/v1 / Job object templates.
Adding such annotations would be a cleaner way to support Istio than the extraInit solution presented in #688.

Generic example of using sidecar.istio.io/inject: "false" in a Job to prevent Istio from injecting a sidecar proxy.

apiVersion: batch/v1
kind: Job
metadata:
  name: my-job
spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      restartPolicy: Never
      containers:
        - name: worker
          image: my-image:latest

According to Claude:

The reason you typically want this on Jobs is the classic sidecar-lifecycle problem: with the old (non-native) sidecar model, the Envoy proxy keeps running after your main container exits, so the pod never reaches Completed and the Job hangs indefinitely. Disabling injection sidesteps that entirely when the Job doesn't need mesh connectivity.

If the Job does need to talk to mesh services, then instead of disabling injection you'd want to handle proxy shutdown. On Kubernetes 1.28+ with Istio 1.19+, native sidecars (Envoy as a restartPolicy: Always init container) solve this automatically — the sidecar is torn down when the main containers finish. Otherwise the traditional workaround is to have your app call the proxy's quit endpoint (curl -sf -XPOST http://localhost:15020/quitquitquit) on completion.

For Jobs that require Istio mesh connectivity, there should be a separate way to add a post command in values.yaml so that curl -sf -XPOST http://localhost:15020/quitquitquit could be added as the last command.